Privacy Policy
What we collect, why, and what you can do about it
Schoolpager builds and hosts websites for schools. This policy explains how Fikazon Technologies Ltd handles personal information — the school's, its staff's, and the parents' and pupils' whose details pass through a school's website — under the Nigeria Data Protection Act 2023.
In short
- We collect what we need to run your account and your website, and nothing to sell. We do not sell or rent personal information, ever.
- School websites carry no advertising trackers and no tracking cookies. Visit counts are made without storing anyone's IP address.
- For what a website collects from parents — enquiries, applications, payments — the school is in charge and we act on its instructions. Parents should ask the school first; we will help.
- Card numbers never reach us. Paystack handles them.
- You can see, correct, take away or delete your information, and complain to the Nigeria Data Protection Commission.
1Who is responsible for what
Fikazon Technologies Ltd (trading as Schoolpager) is a company registered in Nigeria. Two different situations arise, and the law treats them differently.
Your account with us
For the information a school and its staff give us to run the account — names, sign-in details, billing, support conversations, and what you do in the admin — we are the data controller. We decide how that information is used, within this policy.
Your school's website
For the information a school's website collects from the public — a parent's enquiry, an application, a fee payment, a visit — the school is the data controller and we are its data processor. The school decides what to ask for and what to do with the answers; we store and process them only on the school's instructions, to run the website. If you are a parent or pupil with a question about your information on a school's website, the school is the right first call; we help the school answer, and we will point you to it if you come to us.
2What we collect
| Information | Where it comes from |
|---|---|
| Account details: your name, email address, phone number (optional), a password we store only as a one-way hash, your role at the school, and the school's name, address and contact details. | You, when you sign up or are added to a school. |
| Website content: everything you put on your website — text, photographs, documents, staff names, roles and portraits, news, events, and the settings that shape the site. | You, through the admin; or imported from your old website at your request. |
| Billing records: plan, invoices, payment references, whether a payment came by card or transfer, and Paystack's confirmation of it. Never a full card number. | You and Paystack. |
| Domain and email details: the domain names you connect or buy, DNS records, and the mailbox addresses you create. For a domain bought through us, the registrant contact details the registry requires (name, address, email, phone). | You; the registrar and Zoho. |
| Payment-gateway keys for collecting fees on your website. | You. Stored encrypted; see section 10. |
| Activity and security records: a log of sensitive actions in your admin (domain changes, DNS edits, billing, key reveals, mailbox changes) with the person, time and IP address; sign-in attempts; server logs. | Generated as you use the admin. |
| Support conversations and any email you send us. | You. |
| Photographs emailed in for your gallery, with the sender's address and note. | Your staff, when the school turns the feature on. |
We do not ask for, and you should not send us, information about anyone's health, religion, ethnicity or other sensitive categories except where a school chooses to put such content on its own website, for which the school is responsible.
3Why we use it, and the legal basis
| Purpose | Legal basis (NDPA 2023, s. 25) |
|---|---|
| Running your account and website, billing you, providing domains, email and payment tools — the things you signed up for. | Performance of our contract with the school. |
| Keeping the service secure: detecting abuse, rate-limiting, recording sensitive actions, notifying an owner when a key is revealed. | Our legitimate interest in a safe service, and yours in a safe account. |
| Sending service notices: renewals, domain expiry, certificate problems, security alerts, changes to these terms. | Performance of the contract; legal obligation where notice is required. |
| Keeping invoices and payment records. | Legal obligation (tax and company law). |
| Answering your support requests. | Performance of the contract. |
| Telling you about new features or plans. | Legitimate interest for existing customers, with an unsubscribe link in every such email. We do not send marketing to anyone else without consent. |
| Improving the service by looking at how the admin is used, in aggregate. | Legitimate interest. We do not profile individuals. |
We do not make decisions about you by automated means that have legal or similarly significant effects.
4School websites: visitors, forms and payments
Visits
School websites use our own visit counter, built so that no visitor is tracked. It records the page visited, its title and the time, together with a code made from the visitor's connection and browser mixed with a secret that changes every day, so the same visitor can be counted once in a day and never recognised across days. No IP address is stored, no cookie is set for counting, and no advertising or analytics company is involved. The school sees totals — visitors, page views, most-visited pages — and nothing about any individual.
Forms
When a parent sends an enquiry, applies for a place, books a visit or asks a question, the answers are stored for the school and shown to it in its admin. The school chooses which questions to ask. We keep the submission until the school deletes it or leaves. The school may email a parent about their application status through us; the application can be looked up on the website only with its reference and the email or phone given on it.
Payments
Fees, application fees, shop orders and donations are paid through the school's own Paystack account. The payer enters card details on Paystack's pages, never ours. We receive and keep the payer's name, email, phone, what was paid for, the amount, and Paystack's reference and outcome, so that the school has a ledger and the payer a receipt. Receipts are opened with a signed link, so a guessed reference is not enough.
Optional add-ons
A school may switch on extras such as a WhatsApp chat button, Cloudflare Turnstile (a bot check on forms) or text-message notices via Termii. Each is described in the school's admin before it is switched on, and each sends only what it needs to that provider. Turnstile, for instance, sends the visitor's browser signals to Cloudflare to tell a person from a script; a WhatsApp button sends nothing until it is tapped.
6Automated drafting
Some drafts are written by software. Most are made from a fixed phrase book with your school's facts filled in, and involve no outside service. Two things are sent to an automated writing service (Anthropic) with our instructions:
- the text of your old website, when you ask us to import it, so that it can be sorted into the right pages; and
- a photograph and the sender's note, when staff email a photo in, so that a caption can be drafted.
Your account details, billing, form submissions and passwords are never sent. Answers are kept by us so that the same question is never asked twice. Anthropic processes the request to answer it and, under its commercial terms, does not use it to train its models. Every draft is a suggestion the school reviews before anything is published.
8Information that leaves Nigeria
Our servers are in Europe and several providers above operate from the United States, the European Union or India. Information therefore leaves Nigeria to be processed. We do this under sections 41 to 43 of the NDPA: each provider is bound by contractual terms that require protection at least as strong as Nigerian law, and we choose providers with established security programmes and published certifications. You may ask us for details of the safeguards for any provider.
9How long we keep it
| Information | Kept for |
|---|---|
| Account and website content | While the account exists. After an account is closed, deleted within 90 days; backup copies expire within a further 35 days. |
| A paused school's content (unpaid) | Kept in full for up to 12 months of pause, so one payment restores everything; then the account may be closed, with 30 days' notice. |
| Form submissions and payments received by a school | Until the school deletes them, or leaves. |
| Mailbox archives (a deleted mailbox, or a paused school's) | 90 days, then permanently deleted. |
| Invoices and payment records | 6 years, as tax and company law require. |
| Security and activity logs | While the account exists and up to 2 years after, or longer if needed for a dispute. |
| Raw responses from providers (kept to diagnose faults) | 90 days. |
| Server access logs | 30 days. |
| Support emails | 3 years after the last message. |
10How we protect it
- Every connection to the admin and to school websites is encrypted (HTTPS), with certificates we obtain and renew automatically.
- Passwords are stored as one-way hashes; we cannot read them. Payment-gateway keys and add-on secrets are encrypted at rest and shown masked; revealing one needs your password again and a code emailed to you, and the school's owner is told each time.
- Each school's information is separated from every other school's at the database level, and that separation is tested automatically with every change we make.
- Uploaded files are checked and re-encoded before they are stored, and are served from storage separate from our application.
- Access to production systems is limited to the people who run the service, over encrypted connections, and sensitive actions are logged.
- The platform is backed up every night to a separate location.
If a breach of security affects your personal information in a way likely to put you at risk, we will tell the Nigeria Data Protection Commission within 72 hours of becoming aware of it and tell you without undue delay, saying what happened and what we are doing.
11Children
School websites are about children, and often show them. The school decides what to publish and is responsible for obtaining whatever consent its own policies and Nigerian law require from parents or guardians before a pupil's photograph or name appears. We provide the tools to publish, hide and delete, and we act promptly when a school asks us to remove something.
Our own accounts are for adults acting for a school; we do not knowingly hold an account for anyone under 18. If a parent believes a child's information has been published without consent, contact the school; if that does not resolve it, contact us at the address below and we will take it up with the school.
12Your rights
Under the NDPA you may ask us to:
- tell you what personal information we hold about you and give you a copy;
- correct anything inaccurate;
- delete it, where we no longer need it;
- restrict or object to how we use it, including to stop marketing at any time;
- give it to you in a portable, machine-readable form, or send it to another provider;
- withdraw consent where consent was the basis, without affecting what was done before.
Write to support@schoolpager.com.ng from the address on your account, or by post to the address below. We answer within thirty days, without charge unless a request is plainly excessive. Many things you can do yourself in the admin — edit your details, download receipts, delete submissions, hide or delete content.
Where the school is the controller (section 1), we pass a parent's or pupil's request to the school and help it respond.
You have the right to complain to the Nigeria Data Protection Commission (ndpc.gov.ng). We would be grateful for the chance to put things right first.
13Changes to this policy
When we change this policy we update the date at the top. For a change that affects what we collect or who we share it with, we email every school's contact address at least thirty days before it takes effect. The current version is always at schoolpager.com.ng/privacy.
14How to reach us
Fikazon Technologies Ltd, trading as Schoolpager — the data controller for your account.
Email: support@schoolpager.com.ng
Web: schoolpager.com.ng