1. About this policy
This Privacy Policy explains how TapEdu (“TapEdu”, “we”, “us”) handles personal data when you visit tapedu.ng, apply to bring a school onto TapEdu, contact us, or use the TapEdu platform. That includes the school workspace at app.tapedu.ng, the Teacher, Family and Student portals, and school websites hosted on TapEdu subdomains such as schoolname.tapedu.ng.
We have written it with the Nigeria Data Protection Act, 2023 (the “NDPA”) and the General Application and Implementation Directive (GAID) 2025 issued by the Nigeria Data Protection Commission in mind. Terms such as “personal data”, “data controller” and “data processor” have the meanings given to them in the NDPA.
2. Who we are and our role
TapEdu provides school management software to schools and school groups in Nigeria. Our role depends on whose data it is and why it is being processed:
- Schools are generally the data controllers of their school-community data. When a school records information about its students, parents and guardians, and staff in TapEdu, the school decides what is collected and why. TapEdu processes that data on the school’s behalf, as its data processor, to provide the service.
- TapEdu is the data controller for its own data. This includes information submitted through our marketing website (school applications and contact enquiries), the details of school administrators we invite, subscription and billing records, and the technical data we need to run and secure the platform.
If you are a parent, guardian, student or member of staff and have a question about how your school uses your information, please contact your school first. We will help your school respond.
3. Personal data we collect
School applications and enquiries
When you apply to register a school, we collect the school’s details — such as its name, type, ownership, address with state and local government area, contact details, website and social media links, registration and CAC numbers, government approval, estimated numbers of students and staff, campuses, sections, current session and term, requested web address and preferred plan, and any logo or banner you upload — together with the contact person’s name, position, email address and phone number. We also record when you accepted our Terms and this policy, and the IP address and browser details used to submit the application.
When you send us a message or request a demo, we collect your name and email address and, if you give them, your school’s name, your phone number and your message, together with the IP address used to send it.
Account information
For each person who signs in — school staff and teachers, parents and guardians, and students — we hold their name, email address, role and school, a securely hashed password, and records such as their last sign-in time and IP address. Accounts are created by the school or by invitation. Invitation links are stored in hashed form and expire after 7 days.
School records
Depending on the modules a school uses, the records it keeps in TapEdu can include:
- Students: names, admission number, gender, date of birth, photo, address, status, class and enrolment history, and documents the school uploads.
- Parents and guardians: names, contact details, relationship to the child, and settings such as primary or emergency contact, pickup authorisation, and what they may see or pay for.
- Staff: names, staff number, photo, role, department and designation, teaching or non-teaching type, hire date and teaching assignments.
- Academic records: timetables, attendance registers, assessment scores, results and grades, report comments, assignments and submitted work, video lessons and communication-book remarks.
- Finance: fee structures, invoices, payments and receipts, parent wallet balances and ledger entries, bank-transfer claims, refunds and school store orders.
- Communication: announcements, events, news, in-app notifications and parent–teacher messages.
- Care and operations: medical notes, library loans, and transport routes and stops.
Sensitive personal data
Medical notes record a student’s complaint and the treatment given, which is health information and sensitive personal data. Access is limited to staff whose role has been given permission and to the student’s linked parents or guardians. Schools should record only what they need to care for the child.
Public school website content
Schools can publish news, events, photo and video galleries and contact details on their TapEdu school website. Anything a school publishes there is public. Messages sent through a school website’s contact form are stored for that school.
Technical and log data
When you use TapEdu we automatically process technical information such as IP addresses, browser and device details, the pages requested and timestamps. We keep audit logs of important actions — who did what, when, and the old and new values — and we record sign-ins. Passwords and other secrets are left out of audit records.
5. How we use personal data
We use personal data to:
- provide TapEdu to schools — running the school workspace and portals, showing each person the information their role allows, and delivering in-app notifications;
- review school applications, contact applicants, request more information and, when an application is approved, set up the school and invite its first administrator;
- send transactional emails, such as invitations, application status updates, portal sign-in details and password resets;
- manage TapEdu subscriptions, including payment references, confirming bank transfers and processing online payments where they are available;
- respond to enquiries and provide support. When TapEdu staff need to work inside a school’s workspace to help, they do so in a support session that records a reason and is audit-logged;
- keep TapEdu secure — preventing fraud and abuse, limiting repeated sign-in and form attempts, investigating incidents and keeping audit logs;
- maintain, troubleshoot and improve the service; and
- meet our legal obligations and establish, exercise or defend legal claims.
We do not sell personal data, and we do not use school-community data for advertising.
6. Our legal bases
The NDPA allows personal data to be processed only where there is a lawful basis. For the data we control, we rely on:
- Contract
- To provide TapEdu to schools that use it, and to take the steps a school asks for before it joins, such as reviewing its application.
- Legitimate interests
- For example, keeping the platform secure, preventing abuse and responding to enquiries — where those interests are not overridden by your rights and freedoms.
- Legal obligation
- Where the law requires us to keep or disclose information, such as tax and accounting records.
- Consent
- Where we ask for it, for example for any non-essential cookies in future. You can withdraw consent at any time.
For school-community data, the school is responsible for having a lawful basis for what it records and, where needed, for obtaining consent from parents or guardians. TapEdu processes that data on the school’s instructions.
7. Children’s data
Many students on TapEdu are children. Under the NDPA, a child is a person under the age of 18, and where a child’s personal data is processed on the basis of consent, that consent must come from a parent or legal guardian.
Student records and student portal accounts are created by the school, not by children signing up themselves. We process children’s data only to provide the service on the school’s instructions, and what parents and guardians can see follows the access settings their school chooses.
If you are a parent or guardian and want to see, correct or remove information about your child, please contact your child’s school first. If you cannot resolve it with the school, contact us and we will help.
9. International transfers
Some of our service providers may store or process data outside Nigeria. Where personal data is transferred outside Nigeria, we do so only in line with the NDPA’s requirements for cross-border transfers — for example, where the destination provides an adequate level of protection or appropriate safeguards are in place.
10. How we protect personal data
We protect personal data with technical and organisational measures appropriate to the risk, including:
- Tenant isolation — each organisation’s data is kept separate from every other school’s, and identifiers submitted in forms are checked against the school a user is working in.
- Role-based permissions — 10 ready-made school roles and 130 permissions that schools can adjust, with teachers limited to the classes and subjects they are assigned.
- Audit logs — important changes, sign-ins and “view as” sessions are recorded, with sensitive fields such as passwords left out.
- Protected sessions and credentials — sign-in sessions use secure, encrypted cookies over HTTPS, passwords are stored hashed, and payment-provider credentials are stored encrypted.
- Abuse protection — sign-in attempts and public forms are rate-limited, forms are protected against cross-site request forgery, and content on public school websites is sanitised.
No system is completely secure. If we become aware of a personal data breach affecting data we process for a school, we will tell the school without undue delay, and we will notify the Nigeria Data Protection Commission and affected people where the law requires.
11. How long we keep data
We keep personal data only for as long as we need it for the purposes in this policy:
- School records are kept while the school’s TapEdu account is active, and as required by law. When a school leaves TapEdu, we delete or anonymise its data in line with its instructions, unless we must keep some of it to meet a legal obligation.
- Modules a school turns off keep their data, so it is still there if the module is switched back on. Turning a module off never deletes data.
- Applications and enquiries are kept for as long as we need them to review the application or respond to the enquiry and keep a record of it, and are then deleted or anonymised.
- Billing records are kept for as long as tax and accounting laws require.
- Audit and security logs are kept for as long as we need them to protect the platform and investigate issues.
12. Your rights
Under the NDPA, you have the right to:
- be informed about how your personal data is used;
- access a copy of your personal data;
- have inaccurate or incomplete data corrected;
- ask for your personal data to be erased;
- ask us to restrict how your data is processed;
- object to processing, including processing based on legitimate interests;
- receive your data in a commonly used format and have it sent to another controller, where this applies;
- withdraw consent at any time, where we rely on consent; and
- complain to the Nigeria Data Protection Commission.
How to make a request
For school records — for example a student’s results or a parent’s contact details — contact the school first. The school controls that data, and we will support it in responding. For data TapEdu controls, contact us.
We may need to confirm your identity before acting on a request, and some rights have limits set by law.
If you are not satisfied with how a request has been handled, you can complain to the Nigeria Data Protection Commission (NDPC) (opens in a new tab).
13. Changes to this policy
We may update this policy as TapEdu changes or the law develops. We will post the new version on this page with a new “last updated” date and, where changes are significant, let school administrators know.
14. Contact us
If you have questions about this policy or want to exercise your rights, contact us through our contact page. Please tell us which school your request relates to, if any.