Privacy & Data Protection Statement

This statement explains how NextFound Academics ("the platform", "we", "us") handles personal data when a school uses the platform to run its entrance examinations, academic records, fees and parent communication. It applies wherever this page is opened — from the platform's own site or from any individual school's portal — because it describes the same practices everywhere.

1. Who we are, and who this covers

NextFound Academics is a software platform used by schools to run entrance examinations, day-to-day school administration, student and parent portals, and fee collection. Each school that uses it — its staff, students, parents, guardians and entrance-examination candidates — is covered by this statement. If you are a parent, student or staff member, your school is the organisation you should contact first about your own information (see section 9); we support your school in answering you.

2. Controller and processor

For the personal data a school enters about its own students, parents, staff and candidates, the school is the data controller: it decides what is collected and why, and it is the organisation a parent or staff member should approach first with a question or a request about their own data. NextFound Academics acts as the school's data processor: we provide and operate the software the school uses to store and process that data, under the school's instructions, and we do not sell it, share it with other schools, or use it for anything beyond running the platform and supporting the school.

3. What personal data is processed

Category	Examples
Student and candidate records	Name, date of birth, gender, class, admission or candidate number, photograph, academic results, attendance, entrance-examination attempts and answers
Guardian and parent contact details	Name, relationship, phone number, email address, SMS number, home address
Staff records	Name, role, contact details, photograph, signature image, login credentials, work assigned to and by them
Financial records	Fees charged, payments recorded, receipts issued, and who recorded them
Communications	Messages between a school and a parent, and the content of the notices sent about results, fees and school work
Technical and usage data	Sign-in times, the IP address a request came from, and a record of significant actions taken in the system (the audit log)

A school decides what it enters; we do not ask schools to collect anything beyond what the platform's own forms request, and we do not add hidden fields to collect more.

4. Why it is processed

• To run the school's entrance examinations, academic records, report cards, assignments and results.
• To record and reconcile fees and payments, and to produce receipts.
• To send parents and guardians the notices they would otherwise be told by phone or letter: a payment received, a report card ready, new work set for their child.
• To let the right staff, and only the right staff, see and change the records their role covers, and to keep a record of who changed what.
• To keep the service itself running securely: sign-in, rate-limiting against guessing, and diagnosing a fault.

5. Legal basis

Personal data is processed under the contract between a school and NextFound Academics, for the school's own legitimate interest in running its administration (and, for its staff and the platform's own security logs, the platform's legitimate interest in keeping the service secure and dependable), and, for anything a person is separately asked to agree to, their consent. Child by child, the school may use the child's photograph in its publicity, send optional messages such as birthday greetings, and share the child's details with WAEC, NECO or the BECE examining body to register them for an external examination. Each is allowed unless a parent says no: a parent can withdraw any of them, or allow it again, at any time in the parent portal (Privacy & my data), or by a signed form the school records. Every decision is kept with its date and how it was given, so the school can show what it was told.

6. How your school's data is kept apart

Every school on this platform has its own separate database and its own separate folder of files — not a shared table filtered by a school identifier, but a database of its own. A query made for one school's data can never accidentally return another's, because the software is built so that no database connection is ever shared between two schools within the same request. A cookie or sign-in issued by one school's address is rejected if it is ever presented at another school's address. Uploaded files (student and staff photographs, signatures, question images) are served only to the people the record says may see them, checked on every request.

7. Security measures

• Passwords are never stored in readable form; they are hashed, and changing a password immediately ends every other sign-in on that account.
• A school's own email server password and SMS API token, where it sets one up, are encrypted before they are stored, under a key specific to that school; they are never shown again once saved, and a copy of the database does not expose them.
• Sign-in attempts, password-recovery requests and test-message buttons are rate-limited against guessing.
• Significant actions — creating or changing a record, a staff member's access, a payment — are written to an audit trail recording who did it, when, and from where.
• The platform loads no advertising or analytics scripts, fonts or images from outside its own servers; its security policy blocks pages from embedding anything foreign.
• Traffic to the platform is encrypted in transit (HTTPS/TLS).

8. Retention and deletion

A school's data is kept for as long as the school's account with the platform remains active, or for as long as applicable law requires records of that kind to be kept, whichever is longer. The School Admin can download every record and file the school keeps at any time (Settings, Export all the school's data), and a school may ask for its data to be deleted once its account ends, subject to any legal or regulatory requirement to retain particular records for a set period (for example, financial records).

When a family asks for a child's data to be erased and the school approves it, the child's name is replaced by a placeholder, and their contact, health and religious details, photograph, sign-in, messages and admission form are removed. Results, attendance and fee records the school must keep stay, under the placeholder name; a parent with no other child at the school is anonymised in the same way. Erasure cannot be undone.

9. Rights over your data

Depending on the law that applies to you, you may have the right to ask to see the personal data held about you, to have inaccurate data corrected, to have it deleted, to object to certain processing, or to receive a copy of it in a portable form. Because your school is the controller of its own records, the quickest route is to ask your school directly. A parent can do so in the parent portal (Privacy & my data): ask for a copy of everything held about a child, or for it to be erased. The school answers within thirty days, and a copy is downloaded from the portal. If you contact us instead, we will pass your request to the relevant school and support them in answering it.

10. Children's data

Much of what a school records is about children. A school is responsible, as controller, for having a proper basis to collect and hold information about the students in its care, in the way it already does for paper records; the platform's role is to hold and process that information securely on the school's behalf, under the same isolation and security measures described above, and to make it visible only to the people the school's own settings say may see it — never to another school, and never to the platform's own staff, other than someone the school has itself entered as an administrator.

11. Cookies and tracking

The platform sets one cookie: a signed session cookie that records who is signed in. It carries no advertising identifier and is not read by any third party. The platform runs no third-party analytics, advertising or tracking scripts of any kind, on any page, for anyone.

12. Sub-processors and delivery channels

Two kinds of message leave the platform on a school's behalf, and only when that school has set them up (or is using the platform's own shared account, where offered, as a stand-in until it sets up its own):

• Email, sent through the mail server the school (or the platform, as a fallback) has configured.
• SMS text messages, sent through BulkSMS Nigeria, using the school's own account where it has one (or the platform's, where the platform provides it). A text carries only a short notice, never a result or a balance.

A school may also give its own developers, or a partner it engages (an accounting system, for example), read-only access to parts of its data through keys its School Admin creates and can revoke at any time, and may have its own systems told when something happens (webhooks, which carry ids, not names or contact details). The school, as controller, decides who that is and is responsible for them.

The underlying database and application hosting is provided by [your infrastructure/hosting provider(s)], acting as a sub-processor under contract with us, bound to the same confidentiality and security expectations as this statement.

13. Where data is hosted

Each school's data is stored on servers operated for this deployment of the platform. [State here where those servers are located, and, if any data ever leaves that country or region, what safeguard covers the transfer.]

14. Changes to this statement

We may update this statement as the platform changes. The date at the top shows when it was last revised, and a material change that affects how personal data is handled will be brought to schools' attention rather than only noted here silently.

15. Contact

Questions about this statement, or about how the platform handles data, can be sent to contact@nextfound.com.ng. A parent, student or staff member asking about their own personal data should start with their school, which holds the records and can act on the request directly.