Anakalice DigitalAll documents

Privacy Policy

Effective date: 10 October 2026

This Privacy Policy explains how Anakalice Digital ("Anakalice", "we", "us", or "our") handles personal data in connection with the Anakalice School Management platform (the "Platform"), a multi-tenant school management service. Our marketing website is at anakalicedigital.com, and each subscribing school is provisioned a dedicated subdomain in the form <school>.anakalicedigital.com.

This policy covers personal data of students (who are minors), their parents or guardians, and school staff, as processed on the Platform.

1. The most important point: who controls the data

For the personal data held on the Platform about students, parents or guardians, and staff:

This means that if you are a parent, guardian, student, or staff member, your first point of contact about your data is usually your School, because the School controls it. We assist the School in responding to you. Our relationship with the School, including our obligations as processor, is set out in our Data Processing Agreement.

Anakalice acts as a controller in its own right only for a limited set of data, such as the account and billing details of the School, information about the School's own Administrators, and data from our marketing website. This policy covers both roles and makes clear which is which.

2. Personal data we process

2.1 Data about students (minors)

Processed on behalf of the School, this may include: name, date of birth, sex, photograph, admission and class information, subjects, attendance records, assessment results and report cards, timetable, fee and payment records, and other records the School chooses to keep for school administration.

2.2 Data about parents and guardians

This may include: name, relationship to the student, contact details (phone, email), and records relating to fee invoices and online payments.

2.3 Data about staff

This may include: name, contact details, role, class and subject assignments, and account and access information.

2.4 Account, billing, and technical data

As a controller, we process: the School's account and billing details, Administrator contact details, and basic technical and usage data needed to run and secure the Platform (for example sign-in records and logs).

2.5 Payment data

When a parent or guardian pays fees online, payment is handled by Paystack. Card and payment-instrument details are collected and processed by Paystack, not stored by Anakalice. We receive confirmation and transaction references needed to verify a payment and mark an invoice as paid.

3. Lawful basis under the NDPA

We process personal data in line with the Nigeria Data Protection Act 2023 (NDPA).

3.1 For data processed on behalf of a School, the School (as controller) is responsible for establishing the lawful basis under the NDPA for the data it collects. Depending on the data, that basis may be consent, performance of a contract, a legal obligation, or legitimate interests, as determined by the School.

3.2 Because students are minors, where the School relies on consent, the School is responsible for obtaining and recording parental or guardian consent and for meeting the NDPA's requirements for children's data.

3.3 Anakalice (as processor) relies on the School's instructions and lawful basis; we do not decide the purposes for that data.

3.4 Where Anakalice acts as a controller (account, billing, Administrator, and website data), our lawful basis is the performance of our contract with the School and our legitimate interest in operating, securing, and improving the Platform, and complying with our own legal obligations.

4. Why we process personal data (purposes)

We process personal data to:

We do not sell personal data, and we do not use student data for advertising.

5. Who we share data with

We share personal data only as needed to run the Platform, and we use the following categories of sub-processors and recipients:

5.1 Paystack (payments). Processes online fee payments and handles payment-instrument data. Used to collect fees and verify payments.

5.2 Hosting provider (Nigerian-operated VPS). The Platform and its data are hosted on a secure virtual private server provided by our hosting provider.

5.3 Email provider. Used to send Platform emails such as notifications, announcements, and account messages, through our email provider.

5.4 The School and its Authorised Users. Data is visible within the School's own tenant to the Administrators, staff, parents, and students the School authorises, at the access levels the School sets.

5.5 Legal and protective disclosures. We may disclose data where required by law, by a lawful request from a competent authority, or where necessary to protect the rights, safety, or security of users, the public, or Anakalice.

We do not share School Data with third parties for their own marketing. A current list of sub-processors is maintained as part of the Data Processing Agreement.

6. Where data is stored and international transfers

6.1 The Platform is hosted on a Nigerian-operated VPS, so School Data is primarily stored in Nigeria.

6.2 Some sub-processors, such as the payment or email provider, may process limited data outside Nigeria. Where any transfer outside Nigeria occurs, it will be handled in line with the NDPA's requirements for cross-border transfers.

7. Data subject rights under the NDPA

Subject to the conditions and exceptions in the NDPA, individuals have the right to:

8. How to exercise your rights

8.1 If the School controls your data (students, parents or guardians, and staff data on the Platform): please contact your School first, because the School is the controller and decides on these requests. As processor, Anakalice will assist the School in responding.

8.2 If Anakalice controls the data (account, billing, Administrator, or website data), or if you cannot reach your School, you may contact our data-protection contact using the details in Section 12. We may need to verify your identity before acting on a request, and we will respond within the timeframe required by the NDPA.

8.3 You also have the right to complain to the NDPC if you believe your data has been handled unlawfully.

9. Retention

9.1 The School, as controller, decides how long student, parent, and staff data is kept on the Platform, in line with its own obligations.

9.2 We aim to keep personal data only for as long as needed to provide the Platform and to meet legal and operational requirements, and to delete or return School Data after a School leaves the Platform. After a School leaves, we keep its data available for export for at least 30 days, then delete or return it. We keep account and billing records for as long as the law requires.

9.3 The School should export any records it needs to keep before its access ends. Data handling on termination is set out in the Terms of Service and the Data Processing Agreement.

10. Security

10.1 We take reasonable steps to protect personal data, at a high level including:

10.2 Backups and resilience. We take automated backups of Platform data every day and store them off-site, and we test that they can be restored. We do not offer a formal uptime or contractual disaster-recovery service level on the standard plans. We recommend that Schools keep their own copies of critical records.

10.3 No system can be guaranteed to be completely secure. We will handle any personal-data breach in line with the NDPA and our Data Processing Agreement, including notifying the School where required.

11. Children's data

11.1 The Platform holds personal data about students who are minors, on behalf of Schools.

11.2 The School is responsible for the lawful basis for processing children's data, including obtaining and recording parental or guardian consent where consent is relied upon, and for meeting the NDPA's requirements for children's data.

11.3 We process children's data only to provide the Platform to the School and on the School's instructions. We do not use children's data for marketing or profiling, and we do not sell it.

11.4 A parent or guardian with a concern about a child's data should contact the School in the first instance, as the School is the controller.

12. Contact and data-protection contact

Anakalice Digital

For data-protection matters, please contact our data-protection contact at info@anakalicedigital.com.

You may also contact the Nigeria Data Protection Commission (NDPC) if you have a complaint about how personal data has been handled.

13. Changes to this policy

We may update this Privacy Policy from time to time. If we make a material change, we will give reasonable notice, for example by email to the School's Administrator or a notice on the Platform. The "Effective date" above shows when this version took effect.