This policy explains what personal information God's Heritage School collects through this website and the school portal, why we collect it, who we share it with, and the rights you have over it. It is written for parents and guardians, so we have kept the legal wording to a minimum.
We are the data controller for the information described here. We process personal data in line with the Nigeria Data Protection Act 2023 (NDPA) and the supervision of the Nigeria Data Protection Commission (NDPC).
1. Who this policy covers
It covers everyone whose information passes through our systems:
- Pupils and students enrolled at the school — pupils from Creche to Primary 6, students from JSS 1 to SS 3. Where this policy says child it means either.
- Parents and guardians who register for a portal account.
- Teachers and staff who use the teacher or admin portal.
- Visitors to the public website who send us an enquiry.
2. What we collect
| Information | Why we hold it |
|---|---|
| Parent name, email address, phone and WhatsApp number | To create and verify your portal account, contact you about your child, and add you to the class parents' group where you have asked us to |
| Child name, date of birth, gender, class, arm, house, admission number and passport photograph | To keep the school register and identify your child correctly on results, attendance and report cards |
| Attendance records | To record who was present, absent or late each school day |
| Test and examination scores, grades, positions and teachers' remarks | To assess your child's progress and produce report cards |
| Fee records and payment history | To bill correctly, record what has been paid and issue receipts |
| Messages you send through the portal | To pass them to the teacher, parent or administrator you addressed |
| Questions you put to the school's AI assistant | To answer them; see section 6 |
| Basic technical information (browser type, approximate location from your IP address, pages visited, error reports) | To keep the portal working and secure |
We do not ask for, and you should not send us, information we have no reason to hold — bank card numbers, national identity numbers, or health details beyond what the school needs to care for your child safely.
3. Why we are allowed to hold it
Under the NDPA we rely on these lawful bases:
- Contract — we need the information to educate your child and to run the account you asked us to open.
- Legal obligation — schools in Nigeria are required to keep registers, records of enrolment and academic records.
- Legitimate interest — keeping the portal secure, preventing misuse, and communicating about school activities.
- Consent — for anything optional, such as publishing a child's photograph in the school gallery. You may withdraw consent at any time.
4. Who we share it with
We do not sell personal data, and we never will. We share it only with:
- Teachers and administrators of this school, and only for the children they are responsible for.
- Google Firebase (Google LLC), which provides the sign-in and database that the portal runs on.
- Railway, which hosts the school's application server.
- Groq, which provides the AI assistant — see section 6 for exactly what reaches it.
- Our payment provider, once online fee payment is switched on, so that a payment can be matched to the right child.
- Government or law enforcement, where we are legally required to.
Some of these providers store data outside Nigeria. Where that happens we rely on their contractual data-protection commitments, as the NDPA permits.
5. Passport photographs
Child passport photographs are uploaded by school staff through the admin portal and stored with our image host. They appear on the child's record and on their identity card. They are not used for anything else and are not made public.
6. The AI assistant
The portal includes an AI assistant. Two things about it matter for your privacy:
- The assistant is given only the information the person asking is already allowed to see. A child cannot ask it about another child. A parent can only ask about their own children. This is enforced on our server, not in the browser.
- Your question and that limited context are sent to Groq to generate the answer. Do not type anything into the assistant that you would not want leaving the school.
7. How long we keep it
| Record | Kept for |
|---|---|
| Child academic and attendance records | The child's time at the school, then archived permanently as the school's academic record |
| Parent portal accounts | While a child is enrolled, then twelve months |
| Fee and payment records | Six years, as required for financial records |
| Portal messages | Two academic sessions |
| Activity and security logs | Twelve months |
8. Your rights
Under the NDPA you may ask us to:
- show you the personal data we hold about you or your child;
- correct anything that is wrong — a misspelt name, a wrong date of birth, a wrong mark;
- delete data we no longer have a reason to keep;
- stop using data where we relied on your consent;
- give you a copy of your data in a portable form.
Write to us using the details below and we will respond within 30 days. If you are not satisfied you may complain to the Nigeria Data Protection Commission.
9. Keeping it safe
- Every account is protected by a password or Google sign-in, and every portal page checks who you are before it shows anything.
- Database rules enforce, at the database itself, that a parent can only read their own children's records and a teacher only their own classes.
- Secrets such as API keys live on the server, never in the browser.
- Examination answer keys never reach a child's browser; marking happens on our server.
- Administrative actions are recorded in an activity log that administrators can review.
If a breach happens that puts anyone at risk, we will tell the affected families and the NDPC as the law requires.
10. Children
Child accounts are created by the school, not by children signing themselves up, and a parent or guardian must have registered first. Parents may ask at any time to see everything held about their child. See our Child Protection and Safeguarding policy for how we keep children safe in the portal's messaging features.
11. Changes
If we change this policy we will update the date at the top of this page and, for anything significant, tell parents through the portal.
12. Contact us
For any question about this policy, or to exercise a right above, contact the school's data protection contact:
God's Heritage School
Ajimasin Ago Area, Olunde Ibadan
Email: care@ghs.com.ng or info@ghs.com.ng
Phone: +234 803 385 3369 or +234 803 487 7979
Office hours: Monday to Friday, 7:00am – 4:00pm