Privacy Policy

Sautus Sunnah International Comprehensive Secondary School ("the School", "we", "us") operates the online portal at ssicschool.ng. This policy explains what personal data we collect, why, how we protect it, and the rights you have. Because most of the people whose data we hold are children, we take particular care and rely on parental/guardian consent as our primary lawful basis for processing pupils' data, in line with the Nigeria Data Protection Act (NDPA) 2023.

1. Who is responsible for your data

The School is the data controller. We have designated a Data Protection Officer (DPO) who is responsible for overseeing how we handle personal data and for answering your questions. To make a privacy request or raise a concern, contact the DPO:

The Data Protection Officer (c/o the School Administrator)
Sautus Sunnah International Comprehensive Secondary School
77 Lawrence Onoja Rd, Katsina 820101, Katsina
Phone: 0706 953 4258 · Email: info@ssicschool.ng (please mark your message "For the attention of the Data Protection Officer")

2. The data we collect

• Pupil records: name, admission number, date of birth/age, gender, house, class, state and local government of origin, and (where provided) health or allergy notes relevant to care.
• Parent/guardian details: names, phone numbers, email addresses and relationship to the pupil.
• Academic data: assessment scores, results, positions, attendance and conduct remarks.
• Financial data: fee invoices, payment status and payment references. Card and bank details are handled directly by our payment processor — we never see or store them.
• Photographs: a pupil's photograph where the school uses it, and prefect/leadership photographs shown publicly only with recorded parental consent.
• Account & technical data: login email, encrypted password, role, and basic security logs.

We collect only what is needed to run the school and serve families (data minimisation).

3. Why we use it (lawful basis)

• Parental/guardian consent for processing a child's personal data, including any photograph used publicly.
• Performance of our agreement with families — enrolment, teaching, assessment, and fee administration.
• Legitimate interests of running the school safely and keeping accurate records, balanced against your rights.
• Legal obligations where the law requires us to keep certain records.

4. Who we share it with

We do not sell personal data. We share it only with service providers who process it on our behalf under contract, and only as needed to run the portal:

• Our secure database, authentication and file-storage provider (hosting the portal's data).
• Our website hosting provider.
• Our payment processor (Paystack) for online fee payments.
• Our SMS and email providers, to send you notices, reminders and account messages.

We may also disclose data where required by law or to protect a child's safety.

5. How we protect it

Access is restricted by role: each parent sees only their own children's information, each teacher only their assigned work, and so on — enforced at the database level. Data is encrypted in transit, passwords are stored in hashed form, and administrative access is limited and logged. Result sheets and pupil documents are served through private, time-limited links, never public ones.

6. How long we keep it

• Academic records are retained as part of the pupil's permanent school record.
• Unsuccessful/abandoned applications are deleted after the admissions cycle they relate to.
• When a pupil leaves, we remove data that is no longer needed while preserving the records the school is legitimately required to keep.

7. Children's data & photographs

Pupils' data is processed on the basis of parental/guardian consent. We do not publish a child's photograph on our public website without recorded parental consent, and consent can be withdrawn at any time by contacting us.

8. Your rights (NDPA)

You have the right to:

• Access the personal data we hold about you or your child.
• Ask us to correct inaccurate data.
• Ask us to delete data we no longer have a lawful reason to keep.
• Object to or restrict certain processing, and withdraw consent.
• Lodge a complaint with the Nigeria Data Protection Commission.

To exercise any right, contact us using the details in section 1. We respond within the time the NDPA requires.

9. Changes to this policy

We may update this policy from time to time. Material changes will be communicated through the portal or by notice to families. The date at the top shows when it was last updated.