Privacy Policy

Last updated: 19 September 2026 - This Privacy Policy explains how St. Global Leaders Academy, Commercial plots 1A, B & C, Oroki Estate, Osogbo, Osun State, Nigeria (admissions@stgloballeaders.edu.ng, +234 800 000 0000) collects, uses, shares and protects personal data across our public site, admissions, parent and student portals and related systems.

1. Introduction and Scope

This Policy applies to data processed by St. Global Leaders Academy through stgloballeaders.edu.ng and any staging domain (/proto), portals, admissions, fees, contact and document services. We limit collection to what is necessary for a safe, effective school and respect confidentiality. Read this together with our Terms. This is not legal advice.

2. Who We Are

For Nigerian data protection guidance (Nigeria Data Protection Act 2023 and NDPA Directive where applicable), the controller is St. Global Leaders Academy, Commercial plots 1A, B & C, Oroki Estate, Osogbo, Osun State, Nigeria, +234 800 000 0000, admissions@stgloballeaders.edu.ng, /contact. Day-to-day enquiries are handled by the Examinations & Records, Admissions and ICT offices, escalated to management where needed.

3. Data We Collect

We collect only relevant data: Learner data - name, birth date, gender, photograph, class and arm, admission number, attendance, timetable, scores, results, broadsheet position, conduct notes, voluntary medical notes and submitted documents; Parent data - name, relationship, phone, email, address, child linkage and communication preferences; Staff data - name, contact, qualifications and allocations (payroll where active, admin-only); Admissions and enquiry data - contact and admission form details including honeypot field “website”; Finance data - invoices, instalments, discounts, references and receipts (card details handled by Paystack and Flutterwave, not stored by us); Technical data - IP, browser, pages visited and anonymised counts (public pages file-cached 60 minutes under cms: keys).

4. How We Use Data

We use data as parents and regulators would expect:

• Education and operations: class placement, attendance and lawful correction, timetabling, continuous assessment, examinations, result computation, broadsheet and report cards, and transcripts. Basis: education contract and legitimate interest.
• Communication: admission decisions, resumption reminders (20 August), events (Inter House Sports, Robotics, Creative & Cultural Day), fee reminders and announcements. Basis: legitimate interest and consent where required.
• Admissions: evaluating applications, assessments and interviews, shortlisting, offers and enrolment. Basis: steps at applicant request prior to contract.
• Fees and payments: invoices, instalments, discounts, gateway reconciliation and signed expiring (one-hour) receipt links. Basis: contract and legal obligation.
• Safeguarding: identity verification, emergency medical notes and positive non-corporal discipline records. Basis: vital interests and legitimate interest.
• Improvement: aggregated analytics on most visited public pages (About, Academics, Gallery). Basis: legitimate interest.
• Legal and audit: retention for accounting and inspection and disclosure where required by Nigerian law or court order. Basis: legal obligation.

Where we rely on consent, such as optional newsletters or publishing a learner photo, you may withdraw consent via the office without affecting prior lawfulness.

5. How We Share Data

Sharing is strictly need-to-know:

• Within the Academy: teachers see only assigned classes and subjects; accountants see fees but cannot approve results; principal and records officers see full academic records. Every sensitive view or change is role-checked and audit-logged.
• With parents and learners: a linked parent sees only that child’s attendance, results, fees, timetable and documents; students see only their own record. Guessing a UUID URL or signed document link is blocked and logged.
• With processors: hosting (cPanel), email and SMS delivery, cloud storage where configured, and payment processors Paystack and Flutterwave under their security measures, acting only on our instructions.
• With authorities: where Nigerian law, Ministry of Education or a court requires disclosure for audit or investigation.

We do not sell data, use it for third-party advertising, or allow external marketers access.

6. Cookies

We use limited cookies and storage: Essential - session cookie for login and installation-lock check; Preference - dismissal of “Add to Home Screen” and PWA flag pwa-deferred; Service worker - sw.js caches public shell assets for faster loads and brief offline, not report cards; Optional analytics - aggregated page-view counts without precise location or cross-site tracking where enabled. Blocking essential cookies prevents login and form submission. We seek consent before any new non-essential analytics.

7. Retention

We keep data only as long as needed: active learner and fee records for enrolment plus archive period for transcripts (hard-deletion forbidden - archived and restricted); unsuccessful applications one session then anonymised; contact enquiries 12 months then deleted; notifications while active; documents via signed expiring links (one hour) retained per schedule; encrypted backups on school drive with one off-site copy, never emailed, rolled over. Before bulk deletion we confirm a verified backup and obtain written approval from the principal or records officer.

8. Security

Measures include RBAC with 60+ granular permissions, permission checks on every sensitive route, audit logging of views and edits, UUIDs instead of sequential IDs with signed expiring links, password hashing, throttled login and contact forms, CSRF and honeypot protection, locked computers and immediate deactivation on departure. If an incident occurs we revoke access, log, investigate and inform the head and, where required, families and regulators without delay.

9. Your Rights

Subject to Nigerian law, you may request Access to data about you or your child (PDF), Correction via the office (not direct self-edit), Restriction or objection for non-essential announcements, Deletion or anonymisation where no longer needed (core records retained), Portability in common format, and Withdrawal of consent where applicable. Contact Examinations & Records at admissions@stgloballeaders.edu.ng with ID and admission number; we acknowledge within five days and respond within 30 days.

10. Children’s Privacy

Services target the school community; learner data is supplied by parents or guardians during admissions for education and care. Learners under 18 do not self-create portal accounts; the school provisions them and parents or teachers monitor use. We do not knowingly collect data directly from children via the public site without adult involvement; if you believe a child submitted data without consent, contact us to remove it.

11. International Transfers

Primary hosting is in Nigeria or our chosen region. Where a processor or backup is outside Nigeria, we ensure contractual safeguards and access controls and limit transferred data to the minimum necessary.

12. Third Parties

Payments are handled by Paystack and Flutterwave under their own terms; we share only the invoiced amount, reference and payer contact. External links (examination councils, scholarship pages) are not covered; review their privacy statements before providing data.

13. Changes

We may update this Policy for new programmes, tools or Nigerian law changes. Updates will be posted here with a new date and, where material, announced via the portal and circulars at least seven days before effect. The version dated 19 September 2026 supersedes prior notices.

14. Contact and Complaints

For questions, access or concerns: St. Global Leaders Academy - Examinations & Records Department, Commercial plots 1A, B & C, Oroki Estate, Osogbo, Osun State, Nigeria, +234 800 000 0000, admissions@stgloballeaders.edu.ng, office Monday-Friday 8:00 AM - 3:00 PM, plus in-app help. If dissatisfied after contacting us, raise the matter with the management committee or, where appropriate, with the Nigeria Data Protection Commission (NDPC), providing copies of correspondence.

Our pledge: we keep only what the school truly needs, we share only with those who need to know, we protect every record as if it were our own child’s, and we tell you plainly what we collect, why and who to ask.