Privacy Policy

1. Introduction

This Privacy Policy explains how Edura (operated by Sorveo Solutions Limited) ("Edura", "we", "us", "our") collects, uses, stores, and protects personal data when you use the Edura school management platform ("the Platform").

Edura is committed to protecting the privacy and security of personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), and the Nigeria Data Protection Regulation (NDPR).

2. Data Controller and Data Processor

Schools that use Edura act as Data Controllers for the personal data of their students, staff, parents, and other school community members. Schools determine the purposes and means of processing this data.

Edura acts as a Data Processor on behalf of schools, processing personal data only as instructed by the school and in accordance with this policy and any applicable data processing agreement.

For data relating to school administrator accounts and billing, Edura acts as the Data Controller.

3. Personal Data We Collect

We collect and process the following categories of personal data:

Account and Identity Data: First name, last name, email address, phone number, password (encrypted), role and designation.

Student Data: Admission number, date of birth, gender, nationality, religion, blood group, home address, previous school, passport photograph, class assignment, house assignment, attendance records, academic results and grades, report cards, fee payment records, and guardian/parent relationships.

Staff Data: Name, email, phone number, designation, role assignments, and employment-related records held within the Platform.

Parent/Guardian Data: Name, email, phone number, relationship to student(s), and communication preferences.

Usage Data: Login timestamps, IP addresses, browser information, pages accessed, and actions performed within the Platform for security and audit purposes.

Billing Data: School billing details, payment transaction records, subscription plan information, and payment gateway references. We do not store full credit card numbers.

4. How We Use Personal Data

We process personal data for the following purposes:

• Providing and operating the school management platform
• Managing student records, attendance, academic results, and report cards
• Facilitating communication between schools, parents, and staff
• Processing fee payments and managing subscriptions
• Sending notifications (absence alerts, fee reminders, report card availability)
• Maintaining platform security, audit trails, and preventing fraud
• Providing customer support
• Improving the Platform through anonymised analytics
• Complying with legal obligations

5. Lawful Basis for Processing

We process personal data under the following lawful bases (GDPR Article 6):

• Contract: Processing necessary to provide the Platform under our agreement with schools.
• Legitimate interests: Platform security, fraud prevention, service improvement, and business operations.
• Consent: Where we rely on consent (e.g. marketing communications), you may withdraw consent at any time.
• Legal obligation: Where processing is required to comply with applicable law.

6. Children's Data and School Responsibility

Edura processes personal data relating to children (students) strictly on behalf of schools in our capacity as a Data Processor. Schools, as Data Controllers, determine the purposes and means of processing student data and are responsible for:

• Ensuring they have an appropriate lawful basis for collecting and processing student personal data under applicable data protection law
• Obtaining any required parental or guardian consent before entering student data into the Platform, where such consent is required by law or by the school's own policies
• Informing parents, guardians, and students about how their data will be processed, including the school's use of Edura as a data processor
• Responding to data subject access requests from parents, guardians, or students regarding school-held data
• Ensuring the accuracy and appropriateness of data entered into the Platform

Edura does not directly collect consent from parents or guardians on behalf of schools. The school is responsible for managing its own consent processes in accordance with its jurisdiction and policies.

We implement appropriate safeguards for children's data, including:

• Restricted role-based access controls ensuring staff can only access data they are authorised to see
• Multi-tenant data isolation preventing any cross-school data access
• Students can only view their own records through the student portal
• Student accounts are created by school administrators, not by children directly
• Audit logging of data access and changes for accountability

7. Data Sharing

We do not sell personal data. We share data only as follows:

• With the school: School administrators and authorised staff can access data for students, parents, and staff within their school.
• Service providers: We use trusted third-party services for email delivery (AWS SES), payment processing (Paystack, Stripe), and cloud hosting (AWS). These providers process data only on our instructions and under appropriate agreements.
• Legal requirements: We may disclose data if required by law, regulation, or valid legal process.

8. International Data Transfers

Edura's servers are hosted within the AWS EU (London) region. Where data is transferred outside the UK or EU (for example, to payment processors), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions.

9. Data Security

We implement appropriate technical and organisational measures to protect personal data, including:

• Encryption of data in transit (TLS/SSL)
• Encrypted password storage (bcrypt hashing)
• Role-based access controls
• Multi-tenant data isolation (each school's data is separated)
• Audit logging of significant data access and changes
• Regular security reviews

10. Data Retention

We retain personal data for as long as necessary to provide the Platform and fulfil the purposes described in this policy. When a school's subscription ends, data is retained in read-only mode for a reasonable period to allow reactivation. Upon request, school data can be permanently deleted.

Audit logs and legal acceptance records are retained for compliance purposes.

11. Your Rights

Under applicable data protection law, you have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate data.
• Erasure: Request deletion of your data (subject to legal retention requirements).
• Restriction: Request restriction of processing in certain circumstances.
• Portability: Request your data in a portable format.
• Objection: Object to processing based on legitimate interests.

For student, parent, or staff data held by a school, please contact your school administrator in the first instance. For account-level requests, contact us at privacy@edura.io.

12. Cookies

Edura uses essential cookies for session management and CSRF protection. We do not use advertising or third-party tracking cookies.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify users through the Platform and request re-acceptance where required.

14. Contact Us

For any questions about this Privacy Policy or data protection matters, contact us at:

Edura (operated by Sorveo Solutions Limited)
Email: privacy@edura.io