Privacy Policy

This Privacy Policy explains how Belad Creative Hub Ltd., operating SMS Naija ("we", "us"), collects, uses, and protects personal data. We process data in line with the Nigeria Data Protection Act (NDPA) 2023 and the regulations of the Nigeria Data Protection Commission (NDPC).

1. Two roles: controller and processor

This matters because SMS Naija serves schools, not just individuals:

• For a school's students, parents, and teachers — data the school uploads or its staff enter (academic records, attendance, fee status, contact details) — the school is the data controllerand SMS Naija acts as a data processor, processing it only to provide the platform to that school. Requests to access, correct, or delete a student's or parent's data should generally start with the school; we support schools in fulfilling those requests.
• For account data collected directly by us — School Owner registration, Superadmin/marketer accounts, blog subscribers, and platform usage data — SMS Naija is the data controller.

2. What we collect

• Account data: name, email, phone number, password (stored as a salted hash, never in plain text) or Google account identifier if you sign in with Google.
• School registration data: CAC number, school name, address, state/LGA, owner name, uploaded CAC document and, where applicable, an owner identification document.
• Academic and operational data: student records, attendance, grades, admissions applications — entered or bulk-uploaded by school staff.
• Payment data: we do not store card numbers. Application fees, school fees, and other fees a school configures are processed by Paystack; we retain transaction references, amounts, and — for schools — settlement bank account details needed to pay out collected fees, minus SMS Naija's 1% transaction fee.
• Communications: support tickets, WhatsApp/email messages you send us, and messages sent through the in-platform Communication Hub.
• Usage data: pages visited, device/browser information, and similar analytics needed to operate and secure the platform.

3. How we use it

• To create and secure accounts, including 2FA verification codes for accounts with two-factor authentication enabled.
• To operate core features: admissions, fee tracking and payment collection, attendance, gradebook, Skill Hub enrollment and certificates, and the Communication Hub.
• To send transactional communications — admission letters, fee reminders, password resets, notification broadcasts a school or Superadmin sends to relevant users.
• To calculate and pay Royal Marketer commissions.
• To detect fraud (e.g. falsified CAC numbers, referral abuse) and secure the platform.

4. Children's data

Many students on SMS Naija are minors. Student records are uploaded by their school, which is responsible for having the appropriate authority (typically parental/guardian consent obtained through the school's own enrollment process) to do so. We do not knowingly market directly to children, and student accounts are used solely to deliver school-related functionality (e.g. viewing grades, Skill Hub access where eligible).

5. Who we share data with

We share data only as needed to run the platform, with these categories of third parties:

• Paystack — payment processing for application, school, and other platform-configured fees.
• Termii — SMS delivery for parent/admissions notifications (school-initiated, drawn from the school's SMS balance).
• Resend — transactional and broadcast email delivery.
• Google — if you choose "Continue with Google" to sign in or register a school.
• Law enforcement or regulators, where required by Nigerian law.

We do not sell personal data to third parties.

6. International transfers

Some of the providers above may process data on servers outside Nigeria. Where this happens, we rely on those providers' own data-protection safeguards and, where required by the NDPA, appropriate transfer mechanisms.

7. Data security

Passwords are hashed, not stored in plain text. Superadmin accounts require two-factor authentication. Access to a school's data is restricted to that school's own staff accounts and platform administrators with a legitimate operational need. No system is perfectly secure, and we encourage strong, unique passwords and enabling 2FA where available.

8. Data retention

We retain account and academic data for as long as the account or school remains active on the platform, and for a reasonable period after closure to meet legal, tax, and dispute-resolution obligations. A school owner or Superadmin can request deletion of a closed school's data, subject to any records we are legally required to retain.

9. Your rights under the NDPA

You may request to:

• Access the personal data we (or, for student/parent data, your school) hold about you.
• Correct inaccurate data.
• Request deletion, subject to legal retention requirements.
• Object to certain processing, such as marketing broadcasts (you can also unsubscribe directly from marketing emails).
• Request a copy of your data in a portable format.

To exercise any of these rights, contact info@smsnaija.com. If your request concerns student or parent data held on behalf of a specific school, we may direct you to that school first, as they are the data controller for that data.

10. Cookies

We use essential cookies/local storage to keep you signed in and to remember in-progress forms (for example, school-onboarding details while you complete Google sign-in). We do not use third-party advertising trackers.

11. Changes to this policy

We may update this Privacy Policy as the platform evolves; the "Last updated" date above reflects the latest revision. Material changes affecting how school data is processed will be communicated to school owners.

12. Contact

Data protection queries: info@smsnaija.com or our support page.