Skip to content
Belloft
Talk to usStart free trial

Data Processing Agreement

Last updated 13 October 2026 (revised: paying online, automatic renewal, late payment, deletion, and the “Powered by Belloft” notice)

This agreement is between the School (“the Controller”) and the platform operator, the operator’s registered address (“the Processor”), and forms part of the Terms of Service. It sets out how the Processor handles personal data on the Controller’s behalf, as required by the Nigeria Data Protection Act 2023 (“NDPA”), in particular section 29.

1. Subject matter and duration

The Processor processes personal data only to provide the school management system to the Controller, for as long as the Controller uses the Service and for 60 days afterwards to allow export, after which the data is deleted. Where the Controller used only a free trial and did not choose a plan, the Controller instructs that its data be deleted after the period stated in the Terms of Service, with no export while the trial school is closed. The Processor keeps no backups of its own; backups and files in the Controller’s storage remain under the Controller’s control.

2. Data and people concerned

Categories of people: students and applicants, parents and guardians, staff, and people authorised to collect students. Categories of data: identity and contact details, educational records, attendance, assessments, fees and payments, communications, photos, and sensitive data about health and welfare that the Controller chooses to record.

3. The Processor’s obligations

  • Process personal data only on the Controller’s documented instructions (given by using and configuring the Service), unless the law requires otherwise, in which case the Processor will tell the Controller first where the law allows.
  • Ensure everyone authorised to process the data is bound by confidentiality.
  • Keep the security measures in section 5 in place and keep them up to date.
  • Not engage another processor without the Controller’s general authorisation; the current sub-processors are listed in section 6. The Processor will give 30 days’ notice of any new sub-processor, during which the Controller may object, and will bind every sub-processor to equivalent data protection obligations.
  • Help the Controller respond to requests from people exercising their rights, and with security, breach notification, data protection impact assessments and consultation with the Nigeria Data Protection Commission.
  • Notify the Controller without undue delay, and in any event within 24 hours, after becoming aware of a personal data breach, with the information the Controller needs to notify the Commission within 72 hours.
  • At the end of the Service, delete or return all personal data at the Controller’s choice, unless the law requires it to be kept.
  • Make available the information needed to show compliance with this agreement, and allow and contribute to reasonable audits on 30 days’ notice, at most once a year unless a breach has occurred.

4. The Controller’s obligations

The Controller is responsible for having a lawful basis for the processing, giving people the required notices (a ready-made notice is provided at the School’s privacy page), obtaining parental consent where the law requires it for children, the accuracy of the data, and deciding which staff may see what.

5. Security measures

  • A separate database for each school, so no school can reach another’s data.
  • Encryption in transit (HTTPS with HSTS) and at rest by the hosting provider; additional encryption at rest, with a key unique to each school, for messages, absence notes, health information and behaviour details. Messages are not end-to-end encrypted, because the Controller’s leadership may be given access to conversations for safeguarding.
  • Passwords stored as bcrypt hashes; account lock after repeated failed sign-ins; sessions stored as hashes; protection against cross-site request forgery and clickjacking; a strict content security policy.
  • Role-based permissions set by the Controller; a log of significant actions in each school; platform support access clearly marked, logged, and unable to open private messages.
  • Nightly backups written to the Controller’s own storage (latest 7 kept), plus full backups the Controller can download at any time; older records archived to the Controller’s storage only after the archive file is confirmed; dependency and security testing before each release.
  • Optional two-step verification for staff and for the Processor’s administrator.

6. Sub-processors

  • Neon, Inc.: database hosting, Frankfurt, Germany.
  • Vercel, Inc.: application hosting and delivery.
  • Upstash, Inc. (optional): change counters only, with no names or content.
  • Google, Apple and Mozilla push services: delivery of notifications (no message content).

Payment providers (Paystack, Flutterwave) and the file storage the Controller connects (for example Google Cloud Storage) act under the Controller’s own agreements with them and are not sub-processors of the Processor. The Processor uses that storage only through the access keys the Controller provides, only to store the Controller’s photos, backups, archived records and cached documents, and keeps the keys encrypted.

7. Transfers outside Nigeria

Data is hosted in the European Union. The Processor relies on the transfer bases and safeguards in Part VIII of the NDPA, including written contracts with sub-processors requiring an adequate level of protection.

8. General

If this agreement conflicts with the Terms of Service on data protection, this agreement prevails. It is governed by the laws of the Federal Republic of Nigeria.

Processor contact for data protection: the operator’s data protection contact.

Data Processing Agreement | Belloft