Section 01
Who we are
ClassPro Technologies Limited ("ClassPro," "we," "us," "our") is a school management software company providing cloud-based tools to educational institutions across Africa and beyond. We are registered in Nigeria with our headquarters in Lagos.
Our platform helps schools run administration, teaching, assessments, and parent communication. When a school subscribes to ClassPro, we act as a data processor on behalf of that school — meaning the school decides what data is collected and how it's used, and we provide the secure infrastructure to support that.
For our marketing site, support interactions, and account management, we act as a data controller — meaning we decide how that specific information is used.
Contact details
- Company: ClassPro Technologies Limited
- Registered office: 14 Admiralty Way, Lekki Phase 1, Lagos, Nigeria
- Data Protection Officer (DPO): dpo@classpro.com
- General privacy queries: privacy@classpro.com
Section 02
Information we collect
We collect information in three main scenarios: when a school subscribes to our platform, when individual users (teachers, students, parents) interact with it, and when visitors browse our marketing website.
Categories of personal data
Category
Typical examples
Identity data
Names, dates of birth, gender, photographs, student/staff ID numbers.
Contact data
Email addresses, phone numbers, home addresses, emergency contacts.
Academic data
Class enrolment, grades, attendance, assignments, exam results, learning progress.
Financial data
Fee invoices, payment records, payment method tokens (not full card numbers).
Technical data
IP addresses, device type, browser, login times, app version, time zone.
Communications
Messages between users, support tickets, feedback submitted to us.
What we do NOT collect
- We do not collect full credit/debit card numbers — payment processors (Paystack, Flutterwave, Stripe) handle these directly.
- We do not collect biometric data unless your school specifically enables biometric attendance, and only with proper consent.
- We do not collect data from third-party advertising networks; we don't use any.
- We do not track users across other websites.
Section 03
How we use information
We use personal data only for the purposes a school, parent, or user would reasonably expect when signing up for a school management platform. Specifically:
- To deliver the service: manage class rosters, take attendance, process fee payments, deliver lessons, run exams, generate report cards.
- To communicate: send notifications about grades, attendance, fees, schedule changes, and emergencies on the school's behalf.
- To support users: respond to help requests, troubleshoot issues, train staff.
- To improve the platform: analyze aggregated, anonymized usage data to understand which features work well.
- To keep the platform secure: detect fraud, prevent abuse, maintain audit logs for accountability.
- To meet legal obligations: respond to lawful requests, maintain records required by tax or education authorities.
What we never do with your data
We never sell personal data. We never share it with advertisers. We never use student academic data to train AI models that benefit other organizations. We never use it to profile users for any commercial purpose.
Section 04
Legal basis for processing
Under NDPR and GDPR, we must have a lawful basis for processing personal data. The bases we rely on:
- Contract: Most processing is necessary to deliver the service the school (or individual user) signed up for.
- Legitimate interests: Improving the platform, preventing fraud, ensuring security — balanced against individuals' rights.
- Legal obligation: Where law requires us to retain or disclose information.
- Consent: For optional features such as marketing emails, biometric attendance, or webcam proctoring — you can withdraw consent at any time.
Section 05
Children's data
Extra care for minors
Schools are the primary customer of ClassPro, and most students are minors. We treat children's data with heightened sensitivity, as required by NDPR, GDPR, and our own ethical commitments.
How children's data is handled
- The school acts on behalf of parents: When a school enrols a student in ClassPro, the school has obtained the necessary consent from parents or legal guardians as part of standard enrolment.
- No direct sign-up for children: Children cannot sign up to ClassPro on their own. Accounts are created and managed through the school.
- No targeted advertising: We never show ads to anyone, but especially never to children. There are no ad networks operating on the platform.
- No commercial profiling: Children's academic data is never used for marketing, profiling, or any commercial decision-making.
- Restricted social features: In-app messaging is moderated and limited to teacher-student, teacher-parent, or school-broadcast. No open social network exists on the platform.
- Right to be forgotten: When a child leaves the school, parents may request full deletion of that student's records (subject to legal retention requirements for academic transcripts).
If you are a parent and want to review, correct, or delete information about your child, contact your school administrator first. Schools have direct controls in their ClassPro dashboard for this. If the school cannot help, you may contact our DPO directly at dpo@classpro.com.
Section 06
How we share information
We share personal data only when necessary to deliver the service, when legally required, or when you've given explicit permission. The categories:
Within the school
Information you provide is visible to authorised users within your school based on their role — teachers see students they teach, bursars see fee records, principals see everything. Access is role-based and audit-logged.
With service providers (sub-processors)
We use trusted third-party providers to operate our infrastructure. Each is contractually bound to protect your data with security and confidentiality standards at least as strict as our own:
- Cloud hosting: Amazon Web Services (data centres in Africa, EU, and US)
- Payment processing: Paystack, Flutterwave, Stripe
- Email delivery: Postmark, AWS SES
- SMS gateways: Twilio, Termii
- Customer support tools: Intercom, Help Scout
- Analytics (aggregated, anonymized): Plausible Analytics — privacy-first, no cookies
A complete and current list of sub-processors is published at classpro.com/sub-processors.
When required by law
We may disclose personal data when ordered by a court of competent jurisdiction, required by law enforcement under valid legal process, or to protect the rights, safety, or property of ClassPro, our users, or the public. We will notify the affected school whenever legally permitted to do so.
Business transfers
If ClassPro is involved in a merger, acquisition, or sale of assets, your information may be transferred to the successor entity. We will give you advance notice and the opportunity to opt out where legally required.
Section 07
Data security
We protect personal data with the same standards used to secure financial systems. Our security programme includes:
- Encryption: 256-bit SSL/TLS in transit; AES-256 at rest for all stored data.
- Access controls: Role-based permissions, two-factor authentication for staff accounts, single sign-on (SSO) for enterprise customers.
- Audit logs: Every action on the platform — every login, every record viewed, every change — is logged with timestamp and user identity.
- Backups: Automatic encrypted backups every 24 hours, retained for 30 days, stored in geographically separate locations.
- Network security: Web application firewall, DDoS protection, intrusion detection, regular penetration testing by independent security firms.
- Staff training: All ClassPro employees with data access undergo annual privacy and security training. Access is granted on a need-to-know basis.
- Vendor security: All sub-processors are vetted for security maturity before engagement.
No system is perfectly secure, but we work continuously to identify and address vulnerabilities. If you discover a security issue, please report it to security@classpro.com.
Section 08
Data retention
We keep personal data only as long as needed for the purposes described in this policy, or as required by law.
While your account is active
For as long as your school subscribes to ClassPro, we retain the data the school has chosen to keep on the platform. Schools can delete individual records, archive past students, or remove specific data at any time through their dashboard.
After your account is closed
- Active service data: Removed from active systems within 30 days of account closure.
- Encrypted backups: Retained up to 90 days, after which they are securely overwritten.
- Academic records (where law requires): Some jurisdictions require schools to retain student academic records for a specified period (often 5–10 years). Where this applies, we provide schools tools to export and archive, but we do not retain the data ourselves beyond the standard backup window.
- Financial records: Retained for 7 years as required by tax law, in encrypted, restricted-access form.
- Anonymized analytics: Statistical and usage data with all personal identifiers removed may be retained indefinitely for product improvement.
Section 09
International data transfers
Most of our infrastructure runs on cloud services with data centres in Africa (Cape Town and Lagos), the EU (Frankfurt and Dublin), and the US. We minimize cross-border transfers wherever possible and prefer to keep your data in the region closest to you.
Where transfers happen, we use appropriate safeguards:
- For transfers from the EU/UK, we use Standard Contractual Clauses (SCCs) approved by the European Commission.
- For transfers to or from Nigeria, we comply with NDPR cross-border transfer requirements.
- All transfers are encrypted in transit.
- Sub-processors handling transferred data are bound to confidentiality and security obligations no less protective than this policy.
Section 10
Your rights & choices
Under NDPR, GDPR, and similar data protection laws, you have specific rights over your personal information. These rights apply to the data ClassPro holds about you directly. For data held by your school, you'll usually exercise these rights through the school first.
Right to access
Request a copy of all personal data we hold about you.
Right to rectify
Correct inaccurate or incomplete personal data.
Right to erasure
Request deletion (subject to legal retention obligations).
Right to portability
Receive your data in a structured, machine-readable format.
Right to object
Object to certain processing, especially direct marketing.
Right to restrict
Ask us to pause processing while a dispute is resolved.
How to exercise these rights
Email our DPO at dpo@classpro.com with a clear description of your request and proof of identity. We respond to all requests within 30 days. There is no charge unless your request is manifestly unfounded or excessive.
You also have the right to lodge a complaint with the Nigeria Data Protection Bureau (NDPB) or, if you're in the EU, your local supervisory authority.
Section 11
Cookies & tracking
We use cookies and similar technologies sparingly — only what's needed to deliver the service and improve it. We do not use third-party advertising cookies of any kind.
Types of cookies we use
- Essential cookies: Required for the service to work — login sessions, security tokens, user preferences. These cannot be disabled without breaking core functionality.
- Functional cookies: Remember settings like language, timezone, and theme.
- Privacy-respecting analytics: We use Plausible Analytics, a cookieless analytics tool that respects privacy by design. No personal identifiers, no cross-site tracking, no third-party data sharing.
You can control cookies through your browser settings. Most browsers let you block or delete cookies, though doing so may affect certain features of ClassPro.
Section 12
Data breach response
Despite our best efforts, security incidents can happen. We have a documented incident response plan and a dedicated security team monitoring our systems around the clock.
If a personal data breach occurs that is likely to result in a risk to the rights or freedoms of individuals, we will:
- Notify affected schools as soon as reasonably possible, and within 72 hours of becoming aware where required by law.
- Notify the relevant regulators (NDPB, EU supervisory authorities) within statutory timeframes.
- Provide affected users with information about the breach, the data involved, the likely consequences, and the measures taken.
- Take action to contain the breach, mitigate harm, and prevent recurrence.
- Maintain a public record of significant incidents at classpro.com/security/incidents.
Section 13
Changes to this policy
We may update this Privacy Policy from time to time to reflect changes to our practices, new features, or new legal requirements. When we make material changes, we will:
- Update the "Last updated" date at the top of this page.
- Notify subscribers via email at least 30 days before changes take effect.
- For material changes affecting individual users (parents, students, staff), require schools to inform their users in line with our terms.
- Maintain a publicly accessible version history at classpro.com/privacy/changelog.
Your continued use of ClassPro after the effective date of an updated policy constitutes acceptance of the changes. If you don't agree, you may close your account at any time.