1. Who we are
AkademicNest is a school management platform operated by [TO BE PROVIDED: legal entity name and registration number], of [TO BE PROVIDED: address].
Data protection contact: support@akademicanest.com. Data Protection Officer: [TO BE PROVIDED].
This policy explains what personal information AkademicNest handles, why we handle it, and what happens to it. It covers the school portals, the public school websites and the mobile application.
2. Our relationship with schools
Almost all of the personal information in AkademicNest is entered by a school about its own pupils, parents and staff. The school decides what to record, who may see it, how long to keep it and when to correct it. AkademicNest provides and runs the system in which that happens.
In data protection terms, for that information:
- the school is the controller, because it decides the purposes and means of processing;
- AkademicNest is a processor, because we act on the school's instructions.
For a smaller set of information, which we need to run AkademicNest as a business, AkademicNest is the controller. Section 3 explains which is which.
3. What we collect, and in which role
3.1 School and account information (AkademicNest is controller)
| Data | Source |
|---|---|
| School name, web address, postal address, phone, email, logo, favicon | School registration and settings |
| School Administrator name, email, username, phone, password (stored securely, never in readable form), profile photograph | Registration and profile |
| Subscription plan, status, pupil capacity, dates | Subscription process |
| Payment records, payment method, proof of payment documents, verification notes | Payment submission |
| Support tickets and replies | Support requests |
3.2 Pupil information (school is controller, AkademicNest is processor)
Full name, admission number, gender, date of birth, class, house, address, phone, email, photograph, admission date, notes, active status, portal password (stored securely), and blood group.
Blood group is health information. Under the Nigeria Data Protection Act and comparable laws it is a special category of personal data that attracts stricter conditions. It may be recorded about pupils and about staff. See section 7.
3.3 Parent and guardian information (school is controller)
Name, guardian number, email, phone, photograph, portal password (stored securely), and the pupils they are linked to. Pupil records may also include a guardian name, phone number and email address entered directly on the pupil's record.
3.4 Staff information (school is controller)
Name, staff number, gender, date of birth, role, department, qualification, employment date, emergency contact name and phone number, address, phone, email, photograph, blood group, notes and portal password (stored securely).
3.5 Academic information (school is controller)
Examination records, subjects, scores, grades and positions, teacher and principal remarks, report cards, attendance records, assignments and submissions, computer based tests with their questions, attempts and answers, timetables, teacher diary entries, co-curricular activities, library loans, transport assignments, hostel allocations, fee structures, invoices and fee payments.
3.6 Result access tokens (school is controller)
Tokens issued so that a parent can view one pupil's result for one examination. Tokens are stored in a protected form, with an encrypted copy so that the school can display a token it has issued again. Each use is recorded with the time, the outcome, the IP address and the browser type.
3.7 Digital signatures (school is controller)
An image of a signature drawn by a School Administrator or member of staff, stored against that person's account and printed on documents such as report cards.
3.8 Information from visitors to public school websites (school is controller)
- Contact enquiries: name, email, phone, subject and message.
- Pupil conduct reports: the reporter's name, a description, the location, and up to four attached files (photographs or short videos). Contact details are not required.
3.9 Technical information (AkademicNest is controller)
| Data | Purpose |
|---|---|
| IP address, page visited, referring website, traffic source, device type | Recorded for every web request, whether or not the visitor is signed in, to understand how the platform is used |
| IP address, action, description, acting user | A record of administrative actions |
| IP address and browser type | A record of every result lookup |
| IP address | Held briefly to limit repeated sign in attempts and lookups |
| Session identifier and session data | Keeping you signed in (see section 12) |
| Access tokens | Signing in to the mobile application |
4. Who provides the information
Very little of it is provided by the person it describes. Pupil and staff records are entered by the school, and parent records are created by the school. This means the person the information is about may not know it is held in AkademicNest. Informing them is the school's responsibility, as explained in the School Responsibilities Framework.
5. Why we process it
| Purpose | Categories |
|---|---|
| Creating and running accounts | Account, pupil, staff, guardian |
| Authentication and access control | Credentials, sessions, tokens |
| School administration | Pupil, staff, class, attendance |
| Academic management and result processing | Academic, examination, result tokens |
| Producing documents (report cards, ID cards) | Pupil, academic, signatures, school branding |
| Communication and notifications | Contact details, notices, messages |
| Operating the public school website | Website content, gallery, news, events |
| Handling visitor enquiries and conduct reports | Visitor submissions |
| Subscription and payment verification | Payment records, receipts |
| Preventing payment fraud | Receipt documents |
| Security, rate limiting and abuse prevention | IP addresses, session data |
| Audit and accountability | Audit records |
| Technical support and fault diagnosis | Whatever the fault concerns |
| Understanding platform usage | Page views |
| Legal compliance | As required |
6. Legal basis
For information where AkademicNest is controller, we rely on:
- Contract, to run accounts, subscriptions and payments;
- Legitimate interests, for security, fraud prevention, audit records and understanding platform usage, balanced against the individual's interests;
- Legal obligation, where the law requires us to keep or disclose something.
For information where the school is controller, the school must identify its own legal basis. For a school this will commonly be a public task, a legal obligation, or the performance of its contract with parents. AkademicNest does not obtain consent from pupils or parents and does not rely on consent for this processing.
7. Children's and pupils' information
AkademicNest is a school platform, so much of the information it holds is about children. We treat this information with particular care.
What is held about a pupil: name, admission number, gender, date of birth, photograph, home address, phone, email, class, house, blood group, notes, guardian contact details, attendance, results, grades, remarks, assignments, test attempts, library loans, transport, hostel allocation, fees, and any conduct report a member of the public has submitted about them.
Who enters it: the school, through its administrators and staff.
Who can see it:
| Party | Access |
|---|---|
| School Administrator | All pupil records in that school |
| Staff | Records within their school, limited by role and assignment |
| Pupil | Their own results, attendance, assignments, notices and timetable |
| Parent or guardian | Their linked children's records (Standard plan and above) |
| Anyone with a result token | One pupil's result for one examination, for a limited number of uses |
| AkademicNest Team | Authorised team members, as described in section 10 |
| Another school | Never. This is enforced by the platform |
Who can change it: school administrators and, within limits, staff. Pupils and parents cannot edit their own records directly. They can request changes to their portal profile, which the school approves.
Who can download it: schools can generate and print report cards and ID cards. A result token allows a result to be downloaded.
Retention: see the Data Retention & Deletion Policy.
How it is protected: see section 11 and the Security & Data Handling Statement, including the information there about how photographs and signature images are stored.
Consent. AkademicNest does not obtain parental consent. The school is responsible for having the authority, and any permission required, to record its pupils' information and to publish any photograph on its public website.
8. Third parties
AkademicNest uses a small number of external services, described below.
8.1 Payment receipt checks (no external service)
When a school uploads proof of payment, the receipt is checked automatically on AkademicNest's own servers before a member of our team reviews it.
- What is checked: whether the file can be read, whether it is blank, and, for a PDF, whether it shows payment details and an amount at least equal to what is owed.
- Why: to identify uploads that are clearly not receipts before they reach manual review.
- Where: the receipt is not sent to any outside service. It is stored in private storage and seen only by the AkademicNest Team.
8.2 Bunny Fonts (fonts.bunny.net)
Provides the typeface used in the signed in portals. The visitor's browser requests the font directly, which shares their IP address and browser details with that provider.
8.3 Google Fonts (fonts.googleapis.com, fonts.gstatic.com)
Provides typefaces on public school websites where a school has chosen one. The visitor's browser requests these directly, which shares their IP address with Google. This applies only to Google hosted typefaces. A school that selects one of the standard system fonts causes no such request.
8.4 Email delivery
Notifications may be sent by email through a mail delivery provider: [TO BE PROVIDED].
8.5 Hosting
The platform and its database are hosted by [TO BE PROVIDED: hosting provider and region].
8.6 What we do not use
- No analytics services. We do not use Google Analytics, Tag Manager, the Meta pixel, Hotjar, Segment or similar tools. Page views are recorded in AkademicNest's own database.
- No advertising networks.
- No card processing. No card details are collected or stored by AkademicNest.
- We do not sell personal information, and we do not share it between schools.
9. Sharing
Apart from the services in section 8, personal information is disclosed only:
- to the users a school has authorised, within that school;
- to the holder of a valid result token, for the single result it was issued for;
- to the AkademicNest Team for support, security and payment verification;
- where required by law, or to establish or defend legal claims;
- to a successor organisation on a sale or reorganisation, with notice.
One school can never see another school's data. Every request is checked against the signed in user's school, and access is refused where they do not match.
10. AkademicNest Team access
Members of the AkademicNest Team with the appropriate role can use the administrative tools to view school records and act on them, including deleting a school and everything in it. Administrative actions are recorded with the person responsible, the action taken and the IP address.
Access is governed by role permissions. Team members may access school records only for support, security, payment verification and the operation of the platform.
11. How information is stored and protected
A summary is given here. Full details are in the Security & Data Handling Statement.
- Passwords are stored using strong one way hashing. They are never stored in readable form and cannot be recovered. Passwords must be at least eight characters long and include upper and lower case letters, a number and a symbol.
- Result tokens are stored in a protected form with a separately encrypted copy.
- Files: payment receipts and conduct report attachments are held in private storage. Photographs of pupils, staff and guardians, school logos, gallery images and signature images are held at long, random addresses that cannot be guessed. Anyone who has the address of one of these files can open it, so addresses should not be shared.
- Connections use HTTPS in production, with HSTS.
12. Sessions and cookies
Full details are in the Cookie & Browser Storage Policy. In summary: a session cookie is required to sign in; school portal sessions end after three minutes of inactivity; a "remember me" option is available; and no analytics or advertising cookies are set.
13. Retention
Full details are in the Data Retention & Deletion Policy. Records are held for as long as a school's subscription is active and until deletion is requested. Operational records such as audit records, page views and result lookup records are currently kept without a fixed deletion date. We intend to introduce automatic retention limits.
14. Deletion and other rights
Depending on the law that applies, you may have the right to access, correct, erase, restrict or object to the use of your personal information, or to receive a copy of it in a portable format.
Where to send a request:
- Pupils, parents and staff should contact their school, which decides what is recorded about them and is the controller for it. AkademicNest cannot act on such a request without the school.
- School Administrators may contact AkademicNest about their own account.
- If a school asks us to help with a request it has received, we will.
Please note:
- A school may be required by education law, or by its own obligations, to keep academic records, and may refuse deletion on that basis.
- Deletion of a school's account is permanent and cannot be reversed by us.
- A bulk export feature is not currently available. A school wanting a copy of its records should contact us to arrange it.
You may also complain to a data protection authority. In Nigeria this is the Nigeria Data Protection Commission.
15. International transfers
Font requests to Bunny Fonts and Google share visitors' IP addresses with servers outside Nigeria. Payment receipts are not sent outside AkademicNest.
Whether the database itself is stored outside Nigeria depends on the hosting arrangement: [TO BE PROVIDED].
16. Automated decision making
Payment receipts are checked automatically (section 8.1). The check can reject an upload, for example by telling the school that the document does not look like a receipt or that the amount is too low, but it can never approve one. A member of our team always reviews a payment before a subscription is activated, and a school whose receipt is rejected can contact us.
No other automated decision making with legal or similarly significant effects takes place. Grades and positions are calculated from scores and grading bands that the school itself sets. That is a calculation, not profiling.
17. Security incidents
Our approach is described in the Security & Data Handling Statement. In summary, we will investigate and contain an incident, assess who is affected, notify affected schools without undue delay, and notify the regulator where the law requires it. Statutory deadlines apply in every case.
18. Changes to this policy
We will notify School Administrators of material changes through the platform or by email. The version number and date at the top of this policy will change.
19. Contact
| Operator | [TO BE PROVIDED] |
| Address | [TO BE PROVIDED] |
| Privacy enquiries | support@akademicanest.com |
| Data Protection Officer | [TO BE PROVIDED] |
| Supervisory authority (Nigeria) | Nigeria Data Protection Commission |