SchoolOS is a school management platform run by OSARTech, a subsidiary of Osso Engineering LTD (“we”, “us”). This policy explains what personal data the platform holds, why, who it is shared with, how long it is kept and the rights you have. It is written for schools and for the staff, students and parents who use SchoolOS.
1. Who is responsible for your data
Your school decides what student, parent and staff data is entered into SchoolOS and what it is used for. Under the Nigeria Data Protection Act 2023 (NDPA) the school is the data controller of that data.
We run the platform for the school and process that data on its instructions, as its data processor. We are the controller only for the data we need to run our own business: the school's contact and billing details, the accounts of our own staff, and website visitors' enquiries and applications.
If you are a parent, student or member of staff, your first point of contact about your data is your school. You can also contact us (see Contact us).
2. What we hold
| Who | Data |
|---|---|
| Students | Name, admission number, gender, date of birth, class, passport photograph, scores, results, report cards, attendance figures, teacher comments, behaviour ratings, subject choices, fee bills and payments. |
| Parents | Name, phone number, email address (optional), the children linked to them, fee payments and transfer receipts they upload, notification preferences. |
| Staff | Name, email, phone, gender, role and class or subject assignments, signature (if uploaded for report cards), actions taken in the app. |
| Schools | Name, address, contacts, logo, head's name and signature, bank accounts for fees, subscription and payment records. |
| Everyone who signs in | Sign-in name, password (stored only as a one-way hash), sign-in times, IP address and browser, security and audit logs, questions typed into the help assistant. |
3. Why we use it, and on what basis
- To provide the service the school has contracted for: results, report cards, fees, timetables, documents and parent and student portals (performance of a contract with the school; the school's legitimate interest in running its education services).
- To send notices the school has switched on: results ready, payments received, fee reminders, by email, SMS, WhatsApp or push. Parents choose their channels on their Notifications page and can switch them off.
- To keep accounts secure: sign-in checks, password resets, audit trails and fraud prevention (legitimate interest; legal obligation).
- To bill schools for their subscription and for SMS and WhatsApp use (contract).
- To support users and fix problems reported to us (legitimate interest).
We do not sell personal data, and we do not use students' or parents' data for advertising.
4. Who it is shared with
Data is visible inside the platform only to the people the school's set-up allows: for example, a teacher sees their own classes, a parent sees only their own children. To run the platform we use these service providers, each bound to protect the data and use it only for the service:
| Provider | What for |
|---|---|
| Our web hosting provider | Hosting the application and its database. |
| Brevo (Sendinblue SAS, France) | Sending email. |
| Termii (Nigeria) | Sending SMS, where the school uses it. |
| Meta Platforms (WhatsApp Business) | Sending WhatsApp messages, where the school uses it. |
| Paystack (Nigeria) | Online fee and subscription payments, where used. Card details go to Paystack, never to us. |
| Browser push services (Google, Apple, Mozilla, Microsoft) | Delivering push notifications to devices where they are switched on. |
| Groq, Inc. (USA) | AI assistant answers, only where the school's plan includes them: the question you type and the help text for your page are sent to it. Please do not type personal details into the assistant. |
We may also disclose data where the law requires it, or to protect the safety of a child or the security of the platform.
5. Data outside Nigeria
Some providers above process data outside Nigeria. Where they do, we rely on the transfer safeguards allowed by the NDPA, such as contractual protections and the provider's own data protection commitments.
6. How long we keep it
- School records (results, report cards, fee records) are kept while the school uses SchoolOS, because they form the student's academic and financial history.
- When a school leaves, it can export its data. We then delete or anonymise it within 90 days, except what we must keep by law (for example, billing records).
- Security and error logs are kept for a limited period and then cleared.
- Notification records and assistant questions are kept for as long as the school needs them for its records and support, and are cleared periodically.
7. How it is protected
Access is by individual accounts with roles; passwords are stored only as one-way hashes; all traffic uses HTTPS; each school's data is kept separate; sign-ins are rate-limited; and sensitive actions are recorded in audit logs. No system is perfectly secure: if a breach affects your data, we will tell the school and, where required, the Nigeria Data Protection Commission.
8. Children's data
Most students are children. Their data is entered by their school, and parents see their own children's records. We process it only to provide the school's education services, and we apply the protections above to it.
9. Your rights
Under the NDPA you can ask to:
- see the personal data held about you, and get a copy;
- have wrong or incomplete data corrected;
- have data erased, or its use restricted, where the law allows;
- object to a use of your data, and withdraw any consent you gave (for example, to SMS or WhatsApp messages);
- receive your data in a portable format.
How to ask: ask your school office. The school reviews the request under Privacy Requests and the platform team completes it. If you cannot reach your school, email us. You may also complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
10. Cookies
We use only the cookies needed to keep you signed in and to protect forms (a session cookie and a security token). We do not use advertising or tracking cookies.
11. Changes to this policy
We may update this policy as the platform or the law changes. The date at the top shows the latest version; significant changes will be announced to schools.
12. Contact us
OSARTech, a subsidiary of Osso Engineering LTD
Otigba Street, Ikeja, Lagos 101233, Nigeria
Email: osartech3@gmail.com · Phone: 07013174646