Privacy Policy & GDPR Compliance

1. Overview & Data Controller

This Privacy Policy explains how The Science Model College, Abeokuta (referred to as "the School", "we", "our", or "us") collects, stores, processes, and protects personal data from students, parents, guardians, and staff using the EduTrack portal.

We act as the **Data Controller** for all personal data processed within the platform. All student records are kept secure under data privacy guidelines, including the General Data Protection Regulation (GDPR), Children's Online Privacy Protection Act (COPPA), and local regulations like the Nigeria Data Protection Regulation (NDPR).

2. Data We Collect

We only collect and process personal data necessary to provide academic registration, tracking, billing, grading, and portal communications:

• Student Information: Full name, date of birth, grade/class level, admission number, attendance logs, exam answers, academic marks, and psychomotor reports.
• Parent & Guardian Information: Full name, relation to student, active email address, phone number, billing address, and transaction logs.
• Staff & Instructor Records: Name, qualifications, job titles, department, monthly salaries, next of kin details, and attendance logs.
• Technical Telemetry: IP addresses, browser info, device tokens for mobile sessions, and transaction timestamps.

3. Children's Data & COPPA Compliance

As an educational app handling student data, we prioritize the protection of minors:

• Verifiable Consent: Student accounts are created solely by designated School Administrators or with verified parental activation. We do not permit independent registrations by children under the age of 13.
• Educational Use Only: All student actions, exam attempts, and assignments are used exclusively for school evaluations and educational support. No personal profiles are used for advertising, tracking, or sold to third parties.
• Parental Rights: Parents or legal guardians hold the absolute right to inspect their child's records, request corrections, or direct the school to purge active accounts.

4. Security Measures & Encryption

We maintain state-of-the-art security practices to defend against data breaches and unauthorized access:

• Access Control: The platform utilizes strict role-based permission locks to ensure that students and parents cannot view records belonging to other tenants.
• Password Security: User passwords are encrypted using secure Bcrypt hashing algorithms before database storage. Plaintext or MD5 passwords are strictly forbidden.
• Payment Integrity: Credit card details are never saved on our server. All billing transactions are encrypted and processed statelessly via Paystack API using HMAC-SHA512 webhook signature verification.
• Upload Protections: File uploads (e.g. lesson notes and student submissions) are validated using strict extension Whitelisting and binary signature checking to prevent command injection.

5. Data Retention & Purging

We retain student and parent records only as long as required for educational administration and statutory audit reports. When a student graduates or transfers, their records are archived securely. Upon request from an authorized parent/guardian, personal accounts and profiles can be permanently deleted from active systems, subject to legal record-keeping requirements for academic transcripts.

6. Contact & Rights Requests

Under GDPR/NDPR/COPPA regulations, you hold the right to access, rectify, restrict processing, or delete your data records. To file a privacy request or contact our Data Protection Officer, please submit a inquiry through your school administration portal.