1. Who is responsible
ACUdemy determines why and how personal data is used for its own activities and is a data controller for those activities. Where ACUdemy hosts or operates services only on a school’s instructions, the school is ordinarily the controller and ACUdemy acts as its processor. Some functions may involve separate controllers, including payment providers and regulators.
2. Data we collect
Depending on the service, we may collect identity and contact details; student, parent, guardian and staff records; admissions and academic records; attendance, assessment and learning activity; fees, payroll and transaction references; communications and support requests; uploaded images and documents; account, device, log, IP and security data. We do not intentionally store full payment-card details.
3. Why and on what lawful basis
- Contract: to create accounts, provide school services, process enrolment and fulfil paid services.
- Legal obligation: to maintain required educational, employment, accounting, safety and regulatory records.
- Legitimate interests: to secure, administer and improve the service, prevent fraud and support users, after balancing affected rights.
- Consent: where the law requires a genuine choice, including optional communications or particular uses of a child’s data. Consent can be withdrawn without affecting earlier lawful processing.
- Vital or public interests: where necessary to protect a person or carry out a lawful public-interest function.
4. Children’s data
School services necessarily involve children. We apply heightened care, data minimisation and appropriate access controls. A competent parent or guardian’s consent is obtained where consent is the lawful basis, unless another basis permitted by law applies. We do not use school records for behavioural advertising and will consider the child’s best interests in decisions affecting their data.
5. Sharing and international transfers
Data is shared only as necessary with authorised school personnel, the relevant parent or student, contracted hosting, communications, support and payment providers, professional advisers, regulators, law-enforcement bodies where lawfully required, or a successor following a lawful reorganisation. Providers must protect data and use it only for authorised purposes. A transfer outside Nigeria will use a mechanism allowed by the NDP Act, such as an adequacy decision, appropriate safeguards, necessity recognised by law, or explicit informed consent where appropriate.
6. Retention and security
We retain data only for the service, legal, safeguarding, accounting, dispute and archival periods that apply to it, then securely delete or anonymise it. Controls include role-based access, authentication, logging, backups, software maintenance, provider review and incident response. No internet service can promise absolute security.
7. Your rights
Subject to lawful limits, you may ask whether we process your data; obtain access and a copy; correct inaccurate data; request erasure or restriction; object to certain processing; withdraw consent; receive portable data where applicable; and not be subject to a solely automated decision with legal or similarly significant effect without the safeguards required by law. We may verify identity and may preserve data where retention is legally required.
8. Cookies and service logs
Essential cookies and local storage may keep sessions secure and remember necessary settings. Operational logs help detect errors and misuse. Optional analytics or marketing technologies, if introduced, will be described and offered with the choices required by law.
9. Requests and complaints
Send privacy requests to privacy@acudemy.school. Describe your request and the school or account concerned. You may also complain to the Nigeria Data Protection Commission. We will respond within the period required by applicable law and explain any lawful refusal or extension.
10. Updates
We will post changes here and revise the effective date. Material changes will receive additional notice where appropriate. See also our Data Protection and Compliance notice.