Privacy Policy

This Privacy Policy explains how Schola Headquaters ("we", "us", "our") collects, uses, discloses, and safeguards information when a School and its users ("you") use ScholaHQ ("the Platform", "the Service").

This Policy should be read together with our Terms and Conditions. By using the Platform, you acknowledge the practices described in this Policy.

ScholaHQ is a multitenant platform. Each School operates within its own isolated organization ("Tenant").

• For account, billing, and platform-usage data relating to the School itself and its administrators, we act as the data controller.
• For student, guardian, and staff personal data that a School enters into the Platform ("Student Data"), the School is the data controller and we act as a data processor, processing that data only on the School's instructions and for the purpose of providing the Service.

If you are a parent, guardian, student, or staff member and have questions about how your data is used within a specific school's account, please contact that school directly, as they control that data.

We collect the following categories of information:

• Account and organization information: school name, administrator names, email addresses, phone numbers, and billing details provided at signup.
• Student and guardian data: entered by the School, which may include names, dates of birth, contact details, academic records, attendance, fee and payment history, and guardian relationships.
• Staff data: names, roles, contact details, and permissions assigned within the organization.
• Usage data: log data, device and browser information, IP address, and interactions with the Platform, collected automatically to maintain security and improve the Service.
• Payment data: where fee collection features are used, payment references and transaction metadata are processed via our payment providers; we do not store full card numbers on our servers.

We use collected information to:

• Provide, operate, and maintain the Platform, including student records, billing, and reporting features.
• Authenticate users and enforce organization-level access controls.
• Process fee payments and generate financial records on behalf of Schools.
• Communicate with organization administrators about their account, billing, or Platform updates.
• Monitor, secure, and improve the Platform, including diagnosing technical issues.
• Comply with legal obligations and enforce our Terms and Conditions.

We do not sell Student Data, and we do not use Student Data to serve advertising.

Where applicable data protection law requires a legal basis, we (or the School, as controller of Student Data) rely on one or more of the following: performance of a contract with the School, the School's legitimate interests in administering education services, compliance with a legal obligation, or consent obtained by the School from parents or guardians where required.

Schools are responsible for ensuring they have a valid legal basis, including any necessary parental consent, before submitting Student Data to the Platform.

We share information only in the following circumstances:

• With service providers who support our infrastructure, such as cloud hosting, payment processing, and email delivery, under contractual obligations to protect the data.
• Within a School's own organization, based on the roles and permissions that organization's administrators assign to their staff.
• Where required by law, regulation, court order, or to protect the rights, safety, or property of ScholaHQ, our users, or others.
• In connection with a merger, acquisition, or sale of assets, subject to equivalent confidentiality protections.

We do not share Student Data with third parties for their own marketing purposes.

We retain Customer Data, including Student Data, for as long as the School's organization account is active, and for a reasonable period afterward to allow for data export, in accordance with our standard retention practices.

Upon a School's request, or upon termination of an account, we will delete or anonymize Student Data within a reasonable timeframe, except where retention is required by law or for legitimate backup and security purposes.

We implement technical and organizational measures designed to protect data against unauthorized access, alteration, disclosure, or destruction, including encryption in transit, access controls, and tenant isolation between organizations.

No method of transmission or storage is completely secure. While we work to protect your information, we cannot guarantee absolute security, and Schools are responsible for maintaining the confidentiality of their own user credentials.

The Platform is designed to store data belonging to students who may be minors, submitted and managed by Schools rather than collected directly from children by us. We rely on Schools to obtain any necessary parental or guardian consent required by applicable law before submitting a student's personal data to the Platform.

We do not knowingly allow students to create their own accounts without school administrator oversight, and we do not use children's data for advertising or profiling unrelated to the educational services provided.

Depending on your role and applicable law, you may have rights to access, correct, export, or request deletion of personal data.

• School administrators can exercise these rights directly within the Platform for data under their organization, or by contacting us.
• Parents, guardians, students, or staff seeking to exercise these rights over Student Data should generally contact the relevant School first, as the School controls that data; we will support Schools in fulfilling such requests.

To make a request directly to us regarding controller data (such as School account or billing information), contact us using the details in Section 13.

Your information may be processed and stored in countries other than your own, including where our hosting and infrastructure providers operate. Where required, we take steps intended to ensure such transfers are subject to appropriate safeguards consistent with applicable data protection law.

We use cookies and similar technologies to authenticate sessions, remember preferences, and understand how the Platform is used. You can control cookies through your browser settings; disabling certain cookies may affect Platform functionality, particularly login sessions.

We may update this Privacy Policy from time to time. Material changes will be communicated to organization administrators via email or an in-app notice at least 14 days before taking effect. Continued use of the Platform after changes take effect constitutes acceptance of the revised Policy.

If you have questions about this Privacy Policy or how your data is handled, please contact us at:

Email: support@scholahq.com Address: Maruba, Abuja