Privacy Policy

1.1 This Privacy Policy ("Policy") is issued by EDULEDGA INNOVATIONS LIMITED, a company incorporated in Nigeria under the Companies and Allied Matters Act 2020 with registration number RC 9591803, whose registered office is at BDPA, Benin City, Edo State, Nigeria ("EduLedga", "we", "us" or "our").

1.2 This Policy explains how we collect, use, disclose, store, protect and delete personal data when you:

(a) visit our website at eduledga.io or any of its sub-domains (the "Website");

(b) request access to, or use, our public demonstration environment at eduledga.io/demo (the "Demo");

(c) use the EduLedga school-management platform, web application and related services (the "Platform") as a proprietor or director, principal, headmaster, bursar, teacher, parent or guardian, student, class monitor or school administrator;

(d) contact us for sales, onboarding, support or any other reason; or

(e) are a contact person at a school or organisation that buys, or is considering buying, our services.

1.3 This Policy is written to meet the transparency requirements of section 27 of the Nigeria Data Protection Act 2023 ("NDPA") and Article 27 of the NDPC General Application and Implementation Directive 2025 ("GAID"). It should be read together with our Cookie Policy, our Terms of Service and, for school users, your school's own privacy notice.

1.4 A notice is not a request for consent. Where we need your consent, we ask for it separately, in a clear and specific way, with an option to decline (Article 27(4) and Article 17 GAID).

2.1 In this Policy, the following words have the meanings given below. Words defined in the NDPA (such as "personal data", "sensitive personal data", "processing", "data controller", "data processor" and "data subject") have the same meaning here.

3.1 EduLedga is a product of EDULEDGA INNOVATIONS LIMITED (RC 9591803). The company was founded by Ajieh C. Daniel and Ajiroghene Praise Jesuhovie.

3.2 Contact details. All privacy, data protection, security and support requests are handled through one address so that nothing is lost:

3.3 Data Protection Officer. Our Data Protection Officer, designated under section 32 NDPA, is Ajay Chukuniku Daniel, who can be reached at privacy@eduledga.com (which routes to hello@eduledga.com) or on 0814 373 1505.

3.4 NDPC registration. EduLedga's registration with the Nigeria Data Protection Commission (NDPC) as a data controller and/or data processor of major importance (section 44 NDPA; Articles 8 and 9 GAID) is ongoing. The registration number will be provided on request once issued.

4.1 EduLedga has two different roles, depending on the data concerned. Understanding this matters because it decides who you should contact and who is responsible.

4.2 Where your School is the controller and EduLedga is the processor. Your School decides why and how School Data is processed. This includes:

(a) pupil and student records (name, admission number, class, campus, date of birth, sex, photograph where uploaded, guardian links);

(b) attendance registers;

(c) scores, assessments, results, report cards and promotion records;

(d) timetables, class lists and subject allocations;

(e) school fees, invoices, payment status and receipts;

(f) announcements and messages sent by the School;

(g) parent and guardian contact details and relationships;

(h) staff details held by the School as employer; and

(i) any Annual School Census / EMIS return prepared by the School using our DNEMIS module.

We process School Data only on the School's documented instructions, under the DPA, as required by section 29 NDPA and Article 34 GAID. Your School's own privacy notice explains its purposes, lawful bases and retention periods. Requests about School Data should be sent to your School. If you send them to us, we will pass them to your School promptly and help it respond.

4.3 Where EduLedga is the controller. We decide why and how the following data is processed, and we are responsible for it:

(a) account and security data for every Platform user (login identifier, hashed password, sessions, sign-in history, device and browser information, IP address, security and audit logs);

(b) consent records we keep to prove consents and acknowledgements given for EduLedga purposes;

(c) customer and billing data about Schools as our customers (contract details, billing contacts, number of students billed, invoices, Paystack payment references);

(d) Website and cookie data (see our Cookie Policy);

(e) Demo data: the email address, consent record and activity status of visitors to eduledga.io/demo;

(f) sales, onboarding and support data (enquiries, call notes, messages, tickets);

(g) marketing data (newsletter and product-update subscriptions, marketing preferences), only where you have opted in; and

(h) product analytics and error data that we use to keep the Platform working and to improve it.

4.4 Paystack. Card and bank details entered to pay school fees or EduLedga subscription fees are collected directly by Paystack Payments Limited ("Paystack") under Paystack's own terms and privacy policy. EduLedga does not receive or store full card numbers, card security codes, PINs or one-time passwords. We receive the payment status, amount, date, payer email or reference and a transaction reference.

5.1 Summary table. The table below summarises the main categories of personal data, why they are processed, who is the controller and the lawful basis. Retention is described in section 10 and in our Data Retention & Deletion Policy.

5.2 Data we receive from others. Most School Data is entered by the School (for example by bulk import from a spreadsheet). Parents, guardians and staff may also update their own details. We receive payment confirmations from Paystack, and delivery reports from Brevo (email and SMS) and the Meta WhatsApp Business Platform. We do not buy personal data from data brokers.

5.3 Students without email addresses. Schools can import students who have no email address. Those students sign in with a username or admission-number-based identifier issued by the School. Communications about them go to their linked parents or guardians.

5.4 Sensitive personal data. We do not require any sensitive personal data to provide the Platform. If a School chooses to record health, special-needs, religious or disciplinary information, the School must have a lawful ground under section 30 NDPA, and access to those fields is restricted by role.

6.1 Where we act as processor for a School, we use School Data only to provide the Platform features the School has switched on and to support the School, including: maintaining records across one or more campuses; importing students (including those without email); taking attendance (including QR-code attendance); recording scores and producing results and report cards; promotion workflows; timetables; fee invoicing and collection through Paystack; announcements; in-app, email, SMS and WhatsApp notifications; analytics dashboards and predictive AI insights for the School; AI-assisted lesson notes, AI report-card comments, AI exam-question generation and the AI student tutor; certificates with verification codes (tamper-resistant and blockchain-ready); online admissions; School websites; an audit trail of changes to records; and (where the School instructs) preparing statutory returns such as the Annual School Census.

6.2 Where we act as controller, we use EduLedga Data to:

(a) create and secure user accounts, authenticate users and prevent unauthorised access;

(b) provide, maintain, troubleshoot and improve the Platform, including using error logs and aggregated, de-identified usage statistics;

(c) bill Schools, collect subscription payments through Paystack, keep accounting and tax records and issue receipts;

(d) record consents and acknowledgements and honour withdrawals;

(e) give visitors access to the Demo and, where they have agreed, follow up;

(f) send marketing, newsletters and product updates to people who have opted in;

(g) respond to enquiries, support requests, complaints and data subject requests;

(h) detect, investigate and prevent fraud, abuse, security incidents and breaches of our terms;

(i) comply with legal obligations, court orders and lawful requests from regulators; and

(j) establish, exercise or defend legal claims.

6.3 What we do not do. We do not: sell personal data; use School Data for advertising; build marketing profiles of students, parents or staff; allow third parties to target adverts on the Platform; use School Data to train general-purpose artificial intelligence models; or make decisions about students that produce legal or similarly significant effects solely by automated means.

6.4 Predictive AI insights and automated processing. Where a School uses predictive insights, the Platform analyses School Data inside EduLedga, such as attendance and score trends, to produce advisory indicators and projections of scores, failure rates and pass rates for the next term, and of education outcomes for the School. These indicators and projections are computed by EduLedga's own self-hosted model within EduLedga's own infrastructure; no data is sent to any external AI provider for this purpose. The indicators are for authorised staff (for example, that a student's attendance has dropped) and: (a) are shown only to staff whose role permits it; (b) are never shown to other students or used for marketing; (c) do not by themselves produce any decision about a student; and (d) must be reviewed by a person before any action is taken. No decision that produces legal or similarly significant effects for a student, parent or staff member (such as promotion, repetition, exclusion, fee penalties or disciplinary action) is made solely by automated means (section 37 NDPA). You may ask for human review of any indicator, express your view and contest it by contacting your School or hello@eduledga.com. See our AI & Automation Notice.

6.5 Blockchain-ready certification. The Platform can produce certificates and results with a verification code. If verification is extended to a blockchain or other tamper-evident ledger, only a one-way cryptographic fingerprint (hash) of the document will be recorded, never names, dates of birth, scores or other personal data, so that the School will still be able to correct or delete the underlying record (Article 43(2)(b) GAID). Certificates are designed to be tamper-resistant and hard to forge or alter, and are ready for blockchain anchoring; they are not currently recorded on any blockchain. The safeguards in this paragraph will apply if anchoring is introduced, and we will update this Policy before then.

6.6 Audit trail. The Platform keeps an audit trail of changes to records (for example score and attendance changes, role changes, imports, settings changes and payment reconciliations), recording the user, the action and the time. At present the audit trail records changes, not every occasion on which a record is viewed. The audit trail protects students and staff by making changes traceable, and is used for security, dispute resolution and compliance.

6.7 AI and pupil data. EduLedga uses two AI systems. (a) DeepSeek (AI drafting of lesson notes and, where enabled, teacher-reviewed comment suggestions). Lesson-note preparation uses a trained model provided by DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.), through its API at api.deepseek.com. Lesson-note requests contain curriculum content (class, subject, term, week, topic, sub-topics, objectives and teaching guidance), not pupil records. Where a School enables AI comment suggestions, DeepSeek also receives the minimum performance information needed to suggest a report-card comment: the pupil's first name, average score, class position, attendance rate and strongest and weakest subjects. No surname, admission number, date of birth, contact details or sensitive data is sent, and every suggested comment is reviewed and edited by a teacher before use. DeepSeek processes data in the People's Republic of China (as stated in DeepSeek's published privacy policy, last updated 10 February 2026). There is no NDPC adequacy decision for China and DeepSeek does not offer data processing terms, so EduLedga does not rely on adequacy or contractual clauses under section 41 NDPA. Lesson-note requests contain no personal data and are not a transfer of personal data under Part VIII NDPA. Comment suggestions are a cross-border transfer of a child's personal data, which EduLedga makes only where the pupil's parent or guardian (or the pupil, if 18 or over) has given and not withdrawn consent after being informed of the possible risks (section 43(1)(a) NDPA; Article 18(1)(e) GAID). The School collects that consent before it enables the feature, and the feature stays off for any pupil without it. DeepSeek's developer terms do not state whether API inputs are used for training, so this is EduLedga's own commitment, not a DeepSeek guarantee: EduLedga does not use School Data to train any general-purpose model, and it minimises what it sends to DeepSeek (no personal data in lesson-note requests; only the fields listed above for comment suggestions). DeepSeek is listed as a sub-processor in our Sub-processor List. (b) Analytics and predictive insights, and all other AI features, run on EduLedga's own self-hosted model within EduLedga's own infrastructure on our Hostinger servers in France. Teachers and staff review all AI output before it is used, and the NDPA applies to all AI processing in the same way as to any other processing. AI features use only the data needed for the task, and users are told not to type unnecessary personal details into them. School Data is not used to train or fine-tune any general-purpose AI model, is not sold and is not used for advertising or profiling. All the ordinary rules of the NDPA (lawful basis, minimisation, security, retention and your rights) apply to AI processing in the same way as to any other processing on the Platform. See our AI & Automation Notice and AI Data Processing Notice.

7.1 We process personal data only where a lawful basis under section 25(1) NDPA and Article 16 GAID applies. For EduLedga Data we rely on:

(a) performance of a contract with you or with the School you represent (for example providing the subscription and user accounts);

(b) compliance with a legal obligation (for example tax and accounting records, security obligations under section 39 NDPA, breach notification under section 40 NDPA, responding to lawful orders);

(c) legitimate interests, only after a written Legitimate Interest Assessment under Article 26 GAID, and never where those interests are overridden by your rights or go beyond what you would reasonably expect (section 25(2) NDPA). We rely on legitimate interests for platform security, fraud prevention, essential error logging and managing our business relationships with Schools; and

(d) consent, for marketing, non-essential cookies, Demo access and any other processing for which Article 18 GAID requires consent.

7.2 For School Data, the School decides and is responsible for its lawful basis as controller.

8.1 Many people whose data is held on EduLedga are Children. The NDPA gives Children special protection (section 31 NDPA), and nothing in our processing is intended to conflict with the Child's Rights Act 2003, including the child's right to privacy and the principle that the best interests of the child are a primary consideration.

8.2 In particular:

(a) a student under 18 should only be given their own Platform login after a parent or legal guardian has given consent (section 31(1) NDPA; Article 18(1)(d) GAID). The School collects this consent using our Parent/Guardian Consent Form (on paper or electronically) and keeps a record; where the Platform's in-app guardian consent screen is available, consent can also be given in the parent account;

(b) we verify age using the date of birth recorded by the School, and verify guardians through the School's guardian links; a School may also check government-approved identification (section 31(2) and (3) NDPA);

(c) if a guardian refuses or withdraws consent, the student's login is disabled, but the School's normal school records are not affected and schooling continues;

(d) students see short, age-appropriate notices (separate versions for under-13s, 13 to 17 year olds and adult students);

(e) we never show adverts to students, never send students marketing, never set optional cookies on student sessions and never profile students for marketing; and

(f) promotion, repetition, exclusion and similar decisions are always made by School staff, not by EduLedga automatically.

8.3 Our Website and Demo are not directed at Children. If we learn that a Child has submitted personal data through the Website or Demo, we will delete it.

8.4 More detail is in our Children & Student Data Notice and Parental Consent Policy.

9.1 We share personal data only as described below, and only to the extent necessary.

9.2 Within your School. Authorised School users see School Data according to their role. For example, a class teacher sees their own classes, the bursar sees fees, and parents see only their own linked children.

9.3 Sub-processors. We use carefully selected service providers who process personal data on our instructions under written contracts that require confidentiality and security. They are:

The current list is kept in our Sub-processor List at eduledga.io/security/sub-processors. We will give Schools at least thirty (30) days' notice before adding or replacing a sub-processor, as set out in the DPA.

9.4 Paystack processes payments as described in paragraph 4.4.

9.5 Education authorities (DNEMIS / EMIS). Our DNEMIS module helps Schools prepare Annual School Census and EMIS returns. Direct electronic submission to government systems is switched off and will remain off until the National Education Management Information System (NEMIS) or the relevant authority has authorised it in writing. When it is enabled, data will only be sent on the School's explicit instruction, and returns contain totals (for example counts by class, age and sex), not individual pupil records. See our DNEMIS/EMIS Government Data Sharing Notice.

9.6 Legal and regulatory disclosures. We may disclose personal data where required by law, a court order or a lawful request from a competent authority (for example the NDPC, a law-enforcement agency acting under the Cybercrimes (Prohibition, Prevention, etc.) Act 2015 as amended, or a tax authority), or where necessary to protect someone's vital interests. Where the request concerns School Data and the law allows, we will tell the School first.

9.7 Professional advisers. Lawyers, auditors and accountants under a duty of confidentiality, where necessary.

9.8 Business transfers. If EduLedga is involved in a merger, acquisition, restructuring or sale of assets, personal data may be transferred to the successor, subject to the same protections. We will give Schools notice before any transfer of School Data.

9.9 We do not sell personal data, and we do not share it for third-party advertising.

10.1 We keep personal data only for as long as is necessary for the purpose for which it was collected (section 24(1)(d) NDPA), and then delete it or irreversibly de-identify it.

10.2 School Data is kept for the duration of the School's subscription and as the School directs. When a subscription ends, the School may export its data for thirty (30) days, after which we delete School Data within ninety (90) days, except where the law requires us to keep it. We take nightly encrypted backups of the database and uploaded files at 02:00 WAT, stored off-server in the European Union, keeping seven (7) daily and four (4) weekly copies (a maximum of 35 days), with a quarterly restore test. Data in backups is therefore deleted within thirty-five (35) days after it is deleted from the live system.

10.3 EduLedga Data retention periods (summary):

10.4 If you ask for data after it has been deleted under this section, we will not be able to provide it. Full details are in our Data Retention & Deletion Policy.

11.1 Hosting in France. The Platform, including its databases, runs on a virtual private server provided by Hostinger in a data centre in France. This means that personal data held on the Platform, including School Data, is transferred from Nigeria to France. Backups are stored in off-server storage in the European Union. Brevo (email and SMS) processes data in France (EU). The Meta WhatsApp Business Platform may process data outside Nigeria and the EU, as shown in our Sub-processor List. DeepSeek processes data in the People's Republic of China (as stated in DeepSeek's published privacy policy, last updated 10 February 2026); the transfer position is explained in paragraph 6.7. Our Acceptable Use Policy forbids users from entering pupils' personal data into lesson-note prompts.

11.2 Legal requirements. Under section 41(1) NDPA, personal data may be transferred out of Nigeria only if the recipient is subject to a law, binding corporate rules, contractual clauses, a code of conduct or a certification mechanism that affords an adequate level of protection with respect to the personal data in accordance with the NDPA, or if one of the conditions in section 43 NDPA applies. We must record the basis for each transfer and the adequacy of protection (section 41(2) NDPA). Article 45 and Schedule 5 GAID explain how adequacy is evaluated.

11.3 Why we consider France adequate. We have assessed France against the factors in section 42(2) NDPA and Schedule 5 GAID, and we consider that it provides an adequate level of protection because:

(a) an effective data protection law is in force: the EU General Data Protection Regulation (Regulation (EU) 2016/679) (GDPR) applies directly in France, supplemented by the French Data Protection Act (Loi Informatique et Libertés of 6 January 1978, as amended) (section 42(2)(d) NDPA);

(b) data subjects have enforceable rights and access to redress: the GDPR grants rights of access, rectification, erasure, restriction, objection and portability, enforceable before the supervisory authority and the courts, and these rights apply regardless of nationality (section 42(2)(a) NDPA);

(c) there is an independent supervisory authority with enforcement powers: the Commission Nationale de l'Informatique et des Libertés (CNIL) (section 42(2)(e) NDPA);

(d) access by public authorities is subject to law and judicial oversight, including the EU Charter of Fundamental Rights and the European Convention on Human Rights (section 42(2)(c) NDPA); and

(e) France has relevant international commitments, including as a party to the Council of Europe Convention 108 on the protection of individuals with regard to automatic processing of personal data (section 42(2)(f) NDPA).

11.4 Contractual protection. In addition, Hostinger processes the data as our processor under written data processing terms that require it to act only on our instructions, keep the data confidential and secure, use sub-processors only under equivalent terms and assist with breaches and data subject rights, consistent with section 29 NDPA and the GDPR.

11.5 Other transfers. For any sub-processor outside Nigeria and outside the European Union, we will rely on an adequacy assessment, contractual clauses or another basis permitted by sections 41 to 43 NDPA, and record it. Where no other basis is available, we will only transfer with your consent after informing you of the possible risks (section 43(1)(a) NDPA).

11.6 You may ask us for a description of the safeguards that apply to any transfer by emailing privacy@eduledga.com.

12.1 We implement appropriate technical and organisational measures under section 39 NDPA, including encryption in transit (TLS/HTTPS), logical separation of each School's data, role-based access control for every Platform role and sub-role, hashed passwords, audit logging, restricted administrative access, regular backups and monitoring. A public summary is in our Security Policy.

12.2 No system is completely secure. Please keep your password private, sign out on shared devices and tell us at once at hello@eduledga.com if you think your account has been compromised.

13.1 If a personal data breach affects School Data, we will notify the School without undue delay and in any event within twenty-four (24) hours of becoming aware of it, and help it meet its own obligations (section 40(1) NDPA).

13.2 Where we are the controller, we will notify the NDPC within seventy-two (72) hours of becoming aware of a breach that is likely to result in a risk to people's rights and freedoms (section 40(2) NDPA; Article 33 GAID), and we will inform affected people immediately, in plain and clear language, where the breach is likely to result in a high risk to them (section 40(3) NDPA). We will also report qualifying cyber incidents to the National Computer Emergency Response Team (ngCERT) within 72 hours of detection, as section 21 of the Cybercrimes Act (as amended in 2024) requires.

14.1 Subject to the NDPA, you have the right to:

(a) be informed about how your personal data is processed (section 27 NDPA);

(b) obtain confirmation and access to your personal data and a copy in a commonly used electronic format (section 34(1)(a) and (b) NDPA);

(c) have inaccurate, out-of-date, incomplete or misleading data corrected (section 34(1)(c) NDPA; Article 36 GAID);

(d) have your data erased (section 34(1)(d) and (2) NDPA; Article 38 GAID);

(e) have processing restricted while a request, objection or legal claim is resolved (section 34(1)(e) NDPA);

(f) object to processing, including an absolute right to object at any time to direct marketing (section 36 NDPA);

(g) withdraw consent at any time, as easily as you gave it, without affecting processing that took place before withdrawal (section 35 NDPA);

(h) not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (section 37 NDPA);

(i) receive your data in a structured, commonly used and machine-readable format and have it transmitted to another controller (section 38 NDPA; Article 37 GAID); and

(j) lodge a complaint with the NDPC (section 46 NDPA; Article 39 GAID).

14.2 How to exercise your rights. Contact us by email to privacy@eduledga.com or hello@eduledga.com, by phone/WhatsApp on 0814 373 1505 or, once available, through Settings → Privacy & consent in the Platform. You may use the form in our Data Subject Rights Request Procedure, but no particular form is required. For School Data, contact your School; we will pass on any request we receive and assist. We will acknowledge your request within seven (7) days and aim to respond in full within thirty (30) days. The NDPA requires a response without constraint or unreasonable delay. We may need to verify your identity, and we will not charge a fee unless a request is manifestly unfounded or excessive or the cost of providing a copy is unreasonable (section 34(1)(b) NDPA).

14.3 Parents and guardians may exercise rights on behalf of their Children under 18.

15.1 Please contact us first at hello@eduledga.com so that we can try to resolve your concern. You may also serve us a Data Subject's Standard Notice to Address Grievance (Article 40 GAID). Our Complaints Policy explains the steps and timelines.

15.2 You have the right to complain directly to the Nigeria Data Protection Commission (ndpc.gov.ng) at any time (section 46 NDPA). Contacting us first is not a condition for complaining to the NDPC.

16.1 We use only strictly necessary cookies to run the Website and Platform. We measure Website traffic with Plausible Analytics, which is cookieless and EU-hosted, and use Google Search Console for aggregate search data. Any optional cookie would be used only with your consent. See our Cookie Policy at eduledga.io/legal/cookies.

17.1 The Website and Platform may link to third-party sites (for example Paystack's checkout pages). We are not responsible for their privacy practices. Please read their policies.

18.1 We may update this Policy. Each version has a version number and effective date. If a change is material, we will tell you in advance through the Platform or by email and, where the law requires, ask for your consent again at your next sign-in. Minor changes (such as corrections or new contact details) will be shown in a notice.

19.1 This Policy is governed by the laws of the Federal Republic of Nigeria, including the NDPA and GAID.

19.2 Any dispute with EduLedga arising from this Policy that cannot be resolved through our Complaints Policy shall be referred to arbitration seated in Lagos, Nigeria, under the Arbitration and Mediation Act 2023, as set out in our Terms of Use. Nothing in this section limits your right to complain to the NDPC, the Federal Competition and Consumer Protection Commission or any other regulator, or any right that cannot be excluded by law.