Privacy Policy

1. Introduction

CerebriaTech Solutions ("CerebriaTech", "we", "us" or "our") operates School Report Pro, a school management and administration platform.

We recognise that schools use School Report Pro to manage information relating to students, parents, guardians, teachers, staff and other individuals.

We are committed to handling personal data responsibly, securely and transparently.

This Privacy Policy explains:

• what information may be processed through School Report Pro;
• why information is processed;
• the roles of schools and CerebriaTech;
• how information is protected;
• how long information may be retained;
• how data may be exported or deleted;
• how security incidents are handled; and
• how privacy rights may be exercised.

This Privacy Policy is intended to operate consistently with the Nigeria Data Protection Act 2023 and applicable requirements and guidance issued by the Nigeria Data Protection Commission.

2. Important Role of the School

For information that a school collects and stores through School Report Pro, the School generally determines why the information is collected and how it is used in its educational and administrative activities.

The School therefore has important responsibilities concerning its students, parents, guardians and staff.

For example, the School is generally responsible for determining:

• what information it collects;
• the purpose of collection;
• the lawful basis for processing;
• who should have access;
• how long information should be retained; and
• how requests from data subjects should be handled.

CerebriaTech provides the technology through which the School manages that information.

Where CerebriaTech processes School Data on behalf of a School, CerebriaTech will process such information for the purposes of providing, maintaining, securing and supporting the Service and according to applicable instructions and law.

3. Information We May Process

Depending on the features used by a School, School Report Pro may process information including:

Student information

This may include:

• name;
• date of birth;
• gender;
• student identification information;
• class and academic information;
• attendance;
• examination and assessment records;
• photographs;
• contact information;
• guardian or parent information;
• home or contact address;
• nationality or state information;
• information relating to school activities; and
• other information entered by the School.

Parent and guardian information

This may include:

• names;
• telephone numbers;
• email addresses;
• addresses;
• relationship to the student;
• payment or account information entered by the School; and
• communication information.

Staff information

Depending on the School's use of the Service, this may include:

• name;
• contact details;
• employment information;
• staff identification information;
• photographs;
• role;
• salary or payment information;
• attendance;
• qualifications;
• administrative records; and
• other employment-related information entered by the School.

School information

This may include:

• school name;
• address;
• contact information;
• school logo;
• administrative information;
• subscription information;
• configuration settings; and
• information relating to authorised School users.

Account information

This may include:

• username;
• email address;
• account role;
• login-related information;
• password-reset information;
• user permissions; and
• account activity.

Passwords are intended to be stored and handled through appropriate authentication mechanisms. CerebriaTech does not send existing user passwords through ordinary password-reset emails.

4. Information Provided Directly by Users

Information may be provided when:

• a school creates an account;
• a school registers students;
• staff accounts are created;
• users update records;
• users upload documents or photographs;
• users contact support;
• users request password resets;
• users subscribe to a plan;
• users make or record payments;
• users submit support requests; or
• users otherwise interact with the Service.

5. Information Generated Through Use of the Platform

School Report Pro may generate technical and operational information needed to operate and secure the Service.

This may include:

• login activity;
• account activity;
• timestamps;
• audit events;
• security events;
• error information;
• system activity;
• service usage information; and
• information necessary to diagnose technical problems.

Where appropriate, this information may be recorded in audit logs.

6. Audit Logs

School Report Pro may maintain audit logs to support accountability and security.

Audit logs may record information such as:

• which authorised user performed an action;
• the school associated with the user;
• when the action occurred;
• what action was performed;
• which system area was affected; and
• relevant technical information necessary to investigate the activity.

Audit logging may help CerebriaTech and Schools investigate:

• unauthorised access;
• suspicious activity;
• changes to important records;
• account misuse;
• technical problems; and
• security incidents.

Audit information will be handled as confidential operational information and will not be used for unrelated purposes.

7. Why We Process Personal Data

Depending on the circumstances, information may be processed for:

Providing the Service

We process information so that School Report Pro can provide the features requested by the School.

Account administration

We process account information to create, authenticate, maintain and secure user accounts.

School administration

School Data is processed to enable schools to perform academic, administrative and operational functions.

Technical support

We may access limited information where reasonably necessary to investigate technical issues or respond to legitimate support requests.

Security

Information may be processed to protect the Platform, detect suspicious activity, investigate security incidents and prevent abuse.

Backups and recovery

School Data is processed and stored as part of our backup and disaster-recovery processes.

Payments and subscriptions

Payment and subscription information may be processed to manage service access, billing records, payment verification and subscription status.

Legal obligations

Information may be processed where necessary to comply with applicable legal obligations or lawful requests.

Service improvement

Technical and aggregated information may be used to understand performance, diagnose problems and improve School Report Pro.

We do not sell School Data to third parties.

8. Legal Basis for Processing

Where required by applicable law, personal data will be processed on an appropriate lawful basis.

Depending on the activity, this may include:

• performance of a contract;
• compliance with a legal obligation;
• legitimate interests where applicable;
• consent where consent is required; or
• another lawful basis recognised by applicable data-protection law.

The School remains responsible for determining the appropriate lawful basis for personal data that it collects and controls through the Platform.

9. Children and Student Data

School Report Pro is designed for use by educational institutions and may therefore process information relating to children and young persons.

CerebriaTech recognises that student information requires particular care.

Schools using School Report Pro are responsible for ensuring that their collection and use of student information is lawful and that appropriate notices, permissions, consents or other lawful bases are obtained where required.

CerebriaTech will not intentionally use student information for advertising or unrelated commercial profiling.

Student information is processed for the operation of the Service and the legitimate educational and administrative purposes for which the School uses the Platform.

10. School Data Confidentiality

School Data is treated as confidential.

CerebriaTech does not claim ownership of a School's student, parent, staff or school records.

CerebriaTech personnel are not permitted to access School Data merely out of curiosity or for personal purposes.

Access may occur only where reasonably necessary for legitimate operational purposes such as:

• providing support;
• troubleshooting;
• maintaining the Service;
• security investigation;
• preventing abuse;
• system administration;
• restoring or recovering data;
• complying with legal obligations; or
• another legitimate purpose connected with operating School Report Pro.

Where personnel or contractors may have access to confidential information, appropriate confidentiality obligations apply.

11. Security

CerebriaTech applies reasonable technical and organisational measures designed to protect personal data from:

• unauthorised access;
• unauthorised disclosure;
• accidental loss;
• alteration;
• destruction; and
• other inappropriate processing.

Depending on the environment and circumstances, security measures may include:

• account authentication;
• access controls;
• role-based permissions;
• secure web connections;
• restricted administrative access;
• audit logging;
• server security measures;
• backup and recovery procedures;
• security monitoring;
• software maintenance; and
• incident-response procedures.

Because School Report Pro operates through internet-connected infrastructure, no service can guarantee absolute protection against every possible cyberattack or security event.

CerebriaTech nevertheless treats security as an ongoing operational responsibility.

12. Automated Daily Backups

CerebriaTech currently performs automated daily backups of School Report Pro data.

The backup process is designed to support recovery from events such as:

• accidental deletion;
• database failure;
• server failure;
• application problems;
• certain security incidents;
• accidental loss of uploaded files; and
• infrastructure migration.

Where applicable, backup coverage includes both the database and relevant uploaded files required to restore the School's environment, including items such as:

• student photographs;
• staff photographs;
• school logos;
• uploaded documents; and
• other files stored through the Platform.

CerebriaTech may maintain multiple backup recovery points, including daily, weekly and monthly retention periods, depending on the operational backup schedule.

Backups are protected and are not intended to be used as ordinary day-to-day copies of School Data.

13. Data Recovery

If a technical failure or other event requires restoration, CerebriaTech may use available backups to restore the Service.

Recovery time may vary depending on:

• the nature of the incident;
• the amount of data involved;
• the extent of infrastructure damage;
• the availability of backup copies;
• hosting infrastructure; and
• other technical circumstances.

The existence of backups does not constitute a guarantee that every individual historical change can always be restored.

CerebriaTech will take reasonable measures to maintain recoverable copies and improve recovery capability over time.

14. Data Storage and Hosting

School Report Pro operates using hosting and infrastructure selected by CerebriaTech.

CerebriaTech may change hosting infrastructure where reasonably necessary to improve:

• security;
• performance;
• scalability;
• reliability;
• backup capability;
• business continuity; or
• technical operations.

Such changes may involve migrating the application, database and uploaded files to another compatible server or infrastructure environment.

School Data remains under the School's control regardless of the underlying hosting environment.

15. Who May Receive Personal Data

Personal data may be accessible to:

• the School and its authorised users;
• CerebriaTech personnel with a legitimate operational need;
• authorised technical service providers;
• hosting or infrastructure providers;
• payment providers where relevant;
• communication providers where required to deliver service messages;
• professional advisers where reasonably necessary; or
• government, law-enforcement or regulatory authorities where legally required.

CerebriaTech will take reasonable steps to ensure that third parties involved in processing personal data provide appropriate protections consistent with their role.

16. Third-Party Service Providers

School Report Pro may use third-party service providers to support certain technical or operational functions.

Examples may include providers supporting:

• hosting;
• email delivery;
• payment processing;
• infrastructure;
• communications;
• technical monitoring; or
• other essential service functions.

CerebriaTech does not permit third parties to use School Data for their own unrelated purposes merely because they provide infrastructure or technical services to School Report Pro.

Where a third party processes personal data on behalf of CerebriaTech, appropriate contractual and security arrangements will be considered based on the nature of the processing.

17. Payment Information

School Report Pro may maintain information relating to:

• subscription plans;
• invoices;
• payment status;
• payment dates;
• transaction references;
• amounts paid; and
• other information necessary to administer subscriptions.

Where a third-party payment provider is used, payment processing may occur through that provider's infrastructure.

CerebriaTech will retain payment records for legitimate business, accounting, service administration, dispute-resolution and legal purposes.

18. Passwords and Password Reset

Users are responsible for keeping their passwords confidential.

School Report Pro provides password-reset mechanisms where available.

Password-reset emails are intended to contain a reset mechanism or link rather than the user's existing password.

Users should immediately report suspected account compromise.

19. Data Retention

CerebriaTech does not intend to retain School Data indefinitely when there is no legitimate reason to do so.

Retention periods may depend on:

• the School's active use of the Service;
• the School's instructions;
• legal requirements;
• accounting requirements;
• security requirements;
• dispute resolution;
• backup retention;
• contractual obligations; and
• legitimate operational requirements.

Different categories of information may therefore have different retention periods.

20. Deletion of School Data

A School may request permanent deletion of its School Data.

Because permanent deletion can be irreversible, CerebriaTech may require reasonable verification and confirmation before completing the request.

The School should export any information it wishes to retain before requesting permanent deletion.

Once a valid deletion request has been confirmed, School Data will be removed from active production systems within a reasonable operational period, subject to information that CerebriaTech is required or permitted to retain.

Copies may remain temporarily in protected backups until the applicable backup retention cycle expires or the relevant backup is securely overwritten.

Backup copies retained during this period are not ordinarily available for normal School operations.

21. Data Export and Portability

Schools retain control of their School Data.

Where export functionality is available, Schools may export their information using the available export tools.

A School may also request reasonable assistance with data retrieval where necessary, subject to applicable technical and commercial arrangements.

Exports may be provided in commonly usable formats supported by the relevant system functionality.

The School is responsible for storing exported copies securely after receiving them.

22. Data Subject Rights

Under applicable Nigerian data-protection law, individuals may have rights concerning their personal data.

These may include:

• the right to be informed;
• the right of access;
• the right to rectification;
• the right to object;
• the right to restrict processing;
• the right to data portability;
• the right to erasure; and
• other rights recognised by applicable law.

The Nigeria Data Protection Commission identifies these rights among the rights of data subjects under the NDP Act.

For information controlled by a School, requests should ordinarily be made to the relevant School.

Where CerebriaTech receives a request relating to School-controlled information, CerebriaTech may assist the School as reasonably required and permitted by applicable law.

23. Correction of Information

Schools should maintain accurate records.

If a School identifies incorrect information in its account, it should correct the information through the available Platform functionality or contact support where correction requires technical assistance.

Where an individual requests correction of information controlled by a School, the School will ordinarily determine whether the information should be corrected.

24. Security Incidents and Breach Notification

CerebriaTech maintains procedures for identifying and responding to suspected security incidents.

Where a confirmed personal-data breach occurs within systems controlled by CerebriaTech and the incident creates obligations under applicable data-protection law, CerebriaTech will take appropriate steps to:

• investigate the incident;
• contain and mitigate the incident;
• assess potential risks;
• preserve relevant evidence;
• notify affected customers where appropriate;
• cooperate with applicable regulatory obligations; and
• take reasonable steps to prevent recurrence.

Where notification to the Nigeria Data Protection Commission or affected data subjects is legally required, the applicable statutory and regulatory requirements will be followed.

25. International Data Transfers

Where School Report Pro or an applicable service provider processes personal data outside Nigeria, CerebriaTech will consider applicable Nigerian data-protection requirements governing such transfers.

CerebriaTech will not make international data transfers merely for convenience where applicable law requires additional safeguards.

The applicable processing arrangements may be documented through contractual terms, processor agreements or other appropriate safeguards.

26. Cookies and Similar Technologies

School Report Pro may use cookies or similar technical technologies necessary for:

• authentication;
• maintaining sessions;
• remembering preferences;
• security;
• system functionality; and
• improving the user experience.

Where non-essential cookies or similar technologies are used, appropriate information or controls will be provided where required.

27. Marketing

CerebriaTech does not sell School Data to advertisers.

CerebriaTech may communicate with Schools about:

• service updates;
• new features;
• account matters;
• subscription matters;
• security matters;
• support matters; and
• relevant business information.

Where marketing communications require consent or another lawful basis under applicable law, CerebriaTech will follow the applicable requirements.

28. Data Security Responsibilities of Schools

Privacy and security are shared responsibilities.

The School is responsible for:

• selecting authorised users;
• assigning appropriate permissions;
• protecting passwords;
• removing former staff;
• protecting devices;
• training relevant personnel;
• preventing unauthorised sharing of records;
• ensuring lawful collection of information; and
• promptly reporting suspected compromise.

CerebriaTech is responsible for the security controls within its own operational environment.

Neither party should assume that the other party is responsible for security measures that are within its own control.

29. Employees and Contractors

CerebriaTech may use employees or contractors to operate, maintain and support School Report Pro.

Where such persons may access confidential or personal information, CerebriaTech will apply appropriate confidentiality and access-control measures appropriate to their responsibilities.

Access should be limited according to legitimate business need.

30. Data Breaches Caused by School Accounts

If a security incident occurs because a School:

• shares passwords;
• fails to remove an unauthorised user;
• allows an unauthorised person to use its account;
• uses an insecure device;
• intentionally grants inappropriate access; or
• otherwise causes a compromise within its own control,

the School remains responsible for that aspect of the incident.

This does not relieve CerebriaTech of responsibility for security failures within CerebriaTech's own systems.

Where responsibility is shared, the parties will cooperate to determine the cause and appropriate response.

31. Privacy of Support Requests

When a School contacts technical support, CerebriaTech may request information needed to identify the account and diagnose the issue.

Schools should provide only the minimum information necessary.

Schools should not send:

• passwords;
• security tokens;
• unnecessary student information; or
• other confidential information

through ordinary support channels unless specifically requested through an appropriate secure process.

32. Data Security After Export

Once a School exports information from School Report Pro, the School becomes responsible for securing that exported copy.

For example, if exported student records are stored on a personal computer, external drive, USB device or another system controlled by the School, the School is responsible for protecting that copy.

33. Privacy of Other Users

This Privacy Policy applies primarily to information processed through School Report Pro.

Where School Report Pro links to or interacts with an external service, that service may have its own privacy policy.

Users should review the privacy practices of third-party services where appropriate.

34. Changes to This Privacy Policy

CerebriaTech may update this Privacy Policy to reflect:

• changes to School Report Pro;
• changes in technology;
• new security measures;
• changes in legal or regulatory requirements;
• new processing activities; or
• improvements to privacy practices.

The latest version will be published through the applicable School Report Pro website or platform.

Where a material change substantially affects users' privacy rights or the way personal data is processed, reasonable notice will be provided where practicable.

35. Complaints and Privacy Questions

If a user has a question, concern or complaint about the handling of personal data through School Report Pro, the first step should ordinarily be to contact the relevant School where the School controls the information.

Privacy or security concerns involving CerebriaTech's own processing may be directed to CerebriaTech through its official support or privacy contact channel.

CerebriaTech will investigate legitimate privacy concerns and take reasonable steps to address them.

Where applicable, individuals may also exercise rights or seek remedies through the relevant supervisory authority.

36. Regulatory Commitment

CerebriaTech recognises the Nigeria Data Protection Act 2023 as an important legal framework governing personal-data processing in Nigeria.

CerebriaTech is committed to maintaining appropriate data-protection governance and to taking the necessary steps applicable to its role as the School Report Pro service provider.

Nothing in this Privacy Policy should be interpreted as a claim that CerebriaTech holds a particular regulatory certificate, registration, audit certification or international privacy certification unless that status is expressly stated and currently valid.

37. Contact

• CerebriaTech Solutions
• School Report Pro
• Website: https://mail.schoolreportpro.com/footer_pages
• Email: support@schoolreportpro.com
• Phone: +1 (657) 276 7140

For account, technical, privacy or data-protection enquiries, users should use the official contact information published by CerebriaTech.

38. Effective Date

This Privacy Policy is effective from:

5 September 2026

It applies to the processing activities covered by School Report Pro from that date, subject to applicable law and any specific contractual arrangements between CerebriaTech and a School.