1. Introduction & Commitment
Exwhyzee Technologies ("Exwhyzee SP", "we", "our", or "us") operates a unified, multi-tenant cloud School Management and Academic Enterprise Resource Planning (ERP) platform. We are committed to protecting the privacy, integrity, and confidentiality of student records, educational assessment data, parent communications, and institutional financial transactions.
This Privacy Policy explains how personal data is collected, stored, encrypted, processed, and safeguarded when schools, administrators, teachers, parents, guardians, and students access and utilize our services.
2. Categories of Information We Collect
To provide school management services, we process several categories of data entrusted to us by educational institutions:
- Student Profile & Academic Data: Full legal names, admission/matriculation numbers, gender, date of birth, passport photographs, continuous assessment (CA) scores, examination marks, grade positions, psychomotor ratings, and terminal broadsheets.
- Parent & Guardian Information: Full names, primary phone numbers (for SMS broadcasts and notifications), email addresses, residential locations, and fee payment verification transaction records.
- Staff & Educator Credentials: Official email addresses, telephone numbers, role-based access rights, lesson plan submissions, attendance records, and administrative audit trails.
- System & Usage Telemetry: Log timestamps, IP addresses, browser types, session duration, and device identifiers collected to prevent brute-force attacks and ensure account safety.
3. Purpose and Legal Basis for Processing
All data processed on Exwhyzee SP is governed by contractual necessity with registered educational institutions and used solely for lawful academic and administrative operations, including:
- Processing terminal report cards, cumulative transcripts, and automated cognitive evaluations.
- Conducting Computer-Based Testing (CBT) examinations, online quizzes, and entrance assessment grading.
- Invoicing school fees, issuing digital receipts, generating bank tellers, and reconciling payments.
- Delivering automated SMS alerts, exam timetable broadcasts, fee reminder alerts, and emergency notifications.
- Facilitating prospective student admissions, entrance screening forms, and registration verification.
4. Multi-Tenant Data Isolation & Security Architecture
Security is embedded at every layer of our platform architecture:
- Database Isolation: Each institution operates with dedicated database connection strings or isolated schemas, preventing cross-tenant data leakage or unauthorized access.
- Encryption in Transit & at Rest: All web traffic is encrypted using 256-bit TLS/SSL encryption. Database backups and sensitive credentials are encrypted using industry-standard hashing algorithms.
- Role-Based Access Control (RBAC): Strict permission matrices ensure teachers only access their assigned classes, students only view their own performance, and accountants only access financial ledgers.
- Automated Disaster Recovery: Redundant cloud snapshots and point-in-time recovery mechanisms ensure business continuity and guard against catastrophic data loss.
5. Financial & Payment Data Security
Exwhyzee SP does not store raw credit/debit card numbers or bank account PINs on our servers. All online fee transactions are processed through certified, PCI-DSS compliant payment gateways. We only retain transaction reference IDs, settlement timestamps, and bank payment confirmation logs for accounting and audit reconciliation.
6. Data Retention & Institutional Ownership
Educational institutions retain complete, exclusive ownership of their student and staff data. Exwhyzee SP acts as a Data Processor. We retain academic archives for the duration of the school's active subscription and in accordance with institutional regulatory standards. School administrators may request full database exports or account archiving at the conclusion of any academic session.
7. Data Subject Rights & Regulatory Compliance
We comply with the Nigeria Data Protection Regulation (NDPR) and international privacy frameworks (GDPR). Data subjects (students, parents, and teachers) have the right to request access, rectification, or updates to their personal information through their school administrator or our Data Protection Officer.
8. Cookies and Storage Technologies
We use essential cookies and browser storage tokens to authenticate users, protect forms from Cross-Site Request Forgery (CSRF), and maintain session state. Please review our Cookie Policy for complete details.
9. Contact Our Data Protection Officer
If you have questions, feedback, or compliance requests regarding this Privacy Policy, please contact our Data Protection Team:
Exwhyzee Technologies Ltd
Email: info@exwhyzee.ng | privacy@exwhyzee.ng
Website: www.exwhyzee.ng
Support Line: +234 800 EXWHYZEE (24/7 Academic Support)