Data Protection

The law we follow

We process personal information under the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Commission’s General Application and Implementation Directive. Where a customer outside Nigeria is covered by its own law, we will work with it to meet that law too.

Who is responsible for what

Your rights

• To be told what we collect and why. Our Privacy Policy lists it product by product.
• To get a copy of your information. Every Academium account holder can download theirs from My data on their account page. In SMS only school staff have accounts, so students and parents get their SMS records through the school.
• To have wrong or incomplete information corrected.
• To have your information deleted when we no longer need it or have no lawful reason to keep it.
• To restrict or object to how we use it.
• To receive it in a format another service can read.
• To withdraw consent at any time, including a parent’s consent for a child’s account. Withdrawing does not undo what was lawfully done before.
• Not to be subject to a decision with legal or similar effects made only by a computer. Objective test questions are marked automatically, but what a result means for a student is decided by people at the school.

How to make a request

• Email [email protected] with your name, the product you use, and what you want us to do.
• We may ask you to confirm you own the account, for example with a code sent to its email address. For a child’s account, we deal with the confirmed parent.
• If your request is about school records, we pass it to the school and help it answer.
• We reply within 30 days. Requests are free unless they are clearly unfounded or repeated.

For schools: our commitments as your processor

• We process school records only to provide the services the school chose, and only on its instructions.
• Our staff who handle school records are bound to keep them confidential.
• We tell the school about the service providers who handle its records, and before adding a new one.
• We help the school answer requests from students, parents and staff.
• We tell the school without undue delay if its records are affected by a breach.
• When the service ends, we return the school’s records and then delete our copies, except where the law requires us to keep them.
• A written data-processing agreement setting this out is available on request.

Children’s information

The NDPA treats anyone under 18 as a child. Surepass asks every student for a date of birth and asks a parent to confirm each under-18 account. Until a parent confirms, social features stay locked. A parent can withdraw consent or ask us to delete the child’s account at any time.

• Children’s Safety

Where information goes

With the school-server editions, school records stay on the school’s own hardware unless the school connects them to our portal.

Our portal runs on our own servers in Nigeria, so the records it holds are stored in Nigeria. Traffic to it passes through Cloudflare’s network on the way, to protect it from attacks. If we ever move storage outside Nigeria, we will tell schools first and use only the transfer safeguards the NDPA allows.

If something goes wrong

• We contain the problem and find out what was affected.
• If the breach is likely to put people at risk, we report it to the Nigeria Data Protection Commission within 72 hours of becoming aware of it.
• If the risk to you is high, we tell you directly and in plain words: what happened, what it means for you and what you can do.
• We tell any affected school without undue delay so it can meet its own duties.
• We record every breach, including ones that did not need reporting, and what we changed afterwards.

Complaints

Tell us first at [email protected] and we will try to put it right. You can also complain to the Nigeria Data Protection Commission at any time.

• Email [email protected]
• Nigeria Data Protection Commission