Privacy Policy
How SKULOS handles personal information, and the rights you have over it.
This policy explains how SKULOS collects, uses, protects and shares personal information when schools and their communities use our platform. We have written it to align with the Nigeria Data Protection Act and the NDPR, the European Union and United Kingdom GDPR, and comparable data protection laws across Africa. Please read it alongside our Terms and Conditions.
Who we are
SKULOS is a cloud based education operating system for schools. In this policy, SKULOS, we, us and our refer to the operator of the platform. You can reach us at any time by email at info@skulosapp.com or on WhatsApp at +234 802 337 3302.
Controllers and processors
Data protection law separates the party that decides why and how personal data is used, the controller, from the party that handles it on the controller's instructions, the processor.
- For the personal data a school enters about its students, parents and staff, the school is the controller and SKULOS acts as its processor, handling that data only to provide the service.
- For the account, subscription and billing data of the people who sign up and administer a school on SKULOS, we act as the controller.
Information we handle
Depending on how the platform is used, this can include:
- Account information, such as name, email address, phone number and password, used to create and secure a login.
- School records that a school chooses to enter, such as student admission details, guardian contacts, staff records, attendance, assessment scores and results.
- Payment information processed through our payment partners when fees or subscriptions are paid. Card details are handled by the payment provider, not stored by us.
- Usage and device information, such as log records, IP address, browser type and actions taken, kept for security and to keep the service reliable.
How and why we use it
We use personal information to provide and secure the platform, to process payments, to send service messages and notifications a school has configured, to provide support, to meet legal obligations, and to improve reliability and safety. Where the law requires a lawful basis, we rely on performance of a contract, your consent, our legitimate interest in running a secure service, and compliance with legal obligations. You can withdraw consent at any time where consent is the basis.
Students and children
Schools use SKULOS to manage records that can include children's data. That data is entered and controlled by the school under its own authority and its relationship with parents and guardians. We handle it strictly on the school's instructions, apply the same protections as for any other personal data, and do not use it for advertising or sell it to anyone.
When we share information
We do not sell personal information. We share it only with service providers that help us run the platform, such as cloud hosting, payment gateways, and email or SMS delivery partners, and only to the extent needed to provide the service. We may also disclose information where the law requires it, or to protect the rights and safety of users and the public.
International transfers
Our infrastructure may process data in more than one country. Where personal information moves across borders, we take steps to ensure it remains protected to a standard consistent with the laws described in this policy, including appropriate safeguards where required.
How we protect information
Security is built into the platform. Every school is given its own dedicated database, so one school can never access another school's data. We apply encryption, permission based access control, and a full audit trail that records who changed what and when. Access to production systems is restricted and monitored. No system can promise perfect security, but we work continuously to protect the information entrusted to us.
How long we keep it
We keep personal information for as long as an account or a school remains active, and for as long afterwards as we need to meet legal, accounting or reporting obligations. When a school leaves, its data can be exported, and is then deleted or anonymised in line with the arrangement with that school.
Your rights
Subject to the applicable law, you have the right to access the personal information held about you, to have it corrected, to have it erased, to receive a copy in a portable format, to object to or restrict certain uses, and to withdraw consent. For data a school controls, please contact the school directly, and we will support the school in responding. For data we control, contact us using the details below and we will respond within the timeframe the law allows.
Cookies and local storage
We keep cookies and local storage to a minimum. We use them to keep you signed in, to remember your light or dark appearance preference, and to keep the service secure. We do not use them for advertising.
Regional notes
We aim to meet the requirements of the data protection laws that apply to the schools we serve, including:
- Nigeria. The Nigeria Data Protection Act and the NDPR, overseen by the Nigeria Data Protection Commission. You may lodge a complaint with the Commission.
- European Union and United Kingdom. The GDPR and UK GDPR, including the lawful bases and data subject rights described above.
- Kenya. The Data Protection Act 2019, overseen by the Office of the Data Protection Commissioner.
- South Africa. The Protection of Personal Information Act, POPIA.
- Ghana. The Data Protection Act 2012, overseen by the Data Protection Commission.
Where a local law gives you stronger rights than this policy describes, that local law applies.
Changes to this policy
We may update this policy as the platform grows or the law changes. When we make a material change, we will update the date at the top and, where appropriate, tell you through the platform.
Contact and complaints
For any question or request about this policy, or to raise a concern, email info@skulosapp.com or message us on WhatsApp at +234 802 337 3302. If you believe your data has been mishandled, you also have the right to complain to the data protection authority in your country.