Privacy policy
Last updated 18 September 2026.
In short
- Your school decides what data goes into SCHOOLCORD and what happens to it. Under the Nigeria Data Protection Act 2023 (NDPA) the school is the data controller.
- SCHOOLCORD runs the software and stores the data on the school's instruction. We are the data processor.
- We do not sell personal data, and we do not use a school's student or parent records to advertise anything.
- If you are a parent, the fastest route to your child's records is your school, not us — see Your rights.
Who this covers
SCHOOLCORD is school management software used by schools in Nigeria to manage fees, student records and messages to parents. This policy covers www.theschoolcord.com and the application behind it.
Each school using SCHOOLCORD has its own separate account. One school's staff cannot see another school's records.
What we hold
Only what a school needs to run the things it uses us for:
| About | What is held |
|---|---|
| Students | Name, admission number, class and campus, date of birth, sex, enrolment status, and what the class is charged each term against what has been paid. |
| Parents and guardians | Name, phone number, and email address where the school records one, so the school can reach you about fees and school matters. |
| Staff with accounts | Name, username, email address, phone number, job title, the role that decides what they may see, and a securely hashed password. We never store a readable password. |
| Payments | Amount, date, method, reference and who recorded it. Payments are recorded in SCHOOLCORD; card and bank details are not collected or stored by us. |
| Messages | The text the school sent, who it went to, and whether the gateway delivered it. |
| Applicants | Where a school uses admissions: the enquiry and application details a parent submits, and the school's decision. |
| Technical | Sign-in times and ordinary server logs, kept to keep accounts secure and the service working. |
Why we hold it
To provide the service the school signed up for: keeping the roster, working out what each student owes, recording payments, and sending the school's own messages to parents. We also use it to keep accounts secure and to support the school when it asks for help.
Under the NDPA the lawful basis is normally the contract between the school and the parent, and the school's legitimate interest in running the school. Where consent is the right basis, the school obtains it — the school decides this, because the school is the controller.
Children's data
Most students are children. Their records are entered by the school, not by the child, and a parent or guardian acts for them. We do not create accounts for students, and students do not sign in to SCHOOLCORD.
Who else sees it
We share data only with the suppliers who make the service work, and only as far as each needs. They act on our instruction and may not use the data for anything of their own:
- SMS gateway — the recipient's phone number and the message text, so a parent's message can be delivered.
- Email provider — the recipient's address and the message, for things like password-reset emails.
- Hosting and database providers — they store the data so the service can run.
Some of these providers store data outside Nigeria. Where they do, the transfer is covered by the provider's contractual data-protection terms, as the NDPA requires.
We will also disclose data where the law requires it. We do not sell personal data to anyone, and we never share one school's data with another school.
How long we keep it
- While the school is using SCHOOLCORD, its records are kept so the school has its own history — student records and payment history are part of the school's books.
- If a school leaves, it can ask for its data to be exported and deleted. Unless the school asks us to keep it, we delete or irreversibly anonymise the school's data within 90 days of the account closing.
- Records we must keep by law — for example financial records — are kept for as long as the law requires and no longer.
- Deleting a record in the app removes it from the app. Encrypted backups roll off on their own schedule, within 30 days.
How it is protected
- Traffic to and from the site is encrypted (HTTPS).
- Passwords are stored hashed, never in readable form, and are checked against known-breached password lists when they are set.
- Each school's data is separated from every other school's, and staff see only what their role allows — a bursar records payments without being able to change what the school charges.
- Access to production systems is limited to the people who maintain the service.
If a breach happens that puts people at risk, we tell the affected school without undue delay so the school can meet its own NDPA obligations, and we support the school in notifying the Nigeria Data Protection Commission (NDPC) and the people affected.
Your rights
Under the NDPA you can ask to:
- see the personal data held about you or your child;
- have it corrected where it is wrong;
- have it deleted, where there is no legal reason to keep it;
- object to a particular use, or ask that it be restricted;
- receive a copy in a portable form;
- withdraw consent, where the use relies on consent.
Ask your school first. The school is the controller: it holds the records, knows the child, and can correct or delete them directly. If a request reaches us instead, we pass it to the school and act on the school's instruction. We do this without charge, and aim to answer within 30 days.
If you are not satisfied, you can complain to the Nigeria Data Protection Commission.
Cookies
SCHOOLCORD uses only the cookies it needs to work: one that keeps you signed in, and one that protects forms against cross-site request forgery. Your theme choice (light or dark) is remembered in your own browser. There is no advertising or third-party tracking on the application.
Contact
Parents and guardians: please contact your school, which holds the records.
Schools, and anyone who cannot reach their school, can contact SCHOOLCORD at privacy@theschoolcord.com.
Changes
If this policy changes in a way that matters, we update the date at the top and tell schools through the application. Continuing to use SCHOOLCORD after a change means the new version applies.