1. Privacy Summary (At a Glance)
| Who We Are | Azed Labs LTD (RC 9432305), providing the Prismera Edu multi-tenant School Management platform. Registered office: 6, Zoo Road, Kano, Nigeria. |
| Regulatory Roles | Data Processor for student grades, attendance, and school fee records managed by schools. Data Controller for school admin credentials, KYB documents, platform billing, and demo inquiries. |
| What We Collect | School admin credentials, teacher PII, parent contact info, minor student biodata and exam marks, optional student emergency medical flags (blood group, genotype, disabilities), and Paystack payment references. |
| AI & LLM Processing | We integrate Google Gemini Flash for timetable generation, lesson plan drafting, executive insight aggregates, and register OCR. Customer data is not used to train public foundational AI models. |
| Data Sharing | We never sell personal data. Data is shared only with verified infrastructure subprocessors (Google Cloud, Paystack, Render) under strict confidentiality agreements. |
| Your Rights | Under the NDPA 2023, data subjects have the right to access, rectify, port, restrict, or delete personal data, and lodge complaints with the Nigeria Data Protection Commission (NDPC). |
2. Controller vs. Processor Jurisdictional Roles
Under Section 65 of the Nigeria Data Protection Act (NDPA) 2023:
Prismera as a Data Processor
When client schools input student biodata, continuous assessment marks, attendance records, and tuition invoices, the School is the Data Controller. Prismera processes such data strictly on the documented instructions of the School, governed by our Data Processing Agreement.
Prismera as a Data Controller
Prismera acts as an independent Data Controller for school proprietor account registrations, Corporate Affairs Commission (CAC) KYB verification certificates, platform subscription billing with Azed Labs, and website sales/demo inquiries.
3. Categories of Personal Data We Process
- School Administrator Data: First/last name, official email, phone number, role, CAC registration documents, and PBKDF2-hashed passwords.
- Teacher & Staff Data: Full name, employee ID, telephone number, email address, date of employment, subject specializations, and class assignments.
- Parent & Guardian Data: Full name, telephone number (used as unique login ID), email address, physical address, and linked student relationships.
- Student & Minor Educational Records: Name, admission number, date of birth, gender, class arm, daily attendance logs, continuous assessment (CA) marks, term exam scores, behavioral notes, and compiled report cards.
- Emergency Health & Medical Flags: To assist school emergency response, our database supports optional fields: Blood Group, Genotype, and Disabilities. This data is collected with parental authorization, processed exclusively within the isolated school tenant schema, and never used for commercial profiling.
- Financial & Payment Records: School fee schedules, invoice balances, payment history, and Paystack transaction reference tokens.
4. Children's & Minors' Data Safeguards
In compliance with Section 31 of the NDPA 2023 and the Child Rights Act 2003, children are individuals under 18 years of age. Prismera does not directly solicit consent from minor students; we rely on the subscribing School's lawful educational authority (in loco parentis) and parental enrollment contracts.
Strict Prohibition on Commercial Exploitation:Prismera strictly prohibits and will never engage in behavioral ad targeting, commercial profiling, or selling of minor students' personal or academic records.
5. AI Integrations & Subprocessors
Prismera integrates verified infrastructure subprocessors bound by strict confidentiality and data protection covenants:
- Google Gemini AI (Google LLC): Used for automated timetable scheduling, lesson plan generation, executive summaries, fee OCR, and register digitization. Operates under enterprise terms with zero customer data retention for public model training.
- Paystack Payments Limited: Card and bank payment gateway (PCI-DSS Level 1 certified).
- Render Services Inc. / AWS: Cloud container compute and managed PostgreSQL database storage (AES-256 encrypted at rest).
- Termii / Twilio: Transactional SMS dispatch for attendance and fee alerts.
6. Data Retention & Secure Deletion
Personal data is retained in accordance with statutory requirements:
- Academic Transcripts & Grades: Retained for 7 years post-graduation (or permanently archived upon school request).
- Financial Records & Invoices: Retained for 6 years to comply with CAMA 2020 and FIRS tax rules.
- Cybersecurity & Traffic Logs: Retained for 2 years pursuant to Section 38 of the Cybercrimes Act 2024.
- Temporary AI Register Scans: Purged from temporary memory within 24 to 72 hours of batch import confirmation.
- Account Deletion: Dropping a tenant schema permanently purges all associated school data within 90 days.
7. Data Subject Rights & Grievance Mechanism
Under Sections 34 through 39 of the NDPA 2023, data subjects hold rights of Access, Rectification, Erasure, Restriction, and Data Portability.
To exercise your rights regarding direct Prismera controller data or submit a formal grievance, email our compliance desk at privacy@prismera.ng.
You also have the right to lodge a formal complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng or via email at complaints@ndpc.gov.ng.
8. Contact Information
Azed Labs LTD (RC 9432305)
Attn: Data Protection & Privacy Desk
Address: 6, Zoo Road, Kano, Kano State, Nigeria
Email: privacy@prismera.ng | dpo@prismera.ng