Data processing agreement
Draft for legal review. Not yet in force. A lawyer will review this text before any school uses the service with real data.
Last updated: 17 October 2026
This agreement explains how PrimeCrux handles information on each school's behalf, as Nigerian data-protection law requires.
1. Roles
Under the Nigeria Data Protection Act 2023, the school is the data controller for the information about its students, parents and staff that it keeps in PrimeCrux, and PrimeCrux, a product of Prime Digital Technology Services (Business Name Registration No. 8564351), is the data processor. This agreement forms part of our terms of service.
2. What we process, and why
We process the categories of information listed in our privacy policy (school details, staff, students, parents and guardians, academic records and security records) only to provide the service described in the terms: setup, score entry, review and publishing, report cards, parent access, the messages these need, and security.
3. Our duties as processor
- Process information only on the school's documented instructions.
- Make sure everyone who can access it, including our staff, is bound by confidentiality.
- Keep appropriate security measures: separation between schools enforced in the database, encryption in transit and at rest, role-based access, two-step verification for sensitive actions, an audit history that cannot be edited, and backups.
- Help the school answer requests from the people the information is about, and with security and data-protection assessments where needed.
- Make available the information needed to show we meet these duties.
4. Support access
Support access is read-only, needs a written reason, lasts at most 2 hours, and is logged and visible to the school's owners. Any change to the school's information needs the school's time-limited, logged permission.
5. Sub-processors
The school agrees that we may use the following providers. We will tell schools at least 30 days before adding or replacing one, and a school may object.
| Provider | What it does | Where |
|---|---|---|
| Supabase | Database, sign-in and file storage | United Kingdom (London), on Amazon Web Services |
| Resend | Sending emails (invitations, codes, results notices, reminders) | Region chosen when the sending domain is set up; confirmed before launch |
| Termii | Sending text messages to parents without email | Nigeria |
| Web hosting provider | Running the website and app | Named here before launch |
6. Transfers outside Nigeria
Some providers store or handle information outside Nigeria. We transfer it only with the safeguards the Nigeria Data Protection Act 2023 allows, such as contracts that require the provider to protect it to the same standard.
7. Personal data breaches
If we become aware of a breach affecting the school's information, we will tell the school without undue delay, and in any case within 48 hours, with what we know, what we are doing about it, and what the school may need to do, so the school can meet its own duty to notify the Nigeria Data Protection Commission and affected people.
8. When the service ends
When a school stops using PrimeCrux, it can download its students and staff lists and its report cards. We then delete the school's information within 90 days, except where the law requires us to keep something longer, in which case we keep it secure and use it for nothing else.
9. Contact
For data-protection questions, contact us at the contact address published on our contact page before launch.