01 Definitions
- School or Controller: the institution that registers for LeonEd and decides why and how personal data is processed.
- LeonEd or Processor: processes personal data on the School's behalf to provide the service.
- Personal Data, Data Subject and Personal Data Breach have the meanings given in the Nigeria Data Protection Act 2023 (NDPA) and other applicable data protection law.
02 Roles of the Parties
The School is the data controller and LeonEd is the data processor. Each party will comply with its obligations under the NDPA and any other data protection law that applies. LeonEd will process personal data only on the School's documented instructions, including those given through the platform's settings and features.
03 Scope of Processing
| Subject matter | Provision of the LeonEd school management system. |
|---|---|
| Duration | The term of the School's subscription, plus the 30-day export window. |
| Nature & purpose | Storing, organizing, computing and displaying school records, results, attendance, fees and communications. |
| Data subjects | Students, parents and guardians, teachers, staff and administrators. |
| Categories of data | Identity and contact details, enrollment and demographic data, academic results, attendance and behavioural records, fee status, account and audit-log data. |
04 Confidentiality
LeonEd ensures that anyone authorized to process School data is bound by confidentiality obligations, and that access is limited to what is necessary to provide and support the service.
05 Security Measures
LeonEd maintains appropriate technical and organizational measures, including:
- Encryption of data in transit using TLS 1.3.
- Encryption of sensitive academic and financial records at rest using AES-256.
- Role-based, tiered access controls.
- Audit logs of all administrative actions.
- Real-time monitoring of API and database clusters.
06 Sub-processors
The School authorizes LeonEd to engage sub-processors, such as hosting and infrastructure providers, to help deliver the service. LeonEd will bind each sub-processor to data protection obligations at least as protective as this agreement, and will inform the School of significant changes to its sub-processors.
07 Data Subject Requests
Requests from students, parents or staff to access, correct, delete, restrict, port or object to the processing of their data are handled by the School as controller. LeonEd will provide reasonable assistance and platform tools to help the School respond, and will forward any request it receives directly.
08 Personal Data Breaches
LeonEd will notify the School without undue delay after becoming aware of a personal data breach affecting School data, and will provide the information reasonably needed for the School to meet its own obligations, including notifying the Nigeria Data Protection Commission within 72 hours where required.
09 Return & Deletion
When a subscription ends, the School has a 30-day window to export all of its records. After that window, LeonEd permanently deletes the School's records from its primary clusters, unless retention is required by law.
10 Information & Audits
LeonEd will make available information reasonably necessary to demonstrate compliance with this agreement. Requests can be sent to admin@leoned.ng.
11 Term & Precedence
This agreement forms part of the Terms of Service and lasts for as long as LeonEd processes personal data on the School's behalf. If there is a conflict between this agreement and the Terms on data protection matters, this agreement applies.