Privacy Policy

The Data Controller responsible for your personal data is:

For all data-related queries or requests, contact us at the email above and mark your subject line "DATA REQUEST".

We collect the following categories of personal data depending on your role:

Students (Children)

• Full name, date of birth, gender, genotype, admission number
• Class assignment, enrolment date, academic status
• Medical information: height, weight, immunisation status, health conditions, doctor details
• Developmental information: language milestones, dietary preferences, behavioural notes
• Academic results, attendance records, disciplinary records
• Scanned registration documents (uploaded PDFs)

Parents / Guardians

• Full name, phone number, email address
• Occupation, home address, work address, state, local government
• Genotype (as provided on registration forms)
• Financial records: fee invoices, payment declarations and receipts
• Login credentials (passwords stored as cryptographic hashes — never in plain text)

Staff

• Full name, email, phone number, home address
• Employment date, staff type, salary information
• Login credentials (hashed passwords)
• Class assignments and teaching records
• Attendance and payroll records

Technical / System Data

• Session authentication tokens (stored in browser cookies, expire automatically)
• System audit logs: who performed which action and when
• IP address and browser information (collected by hosting infrastructure)

We process personal data on the following legal grounds:

• Contractual necessity — processing is required to provide school management services (enrolment, fee management, academic records).
• Legitimate interests — ensuring school safety, operational continuity, and communication between staff, parents, and management.
• Legal obligation — maintaining educational records as required by Nigerian education regulations.
• Consent — where we rely on consent (e.g. storing non-essential data fields), you may withdraw consent at any time.

For children's data, we rely on the consent of a parent or guardian at the time of enrolment.

• Student data is never shared with third parties for commercial purposes.
• Medical information is only visible to Principal, Admin, and designated staff.
• Parents can request a full export of their child's data at any time.
• Students aged 13+ may request access to their own academic records through school administration.

• Enrolling and managing student academic records
• Generating and tracking fee invoices and payments
• Recording and communicating academic results and report cards
• Managing staff employment, payroll, and class assignments
• Sending messages and announcements within the portal
• Maintaining attendance and disciplinary records
• Complying with statutory educational reporting obligations
• Ensuring system security through audit logs

We do not sell, rent, or share personal data with third parties for marketing purposes.

We retain personal data for the following periods:

After retention periods expire, data is permanently deleted or anonymised.

• All passwords are stored as one-way cryptographic hashes (bcrypt). We cannot recover plain-text passwords.
• Authentication uses short-lived JWT access tokens (expires in 24h) and secure refresh tokens.
• All data is transmitted over HTTPS/TLS encryption.
• Role-based access control (RBAC) ensures each user only accesses data relevant to their role.
• All administrative actions are recorded in tamper-evident audit logs.
• The system is hosted on secure cloud infrastructure with automated backups.

Despite these measures, no system is 100% secure. In the event of a data breach affecting your rights, we will notify affected individuals within 72 hours as required by law.

We do not share personal data with third parties except:

• Cloud infrastructure provider — our hosting partner processes data solely to deliver the service (acting as Data Processor under a processing agreement).
• Email service — used only to send system-generated notifications (password resets, announcements). No marketing.
• Legal authorities — if required by Nigerian law or a valid court order.

This portal uses the following cookies:

We do not use advertising, analytics, or tracking cookies. All cookies are strictly necessary for the portal to function.

Under the NDPA 2023 and GDPR you have the following rights:

• Right of access — request a copy of all personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure — request deletion of your data, subject to legal retention requirements.
• Right to portability — receive your data in a machine-readable format.
• Right to restrict processing — ask us to pause processing while a dispute is resolved.
• Right to object — object to processing based on legitimate interests.
• Right to withdraw consent — where processing is based on consent, withdraw it at any time.

To exercise any right, email info@lenagetechnologies.com with subject line "DATA REQUEST". We will respond within 30 days.

If you believe your data rights have been violated, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

We may update this Privacy Policy from time to time. The effective date at the top of this page reflects the latest revision. Material changes will be notified to active users via the portal announcement system.

For any privacy-related questions or requests: