Privacy Policy

1. Who this policy covers, and who is responsible

This policy explains how TOCEL Enterprise Ventures Ltd (RC 8898939), of 35, Off Ossai Street, Behind Karika Fuel Station, Otokutu, Delta State, which operates the Tocademy platform (we, us), handles personal information, in line with the Nigeria Data Protection Act 2023 (NDPA) and the rules made under it.

• Account information — the details of the person who registers a school, of the school's administrators, and of the school's billing — we are the data controller: we decide why and how it is used.
• School records — pupils, guardians, applicants, staff, attendance, examinations, results, fee records, uploaded files and messages a school keeps on the platform — the school is the data controller and we are its data processor: we act on the school's documented instructions, including our Terms of Service and any agreement the school has signed with us. Questions about how a particular school uses your information should go to that school first; section 9 says how we help.

2. What we collect

From the school and its administrators

• the school's name, type, state and local government area, address, logo and branding;
• the registering person's name, email address and phone number, and the same for each administrator and staff member given an account;
• subscription, invoice and payment records — the plan, amounts, dates and the payment reference returned by the payment processor; we do not receive or store card numbers.

Entered by the school about the people in its care

• pupils' names, dates of birth, sex, admission details, class, photograph, attendance, assessments, examinations, results and report cards, and health or special-needs notes where the school records them;
• guardians' names, relationship to the pupil, phone numbers, email addresses and fee records;
• applicants' details and documents, where the school runs admissions on the platform;
• staff members' names, roles, contact details, qualifications and signatures where the school records them, and, where the school uses HR and payroll, employment and pay records.

Automatically

• sign-in records (time, IP address, device type), activity and access logs, and error logs — kept to keep accounts secure and the platform working;
• a session cookie that keeps you signed in, a cookie that remembers your school's address, and — for staff of a school with more than one campus — a cookie that remembers which campus you last worked in, kept for a year. We use no advertising or cross-site tracking cookies.

3. How we use it

• to provide the platform to the school and to the people it gives accounts to;
• to identify the school and sign people in, including sending one-time codes by email or SMS;
• to invoice the school and to process payments through a licensed payment processor;
• to send the messages a school asks us to send on its behalf — attendance alerts, fee notices, results, announcements;
• to send the school service messages about its account: verification, sign-in details, invoices, renewals, and changes to the service or these terms;
• to keep the platform secure, to detect and stop abuse, and to fix faults;
• to meet our legal obligations, including keeping accounting records.

We may use aggregated or anonymised technical statistics that identify no one to plan capacity, keep the platform secure and improve it. We do not use school records for marketing, profiling or advertising, and we do not sell personal information to anyone.

4. Our lawful bases

For account information we rely on the contract with the school (to provide and bill the service), our legitimate interests (keeping the platform secure and improving it) and our legal obligations (accounting and tax records). For school records we act on the school's documented instructions; the school is responsible for its own lawful basis, its privacy notices, and any consent required from a pupil's parent or guardian.

5. Who we share it with

We share personal information only with the service providers (sub-processors) we need to run the platform, each under terms that limit what they may do with it:

• Microsoft Azure — hosting: where the platform, its database and files run and backups are kept;
• Zoho ZeptoMail — email delivery: verification codes, invitations, receipts and notices (hosted in the European Union);
• SmsLive247 — SMS delivery, when a text is sent;
• Paystack — payment processing for the school's subscription and for fees parents pay online; it receives the amount, a reference and the payer's contact details and handles card details itself;
• Flutterwave — a second payment processor, only where it has been switched on for a payment; it receives the same details as Paystack;
• Google Firebase, Apple and browser push services — delivery of phone and browser notifications, where the person has allowed them;
• Honeycomb — error and performance tracing, where enabled (hosted in the United States);
• Anthropic and OpenRouter — AI drafting, only for the AI features a school switches on, as section 6 explains.

We keep this list up to date and tell schools before we add a provider. We also disclose information where the law requires it — to a court, a regulator or a law enforcement agency with lawful authority — and, if our business is ever sold or merged, to the new owner under the same commitments. Within the platform, a school's information is visible only to that school's own users; no other school can see it.

6. AI features

AI drafting helps staff write lesson notes, questions, announcements, letters, summaries and report-card remarks. Each feature is off until the school switches it on, and staff review every draft before it is used. Before anything is sent to an AI provider, the platform checks it and refuses to send names, email addresses, phone numbers, admission or staff numbers, or anything matching a person on the school's roll. The check cannot recognise very short names or identifiers (a name of one or two letters, or a number of two or three characters), so staff should not type such details into an AI request. For report-card remarks it sends a pupil's scores, attendance and the teacher's note under a placeholder such as "Student 1"; the link back to the pupil stays on our servers. The school keeps a record of each AI request — who asked, which feature and provider, and what kind of data was involved — but not the text itself.

7. Where it is kept and for how long

The platform is hosted in Microsoft Azure data centres, and some of the providers in section 5 process information outside Nigeria. We transfer information abroad only on a basis the NDPA recognises, with the safeguards it requires, such as the provider's contractual commitments.

We keep a school's records while its agreement with us is in force. When it ends, its users can no longer sign in. For 30 days afterwards we provide the school's records on written request in the platform's standard export formats. After that we keep the records only for lawful purposes — the invoice, payment and audit records Nigerian accounting and tax law requires, disputes and security — and do not delete them merely because the agreement ended, so a school that returns finds them intact. A school that wants its records erased writes to us: we carry out the erasure as an explicit, recorded action, keeping only what the law requires, and taking account of legal holds, payment-processor records and time-limited recovery backups. A school that registered but never finished setting up may have its account and records removed after a reasonable period. Sign-in and error logs are kept for a limited period for security and then discarded.

8. How we protect it

Every connection to the platform is encrypted. Passwords are stored only as salted hashes; one-time codes expire within minutes and are locked after repeated wrong attempts. Each school's records are kept apart from every other school's at the database level. Access to production systems is limited to the staff who need it and who are bound to keep it confidential, and changes to financial and audit records are guarded so they cannot be altered silently. Pupil photographs, staff signatures and admission documents are served only to signed-in users of the school that owns them; the images a school places on its own public website are public because the school published them.

If we become aware of a breach affecting personal information, we tell the schools affected without undue delay, give them the information we have, and make the reports the NDPA requires of us to the Nigeria Data Protection Commission; we help schools tell the people concerned.

9. Your rights

Under the NDPA you may ask:

• to see the personal information held about you, and to receive a copy;
• to have inaccurate information corrected;
• to have your information deleted, or its use restricted, where there is no longer a good reason to keep it;
• to object to a particular use, and to withdraw a consent you gave earlier;
• to receive information you provided in a form you can take elsewhere.

For your school account, write to us at the address in section 13 and we will respond within the time the NDPA allows. For records a school keeps about you or your child, ask the school: it is the controller. Parents and pupils can make access, correction and deletion requests through the portal, and the school must answer within 30 days. The school corrects records on the platform itself; a request to erase a person's records goes from the school to us, and we carry it out as an explicit, recorded action on the school's instruction, keeping only what the law requires. Help beyond the platform's standard tools, such as a custom extraction, may be charged to the school at an agreed, reasonable rate where the law allows. You may also complain to the Nigeria Data Protection Commission.

10. Children

Most of the people whose information schools keep on the platform are children, and pupils use the platform themselves: their timetable, results, homework and computer-based tests. What a pupil enters during a test — answers, the submission, and the test's own record of when the pupil left the screen — is collected directly from them, as part of their school's records and with the school as controller.

Where a school turns on webcam photos for an online exam, the candidate is asked first, can decline or withdraw at any time and still sit the exam, and photos are taken only after they agree. The photos are deleted automatically: 30 days after the result is released; 30 days after the exam closes where the school does not use a release step and the result is final; 90 days after the exam closes where the result is never released or marked; and a little later only where a result was voided.

We rely on each school to obtain whatever consent from parents or guardians the law requires, and we design the platform so that a child's information is seen only by their own school and their own guardians. We never advertise to children.

11. Cookies

We use cookies only to keep you signed in, to remember your school's address between visits, and — for staff of a school with more than one campus — to remember which campus you last worked in, a preference kept for a year. They carry no advertising identifiers and are not shared with anyone. Blocking them will stop you signing in.

12. Changes to this policy

We may update this policy as the service or the law changes. The date at the top says when it last changed; where a change is material we tell schools at least 30 days beforehand, by email and through the dashboard.

13. Contact

TOCEL Enterprise Ventures Ltd, 35, Off Ossai Street, Behind Karika Fuel Station, Otokutu, Delta State, Nigeria. Privacy questions, requests and complaints: info@tocel.ng.