Privacy policy

Each school decides what information about its students, parents and staff to keep in PrimeCrux and why. Under the Nigeria Data Protection Act 2023, the school is the data controller for that information, and PrimeCrux is its data processor: we handle it only on the school's instructions and only to provide the service. Our data processing agreement sets out these duties.

For the account details of people who sign up (name, email address, phone number and password), and for running and securing the service itself, PrimeCrux, a product of Prime Digital Technology Services (Business Name Registration No. 8564351), is the data controller.

• School details: name, type, address, contact details, motto, logo and colour.
• Staff: names, email addresses, phone numbers, roles and the classes they teach.
• Students: names, admission numbers, dates of birth, gender, classes and enrolment history.
• Parents and guardians: names, email addresses, phone numbers and their link to their children.
• Academic records: marks, results, positions where the school shows them, report cards and teachers' comments.
• Security records: sign-ins, two-step verification, an audit history of important changes, and the messages we send (but not their contents).

We do not ask for medical, religious or financial information, and schools should not enter it.

Only to provide the service to the school: setting up the school, entering and reviewing scores, publishing results, issuing and checking report cards, giving parents access, sending the messages the service needs, and keeping everything secure.

We do not sell information, show advertising or use school information to build profiles of children or parents.

Every school's information is kept separate from every other school's, and our system checks this on every request. Inside a school, each person sees only what their role allows: for example, a subject teacher sees only the classes and subjects they teach.

Parents see only their own children's published report cards, after confirming a one-time code. Anyone who checks a report card's code sees only whether it is genuine, the school, the student's first name and surname initial, the class, the term and the issue date, never marks.

Our support staff can open a read-only view of a school only to help it, only after writing down the reason, and for at most 2 hours at a time. Every support session and every record viewed is logged, and the school's owners can see that log. Sensitive details are hidden unless the support person deliberately reveals them, which is also logged. Changing a school's information requires the school's permission, which is time-limited and logged.

Information is stored on secure cloud servers outside Nigeria, currently in the United Kingdom (London), through our database provider, Supabase, which runs on Amazon Web Services. We will confirm the final location here before launch. Where information leaves Nigeria, we rely on the safeguards the Nigeria Data Protection Act 2023 allows, including contracts with our providers.

We protect information with encryption in transit and at rest, strict access rules in the database itself, two-step verification for sensitive actions, and an audit history that cannot be edited.

We send emails and text messages only for the school's purposes: invitations, sign-in and one-time codes, results notices and reminders. We use Resend for email and Termii for text messages. They receive only what is needed to deliver each message.

We use only the cookies needed to keep you signed in and to keep the service secure, including a cookie that keeps a parent signed in to their children's report cards on their own phone. We do not use advertising or tracking cookies.

We keep a school's information while the school uses PrimeCrux. Records are archived rather than silently deleted, so results and report cards stay verifiable. When a school stops using the service, we agree with it how its information is returned to it and then deleted, except where the law requires us to keep something longer.

Under the Nigeria Data Protection Act 2023 you may ask to see, correct or delete information about you, object to its use, or ask for a copy to take elsewhere. Parents and students should contact their school first, because the school controls their information; we help schools answer such requests. Staff can contact us directly about their own account.

You can also complain to the Nigeria Data Protection Commission.

PrimeCrux is used by schools and parents. Students do not have their own accounts. Schools are responsible for having a lawful basis, such as parents' consent where needed, for the student information they enter.

For privacy questions, contact us at the contact address published on our contact page before launch.

If we make important changes to this policy, we will tell schools before the changes take effect.