Privacy Policy — eMIS Platform

Last updated: January, 2026 • This Policy explains how personal information is collected, used, and protected on the eMIS platform.

On this page 1. Introduction 2. Who Controls the Data 3. Information We Collect 4. Children's Data 5. Biometric Data 6. How We Use It 7. Basis for Processing 8. Sharing & Disclosure 9. Payment Data 10. Retention 11. Security 12. Your Rights 13. Cookies & Sessions 14. Changes 15. Contact

1. Introduction

The eMIS platform ("the Platform", "we", "us") is an education management information system used by authorised State Ministries of Education, education boards, and schools to manage student, staff, and school records. This Policy describes what personal information the Platform processes, why, how it is protected, and the rights available to individuals. It applies alongside the Terms of Use.

2. Who Controls the Data

Each participating State Ministry of Education, education board, or school (the "School Authority") is the controller of the records relating to its own students and staff. The Platform acts as the processor, handling those records on the School Authority's instructions and for the education-administration purposes set by that authority. Each School Authority's records are held in its own dedicated database and are not shared across authorities.

The Platform is designed to serve multiple states and authorities. Records belonging to one State or school are logically separated from those of another and are accessed only by users authorised for that specific authority.

3. Information We Collect

The Platform processes the following categories of information, depending on the user's role and the modules in use:

Category	Examples
Student identity & enrolment	Name, date of birth, sex, photograph, enrolment/admission number, class and stream, guardian details, contact information.
Academic records	Assessments, results, examination data, promotions, transfers, attendance.
Staff records	Name, staff/identification number, qualifications, postings, assignments, contact details.
Biometric identifiers	Fingerprint templates and/or facial templates used for attendance and identity verification (see Section 5).
Attendance & activity	Sign-in/out records, device check-ins, and related timestamps.
Payment records	Transaction references, amounts, and status for wallet top-ups, fees, or service charges (see Section 9).
Account & technical	Login identifiers, role, audit logs of actions taken in the system, and basic technical data needed to operate and secure the Platform.

4. Children's Data

The Platform necessarily processes personal data relating to children, because students in the school system are its primary subjects. We recognise the heightened responsibility this carries.

Children's data is collected and used only for legitimate education-administration purposes defined by the School Authority.
Access to student records is restricted to authorised personnel whose role requires it, and is subject to audit logging.
Student accounts, where provided, are issued and supervised in line with the School Authority's policies.
We do not use children's data for advertising, marketing, or profiling unrelated to their education, and we do not sell it.

5. Biometric Data

Some deployments use biometric verification (fingerprint and/or facial recognition) for attendance and identity confirmation. Because biometric data is sensitive, it is handled with additional care:

Templates, not images: the Platform stores mathematical templates derived from a biometric sample for matching. These templates are used to verify identity and cannot be used as a substitute for the original biometric in the way a stored photograph or fingerprint image could.
Purpose limitation: biometric data is used only for attendance and identity verification within the Platform, and not for any unrelated purpose.
Restricted access: biometric records are accessible only to authorised processes and personnel required to operate the attendance and verification functions.
Retention: biometric templates are retained only for as long as the individual is enrolled or employed within the relevant authority, or as required by the School Authority, after which they are deleted or de-identified in line with Section 10.

6. How We Use the Information

To register and manage students, staff, and schools;
To record and report academic results, assessments, and progression;
To manage attendance, including biometric verification where used;
To administer authorised payments and reconcile transactions;
To generate official reports, credentials, and returns required by the School Authority;
To secure the Platform, maintain audit trails, and prevent misuse;
To meet legal, regulatory, and reporting obligations applicable to the School Authority.

7. Basis for Processing

Personal data is processed for the performance of the public-education functions and legal duties of the relevant School Authority, and to deliver the administration services the authority has requested. Where applicable law requires consent for a specific use, that consent is obtained through the School Authority. Processing is limited to what is necessary for these purposes.

Records are shared only as necessary to operate the education system, and only with:

The relevant State Ministry of Education, education board, or school responsible for the records;
Authorised examination and assessment bodies, where results reporting requires it;
Payment providers, strictly to process authorised transactions (see Section 9);
Service providers who support the operation of the Platform under confidentiality and data-protection obligations, and only to the extent needed to provide their service;
Authorities or regulators where disclosure is required by law or to protect the safety and welfare of individuals, particularly children.

We do not sell personal data, and we do not share it for third-party advertising.

9. Payment Data

Where payments are supported, transactions are processed by third-party payment providers. The Platform records transaction references, amounts, and status for reconciliation, but does not store full card numbers or bank credentials — these are handled directly by the payment provider under their own security standards and privacy terms. You should review the payment provider's privacy notice for details of how they handle your payment information.

10. Data Retention

Records are retained for as long as necessary to fulfil the education-administration purposes described in this Policy and to meet the School Authority's legal and record- keeping obligations. Student and staff academic records may be retained as part of the permanent education record in line with the School Authority's rules. Biometric templates are retained only while the individual is actively enrolled or employed, or as otherwise required, and are then deleted or de-identified. When records are no longer required, they are securely deleted or anonymised.

11. How We Protect Information

Role-based access control, so users can reach only the records their role permits;
Authentication controls and encryption of sensitive values within the system;
Separation of each authority's records into its own database;
Audit logging of actions taken on records;
Operational and administrative safeguards to reduce the risk of unauthorised access, loss, or misuse.

No system can guarantee absolute security. Users play an essential part by keeping their credentials confidential and reporting any suspected compromise promptly.

12. Your Rights

Individuals (or the parents/guardians of students who are minors) may, subject to applicable law and the School Authority's procedures, request to:

Access the personal data held about them;
Have inaccurate data corrected;
Request deletion or restriction where there is no continuing lawful or record-keeping requirement to retain it;
Object to a particular use where permitted by law.

Because the relevant School Authority controls the records, such requests should be made to that authority, which will handle them in accordance with applicable law. Contact details are in Section 15.

13. Cookies & Sessions

The Platform uses cookies and similar technologies that are necessary to operate securely — for example to keep you signed in during a session and to protect against certain security risks. These are essential to the service and are not used for advertising or cross-site tracking.

14. Changes to this Policy

This Policy may be updated to reflect changes in the Platform, in law, or in operating requirements. The "Last updated" date above shows when the latest version took effect. Material changes will be communicated through the School Authority where practicable.

15. Contact

For privacy questions or to exercise your rights, contact your School Authority (the State Ministry of Education, education board, or school responsible for the records), or the Platform administrator via the channel provided to your organisation:

Administrative contact: support@emisplatform.ng
Operator/School Authority: admin@emisplatform.ng