Data Processing Agreement

Effective date: 10 October 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between the subscribing school (the "School") and Anakalice Digital ("Anakalice") for the Anakalice School Management platform (the "Platform"). It governs the processing of personal data carried out by Anakalice on behalf of the School under the Nigeria Data Protection Act 2023 (NDPA).

Where there is a conflict between this DPA and the Terms of Service on a data-protection matter, this DPA prevails on that matter.

1. Roles of the parties

1.1 The School is the data controller. The School determines the purposes and means of processing the personal data of its students (who are minors), parents or guardians, and staff.

1.2 Anakalice Digital is the data processor. Anakalice processes that personal data only on the documented instructions of the School, as set out in this DPA and the Terms of Service, and to provide and support the Platform.

1.3 This DPA does not cover data for which Anakalice is itself a controller (for example the School's account and billing data). That data is handled under the Privacy Policy.

2. Subject matter and duration

2.1 Subject matter. The processing of personal data necessary to provide the Platform's school-management features to the School.

2.2 Duration. This DPA applies for as long as Anakalice processes personal data on behalf of the School, that is, for the duration of the School's subscription and until the data is returned or deleted under Section 11.

3. Nature and purpose of processing

3.1 Purpose. To provide, operate, secure, and support the Platform for the School, including: student records and admissions; staff management; classes and subjects; attendance; results, assessments, and report cards; timetables; fee tracking and online fee collection; parent and student access; announcements; school branding; and general administration.

3.2 Nature of processing. Collection, recording, organisation, storage, retrieval, use, display, transmission, hosting, verification of payments, and, on termination, return or deletion of personal data.

4. Categories of data subjects and personal data

4.1 Data subjects:

• students (minors);
• parents and guardians;
• school staff and Administrators.

4.2 Categories of personal data:

• student data: name, date of birth, sex, photograph, admission and class details, subjects, attendance, assessment results and report cards, timetable, and fee and payment records;
• parent and guardian data: name, relationship, contact details, and payment records;
• staff data: name, contact details, role, class and subject assignments, and account and access data.

4.3 Special or sensitive categories. The School should not store special-category or sensitive data beyond what is necessary for school administration. If any sensitive data is processed, the School is responsible for the additional NDPA requirements that apply, such as for health data held by a school.

5. Processor obligations under the NDPA

Anakalice agrees that it will:

5.1 process personal data only on the documented instructions of the School, including the instructions contained in this DPA and the Terms of Service, unless required to act otherwise by law, in which case it will inform the School where legally permitted;

5.2 process personal data only for the purposes described in Section 3 and not for its own purposes;

5.3 ensure that persons authorised to process the personal data are bound by appropriate confidentiality obligations (Section 6);

5.4 implement and maintain appropriate technical and organisational security measures (Section 7);

5.5 respect the conditions in this DPA for engaging sub-processors (Section 8);

5.6 assist the School, taking into account the nature of the processing, in meeting the School's obligations to respond to data-subject requests and to maintain the security of processing (Section 9);

5.7 notify the School of any personal-data breach affecting the School's data (Section 10);

5.8 at the School's choice, return or delete the personal data at the end of the provision of services (Section 11);

5.9 make available to the School information reasonably necessary to demonstrate compliance with these obligations, and allow for audits as set out in Section 12;

5.10 not sell the School's personal data, and not use it for advertising or profiling.

6. Confidentiality

6.1 Anakalice will keep the School's personal data confidential.

6.2 Anakalice will ensure that its personnel who access the personal data are subject to confidentiality obligations and are instructed to process the data only as needed to provide and support the Platform.

6.3 Access to the School's data by Anakalice personnel is limited to those who need it to deliver, support, or secure the Platform.

7. Security measures

7.1 Anakalice will maintain appropriate technical and organisational measures to protect personal data, at a high level including:

• tenant isolation, so each School's data is kept within its own tenant and subdomain;
• role-based access controls, with access levels set by the School;
• server-side verification of online payments before an invoice is marked paid, so payment status reflects a verified transaction;
• encryption of data in transit over secure connections;
• hosting on a controlled, Nigerian-operated VPS;
• restricting personnel access to data on a need-to-know basis.

7.2 Backups and operational resilience. Anakalice takes automated backups of Platform data every day, stores them off-site, and tests that they can be restored. Anakalice does not offer a formal uptime or availability service level, or a disaster-recovery commitment with a defined recovery time objective (RTO) or recovery point objective (RPO), on the standard plans. The School should keep its own copies of critical data.

7.3 Security measures may evolve. Anakalice will not materially reduce the overall level of security during the term.

8. Sub-processors

8.1 The School authorises Anakalice to engage the following sub-processors to process personal data for the purposes of providing the Platform:

8.2 Anakalice will impose data-protection obligations on each sub-processor that are, in substance, no less protective than those in this DPA.

8.3 Changes to sub-processors. Anakalice will inform the School before adding or replacing a sub-processor, giving the School a reasonable opportunity to object on reasonable data-protection grounds.

8.4 Anakalice remains responsible to the School for the performance of its sub-processors' data-protection obligations.

9. Assistance to the School (controller)

9.1 Data-subject requests. If Anakalice receives a request directly from a data subject (a student, parent, guardian, or staff member) relating to data processed for the School, Anakalice will not respond directly except to confirm that the School is the controller, and will refer or forward the request to the School. Anakalice will provide reasonable assistance to help the School respond within the NDPA's timeframes.

9.2 Security, breach, and impact assessments. Anakalice will provide reasonable assistance to the School with its obligations relating to the security of processing, breach notification, and any data-protection impact assessment or consultation with the NDPC, taking into account the nature of the processing and the information available to Anakalice.

10. Personal-data breach notification

10.1 Anakalice will notify the School without undue delay after becoming aware of a personal-data breach affecting the School's data.

10.2 The notification will include, to the extent known: the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed to address it.

10.3 Where full details are not immediately available, Anakalice will provide information in phases as it becomes available.

10.4 The School, as controller, is responsible for any notification to the NDPC and to affected data subjects that the NDPA requires. Anakalice will assist as set out in Section 9.

11. Return and deletion of data on termination

11.1 On termination or expiry of the School's subscription, Anakalice will, at the School's choice, return the School's personal data or delete it, and delete existing copies, unless retention is required by law.

11.2 Anakalice makes the School's data available for export for at least 30 days after termination, then deletes or returns it.

11.3 The School should export any data it wishes to keep before its access ends.

12. Audit

12.1 Anakalice will make available to the School information reasonably necessary to demonstrate compliance with this DPA.

12.2 The School may audit Anakalice's compliance, on reasonable prior written notice, no more than once per year except where a breach has occurred or a regulator requires it, during business hours, and in a way that does not compromise the security or confidentiality of other schools' data.

13. International transfers

13.1 Personal data is primarily hosted on a Nigerian-operated VPS and stored in Nigeria.

13.2 Where a sub-processor processes data outside Nigeria, Anakalice will ensure the transfer meets the NDPA's requirements for cross-border transfers.

14. Liability

14.1 Each party's liability under this DPA is subject to the limitations and exclusions set out in the Terms of Service, to the extent permitted by Nigerian law.

14.2 Nothing in this DPA relieves the School of its own obligations as controller under the NDPA, including establishing a lawful basis, obtaining parental or guardian consent for minors' data where consent is relied upon, and responding to data subjects.

14.3 Nothing in this DPA limits any liability that cannot lawfully be limited under Nigerian law.

15. Governing law

15.1 This DPA is governed by the laws of the Federal Republic of Nigeria and is subject to the governing-law and jurisdiction provisions of the Terms of Service.

16. Contact

Anakalice Digital

• Website: www.anakalicedigital.com
• Email: info@anakalicedigital.com
• Phone: 08060275165

Data-protection contact: info@anakalicedigital.com.