How School Works handles personal data, in line with the Nigeria Data Protection Act / NDPR. Last updated August 2026.
Each School is the data controller for the records of its students, guardians and staff. School Works acts as the data processor operating the platform on the School's behalf.
Student bio-data and photographs, guardian contact details, staff records, attendance, assessment scores and results, fee invoices and payment references, and communications sent through the platform. Payment card details are handled by Paystack and never stored on the platform.
Solely to deliver the school-management functions the School has engaged: admissions, academic records, report cards, fee administration and school communication. Data is never sold or used for advertising.
Each school's data is isolated per tenant, transmitted over HTTPS, with passwords stored using strong one-way hashing. Access follows role permissions set by the School. Nightly backups are retained on a rotation and then removed.
Students, guardians and staff may exercise access, correction and erasure rights through their School, which controls the records. The platform provides the School with a per-student export, and erasure tools that remove personal details on request. Where a record carries invoices or enrolment history, those rows are kept — the school has its own accounting and academic retention obligations — but they no longer identify anybody.
Records are kept while the School's tenant remains active. On cancellation, the School may export its data; tenant data and rotating backups are then deleted within 30 days.
Data questions should go first to the School (the controller). Platform-level enquiries reach School Works via the published contact details.