Privacy notice

About this demonstration policy

Lagoon Heights Academy is a fictional demonstration school. This policy illustrates a complete school process as at 8 October 2026; it is not an approved policy of an operating school or a claim of legal certification. The sample email, telephone and address are not monitored services. Do not submit real children’s information, send money or rely on this demo for urgent help. A live school must approve its own details and procedures before using this copy.

Who is responsible

Lagoon Heights Academy determines why pupil, family and school-operation information is used. In a live school it acts as the data controller. Oyibo operates the school software and provides agreed support on the school’s instructions; it does not gain permission to use children’s records for its own advertising. Payment and identity providers also have their own responsibilities for the services they supply. This notice covers the public website, enquiries, admissions and the private school portals. Employment information also requires the staff notice provided during recruitment.

Information we ask for

We ask only for information relevant to the service or the child’s care. Public enquiry forms request contact details and a message. Applications request the applicant’s name, date of birth, intended class and the applying adult’s contact and relationship details. More sensitive evidence belongs in an authorised private channel after staff explain why it is needed.

• Pupil records: admission number, class, attendance, assignments, assessments and approved reports.
• Family records: guardian relationships, legal restrictions, emergency contacts, fee responsibility and authorised collection arrangements.
• Finance records: invoices, allocations, payment references, proof documents, credits and approved refunds. The school does not collect raw card details.
• Care and safeguarding records: necessary allergies, care instructions, clinic visits, permissions and incident records, with additional restrictions.
• School activities: club choices, trips, transport lists, library loans and the permissions needed to participate.
• Technical records: security events, request/device information and essential account identifiers needed to keep the service reliable.

Purposes and legal grounds

We identify a lawful ground for each use rather than treating a single checkbox as permission for everything. Adult enquiries and admission arrangements can involve steps requested before a contract; education-service agreements and necessary statutory records have their own grounds. Child and sensitive information needs the applicable safeguards and guardian permissions. A documented education, medical-confidentiality, legal or vital-interest exception may apply to particular necessary processing. A live school must record its basis and any relevant exception before relying on it.

• Respond to the question or application you sent; operational follow-up is not permission for unrelated marketing.
• Provide teaching, assess work, manage attendance and communicate necessary school information.
• Protect welfare, manage safe collection and arrange appropriate support or emergency care.
• Issue and reconcile school charges, maintain reliable financial evidence and resolve disputes.
• Control access, investigate misuse and preserve evidence where a justified legal obligation or claim requires it.

Children, health information and photographs

We check the applying adult’s relationship before granting private access. A child’s age or a shared phone number alone does not grant guardian authority. Where consent is required, we explain the particular purpose and verify the appropriate parent or legal guardian. We discuss requests from children in a way suitable for their understanding and assess their rights separately. Necessary confidential care records are not a public gallery. Optional website photographs, social-media publication and promotional messages require separate choices: declining publicity does not remove teaching, care or admission eligibility. Withdrawal stops future optional use and starts a review of school-controlled copies; already distributed printed materials or third-party copies may need separate handling.

Who can see school records

Access follows the person’s verified duty and the relevant campus, class or child. Teachers receive the teaching information they need; finance staff receive authorised fee information; clinical and safeguarding material has narrower access. A verified fee payer may see invoices without academic portal access. A collection-authorised adult does not automatically become a legal guardian, fee payer or health decision-maker. Staff check court orders, changes in parental responsibility and revoked permissions. Support access must be specifically approved, limited in time and recorded. A privacy request is assessed on its own merits and is not refused merely because the requester lacks a portal account.

Service providers and international processing

This local demonstration stores fictional data in the project’s PostgreSQL database and keeps demo uploads locally. Its configured demo accounts do not send real provider payments or external messages. The intended live setup uses the providers below. An EU server address does not itself prove every processing operation or support access stays in the EU. Before a live school sends information abroad, it must assess the actual provider terms, safeguards and lawful transfer mechanism and tell families about material changes.

• Render Frankfurt: application, database and background school processing, when the live deployment is configured there.
• Amazon Cognito Frankfurt: verified account sign-in and recovery. Managed login has its own provider-domain security cookies.
• Cloudflare R2: private documents and separate backups in explicitly created EU-jurisdiction buckets. A location hint alone is not an EU residency guarantee.
• Paystack: hosted checkout, payment verification and transaction records for the school’s own merchant account. Read Paystack’s Privacy and Cookie Policy at paystack.com/terms.
• Email, SMS or WhatsApp: only approved channels that the school actually enables, with the required permissions and provider terms. No advertising tracker is installed in the current website.

Demonstration retention schedule

The periods below are explicit sample policy choices for review, not universal statutory deadlines. An operating school must adopt a schedule that fits its legal duties, pupil ages and state requirements, review disposal regularly and log justified exceptions. The website does not claim that every record is automatically deleted on a timer. Legal holds are limited to the relevant records, reviewed and lifted when their reason ends.

• Unconverted enquiries and unsuccessful or withdrawn applications: review and remove unnecessary identifying details within six months; retain a documented legal-claim exception only where justified.
• Ordinary pupil administration, attendance and assessment records: active attendance plus six years after departure, then review and securely delete information no longer needed.
• Minimal final-award verification: a proposed 25-year record of identity, award and date, with a necessity review at least every five years; unnecessary working files are excluded.
• Invoices, receipts and financial approval evidence: proposed six years after the relevant financial year, subject to the actual accounting/tax obligations and any unresolved dispute.
• Routine clinic and care records: proposed three years after departure; serious safeguarding or injury records require a separate age-aware, professionally approved schedule and case review.
• Optional publicity: only for the purpose and duration explained in the separate permission; review at the end of each school year and on withdrawal.
• Routine security logs: proposed 90 days unless selected evidence is needed for an investigation. Backups: proposed 90-day rotation under the approved live backup policy, with restricted use and deletion decisions reapplied after a restore.

Your choices and rights

You can ask what information is held, request an appropriate copy, correct an error, ask for deletion or restricted use, object where applicable, request portability where available, or withdraw optional consent. Rights can have lawful limits, for example another child’s confidentiality or necessary financial evidence. We explain any limitation instead of silently refusing a request. Teaching, admission, disciplinary and refund decisions are reviewed by authorised people; the website does not make a final significant decision solely by an algorithm.

• Contact the school office with the relevant pupil or account reference, the information concerned and the outcome you want. Do not send a password, full card number or unnecessary identity document.
• The privacy lead verifies identity and authority proportionately, for example through an existing contact route or a secure evidence request. A payer relationship is not assumed to authorise all child records.
• The sample service target is acknowledgement within five school days and a substantive response within 30 calendar days. The live school must apply the legal timetable and explain any justified delay.
• You may raise a privacy concern with the Nigeria Data Protection Commission through its official website, ndpc.gov.ng, without giving up another lawful remedy.

Security, incidents and changes

Private records require authenticated access and are checked against current permissions. Approved financial and academic history is preserved; corrections use the relevant reviewed process. Keep shared devices secure and sign out after use. If you believe an account, document or child’s information has been exposed, contact the school promptly with a description of the incident. The school restricts further access, investigates, preserves necessary evidence and assesses notifications to affected people and the regulator. It cannot promise absolute security or that a lawfully required record will be erased on demand. Updates to this notice must reflect actual changes, not conceal a new purpose.