Privacy Policy — Klas

1. Data Controller & Contact

2. Scope

This Privacy Policy explains how we collect, process, store, and protect personal data through the Klas school management system at tryklas.com ("the Platform"). It applies to all users including school administrators, teachers, students, parents/guardians, and support staff.

3. Personal Data We Collect

3.1 Student Data (Minors)

3.2 Parent/Guardian Data

3.3 Staff Data

3.4 Technical Data

Browser type, device information, IP address, cookies, and usage analytics collected automatically.

4. How We Use Your Data

• Managing student enrolment, academic records, and attendance
• Generating report cards and academic transcripts
• Facilitating communication between schools and parents
• Processing school fee payments and generating invoices
• Managing staff records and school operations
• Ensuring platform security and maintaining audit trails
• Improving the Platform through anonymised analytics

5. Children's Data — Special Protections

• Parental consent is mandatory. Under the NDP Act 2023, processing personal data of children (persons under 18) requires verifiable consent from a parent or legal guardian. Schools must obtain this consent during enrolment.
• Data minimisation. We collect only the minimum data necessary for educational administration.
• No profiling or marketing. Children's data is never used for profiling, behavioural advertising, or marketing purposes.
• No sale of data. We never sell, rent, or trade children's personal data to any third party.
• Restricted access. Access to student data is strictly limited to authorised school staff and the child's parent/guardian.
• Right of the parent. Parents/guardians may access, correct, or request deletion of their child's data at any time by contacting the DPO or the school administrator.
• Withdrawal of consent. Parents may withdraw consent at any time. Note that withdrawal may affect the school's ability to provide services to the student.

6. Third-Party Processors & Cross-Border Transfers

Cross-border transfer: Data is stored on servers in the UK (DigitalOcean) and US (Railway). We ensure adequate protection under Section 43 of the NDP Act 2023 through:

• Data Processing Agreements with all processors;
• Adequacy of destination country data protection frameworks (UK GDPR, US state privacy laws);
• Technical safeguards including encryption in transit and at rest.

7. Data Retention

After the retention period, data is securely deleted or irreversibly anonymised.

8. Your Rights as a Data Subject

Under the NDP Act 2023 and GDPR (where applicable), you (and parents/guardians on behalf of their children) have the right to:

• Access — request a copy of personal data held
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion (subject to legal retention obligations)
• Restriction — limit how we process data
• Portability — receive data in a structured, machine-readable format
• Objection — object to processing based on legitimate interest
• Withdraw consent — at any time, without affecting prior lawful processing

To exercise any right, contact our DPO at [email protected]
3, Inyima Lane, Ebem, Abia State, Nigeria. We will respond within 30 days.

9. Security Measures

• TLS/SSL encryption for all data in transit
• AES-256 encryption for data at rest
• Role-based access controls — teachers see only their classes; parents see only their children
• Multi-factor authentication for administrative access
• Regular security assessments and vulnerability testing
• Automated encrypted backups
• Staff training on data protection, with emphasis on children's data

10. Cookies

We do not use advertising or tracking cookies. Manage preferences via your browser settings.

11. Data Breach Notification

In the event of a breach involving children's data or any personal data:

• We will notify the NDPC within 72 hours;
• We will inform affected schools, parents, and users without undue delay;
• We will document the breach and take immediate remedial action.

12. Complaints

1. Contact us first: Email [email protected]
   3, Inyima Lane, Ebem, Abia State, Nigeria or call +234 816 516 0797.
2. Nigeria Data Protection Commission:
   Website: https://ndpc.gov.ng · Email: [email protected]
3. EU/UK residents: You may also contact your local supervisory authority.

13. Changes to This Policy

We may update this policy periodically. For changes affecting children's data processing, we will seek renewed parental consent where required. Material changes will be communicated via the Platform, email, and/or through the school. The "Effective" date at the top indicates the latest revision.

14. Governing Law

This Privacy Policy is governed by the laws of the Federal Republic of Nigeria, including the Nigeria Data Protection Act 2023, the NDPA 2019 Implementation Framework, and the Child Rights Act 2003. For international users, the EU GDPR and UK GDPR apply where relevant.