Privacy Policy

1. Who This Policy Covers

1.1 This Privacy Policy applies to School Administrators, Teachers, and Guardians who create an account on the Platform, and to visitors of our public website at amicaschoolportal.com. It describes what personal data we collect in our capacity as a Data Controller, why we collect it, and the rights you have over it.

1.2 It does not describe how a School processes the personal data of its own students, guardians, and staff within its tenant environment. That processing is governed by the School's own privacy notice to its community (which the School is responsible for providing, per clause 19.3 of our Terms of Service) and by the Data Processing Agreement between the School and Amica.

2. Information We Collect

2.1 Account information

When you register a School or accept an invitation to join one, we collect your name, email address, phone number, and role. School Administrators additionally provide the School's name, subdomain, and address during onboarding.

2.2 Authentication data

We store a salted hash of your password, and a short-lived hashed one-time code (OTP) when you sign in or register. Codes are sent by email, not SMS. We never store OTP codes or passwords in plaintext.

2.3 Billing information

For the School's own platform subscription (separate from guardian fee payments, which are paid through Paystack, Flutterwave, or Monnify and settled to the School's own bank account), we store the subscription plan, payment status, and a Paystack-issued payment reference. Card details are handled entirely by Paystack and are never stored on Platform servers.

2.4 Support communications

If you contact support or raise a support ticket, we collect the content of your message and any attachments you choose to provide, to respond to your request.

2.5 Usage and log data

Our servers automatically log IP address, browser type, device information, pages visited, and timestamps, for security monitoring, fraud prevention, and diagnosing errors. Error events are also sent to Sentry (see Section 6).

2.6 Website analytics

Our public website includes Google Analytics to measure website usage. Google may process browser, device and page-visit information through this integration.

3. How We Use Your Information

We use the information described in Section 2 to:

• Create and administer your account, and authenticate you at login
• Provision and operate your School's tenant environment
• Process your School's platform subscription and send billing notices
• Send transactional emails you have requested (one-time sign-in codes, receipts, account alerts), and SMS once that service is available
• Respond to support requests
• Detect, investigate, and prevent fraud, abuse, and security incidents
• Comply with legal obligations under Nigerian law, including the NDPR and NDPA 2023
• Improve the Platform through aggregated, anonymised usage analysis

We do not sell your personal data, and we do not use it to serve third-party advertising.

4. Legal Basis for Processing

Under the Nigeria Data Protection Regulation 2019 and the Nigeria Data Protection Act 2023, we rely on the following legal bases:

• Contract: processing your account and billing data is necessary to provide the Platform services you or your School have signed up for
• Legitimate interest: security monitoring, fraud prevention, and service improvement, balanced against your rights and interests
• Consent: where we ask for it explicitly, such as optional communications
• Legal obligation: retaining certain records where Nigerian law requires it (for example, financial records for tax purposes)

5. Cookies & Similar Technologies

5.1 We use strictly necessary cookies to keep you signed in and to protect your session (CSRF protection). These cannot be disabled without breaking core functionality of the Platform.

5.2 The public website includes a Google Analytics tag, which may use analytics cookies in addition to the necessary session cookies described above.

6. How We Share Information

6.1 We share personal data only with the service providers necessary to operate the Platform, listed below. Each is bound by a data processing agreement or equivalent contractual safeguard.

6.2 We may also disclose personal data where required by a valid order of a Nigerian court or competent regulatory authority, or where necessary to protect the rights, property, or safety of the Platform, our users, or the public.

6.3 If the Platform is involved in a merger, acquisition, or asset sale, personal data may be transferred as part of that transaction; we will notify affected users before this happens.

7. International Transfers

Our providers operate in several regions, and some are outside Nigeria, including in the United States (for example Resend, Sentry and Railway). Each provider's location is listed in the sub-processor schedule of our Terms of Service. Where personal data is transferred outside Nigeria, we rely on Standard Contractual Clauses or an equivalent recognised transfer mechanism to ensure an adequate level of protection, consistent with NDPR transfer requirements.

8. Data Retention

8.1 We retain your account data for as long as your account is active, and for at least 90 days after your School's subscription ends or is terminated, to allow for data export and account recovery. Deletion is carried out on the School's request or after written notice; it is not automatic.

8.2 Audit logs are append-only. When a School is deleted, the user, IP address and device details on its audit entries are removed and the anonymised entries are kept.

8.3 We retain billing records for the period required by Nigerian tax law.

9. Your Rights

Under the NDPR and NDPA 2023, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data, subject to our legal retention obligations
• Restrict or object to certain processing
• Port your data to another service, in a structured, commonly-used format
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng

To exercise any of these rights, contact us at dpo@amicaschoolportal.com. We will respond within the NDPR-prescribed timeframe of 30 days.

10. Children's Privacy

The Platform is intended for use by School Administrators, Teachers, and Guardians, who must be at least 18 years old. We do not knowingly collect personal data directly from children. Student data is entered and managed by the School and Guardians on a child's behalf, under the Data Processing Agreement described in Section 1, not under this Policy.

11. Security

We apply commercially reasonable technical and organisational measures to protect your personal data, including encryption in transit (TLS 1.2+) and at rest, database-level tenant isolation via PostgreSQL Row Level Security, role-based access control, and audit logging of security-relevant actions and changes to key records. No system is completely secure; if you believe your account has been compromised, contact security@amicaschoolportal.com immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email and update the effective date at the top of this page at least 30 days before the changes take effect. Continued use of the Platform after that date constitutes acceptance of the revised Policy.

13. Contact Us

If you have questions about this Privacy Policy or how we handle your personal data, contact:

• Data protection queries: dpo@amicaschoolportal.com
• General support: support@amicaschoolportal.com
• Legal queries: legal@amicaschoolportal.com

Privacy Policy v1.0: Amica. See also our Terms of Service & Data Processing Agreement · Nigeria Data Protection Commission: ndpc.gov.ng