SMS – SCHOOL MANAGEMENT SYSTEM

Privacy Policy

Document owner: Servizora Technologies Limited
Product: SMS – School Management System
Jurisdiction focus: Nigeria
Status: Approved
Last updated: 13 October 2026
Effective date: 13 October 2026

1. Introduction

Servizora Technologies Limited (“Servizora”, “we”, “us” or “our”) respects the privacy of individuals whose personal data is processed through SMS — School Management System (“SMS”, the “Platform” or the “Service”).

SMS is a school-management technology product designed to support school administration, academic management, student and parent relationships, financial administration, attendance, communication and related school operations, depending on the functionality enabled for each school.

This Privacy Policy explains how personal data may be collected, accessed, used, stored, disclosed, transferred and deleted in connection with:

The SMS website and product information pages.
School accounts and administrative access.
Student, parent, guardian and staff accounts.
Academic, attendance and school-management records.
Financial administration and payment-related records.
Customer onboarding, training, support and communications.
Related integrations and services, where enabled.

This Policy must be read alongside applicable customer agreements, the SMS Terms and Conditions, any applicable School Data Processing Agreement, and relevant school privacy notices.

2. Who we are

SMS is a product owned and operated commercially by Servizora Technologies Limited. SMS is not represented by this Policy as a separate legal entity.

Data protection contact

Organisation: Servizora Technologies Limited
Product: SMS – School Management System
Privacy email: support@sms.servizora.com
Business address: #9 Harmony Close, Omachi Estate Rumuodomaya, Port Harcourt
Website: sms.servizora.com

These contact details must be completed and verified before publication.

3. Scope of this Policy

This Policy applies to personal data processed in connection with SMS, subject to the specific arrangements governing each service and customer relationship.

It covers:

School owners, proprietors and administrators.
Teachers and other school employees.
Students and prospective students whose information is entered into the Platform.
Parents, guardians and authorised caregivers.
Individuals who contact Servizora or request a demonstration.
Customer representatives, suppliers and other business contacts.
Visitors to SMS websites and related digital services.

A school may issue its own privacy notice explaining how it collects and uses personal data for educational, administrative and statutory purposes. That school notice remains important because Servizora does not automatically determine every purpose for which a school processes personal data.

4. Our role and the school’s role

The appropriate legal roles depend on the processing activity.

Servizora as a data controller

Servizora may act as a data controller when determining the purposes and means of processing data for its own business activities, such as prospect enquiries, customer relationship management, billing administration, account security and its own website analytics, where used.

Servizora as a data processor

Servizora may act as a data processor when processing student, parent, guardian, staff or other school records on documented instructions from a school that determines the relevant purposes of processing.

The school

A school will generally be responsible for determining its educational and administrative purposes, deciding what information it collects, authorising user access and ensuring that its collection and use of personal data have an appropriate lawful basis.

These descriptions are not blanket legal classifications. The actual roles must be established for each relevant processing activity and documented in the applicable agreement.

Where required, Servizora and the school will enter into a Data Processing Agreement (DPA) setting out applicable instructions, security responsibilities, confidentiality, assistance with data-subject requests, incident management, subprocessors, international transfers and data return or deletion.

5. Categories of personal data we may process

The data processed depends on the functionality enabled, the school’s instructions and the individual’s relationship with the Service.

5.1 Account and identity information

This may include:

Full name and username.
Email address and telephone number.
Account identifier and role.
School or organisation affiliation.
Authentication and access-control information.
Account status and relevant account activity.

Passwords and authentication secrets must be protected through appropriate security measures. They should not be stored or transmitted in readable form where secure alternatives are available.

5.2 Student information

Where a school uses relevant SMS functionality, records may include:

Student name and school identification number.
Class, class arm, academic session and enrolment status.
Date of birth and other necessary demographic information.
Student photograph, where required and appropriately authorised.
Parent or guardian associations.
Academic records, assessments, grades and report cards.
Attendance, lateness and absence records.
Promotion, transfer, withdrawal and graduation history.
Relevant emergency information.
Other school records necessary for an authorised educational or administrative purpose.

Schools should not enter information that is unnecessary for the relevant purpose.

5.3 Parent and guardian information

Depending on the enabled functionality, this may include:

Names and contact information.
Relationship to a student.
Association with one or more students.
Communication preferences.
Portal account and access information.
Relevant billing, fee and payment-history information.
Records of communications and notifications.

Access to a child’s information must be based on a properly established relationship and appropriate authorisation.

5.4 Staff information

This may include:

Names and contact information.
Employment or staff identifiers.
Department, role and subject assignments.
Attendance and leave information, where supported.
Account permissions and access history.
Other employment-related records required for the school’s operations.

The school is responsible for determining which staff records are necessary and who is authorised to access them.

5.5 Academic and operational information

SMS may process academic sessions, terms, classes, subjects, assessment records, examination scores, attendance summaries, timetables, announcements and related operational records where the relevant functionality exists and is enabled.

Official academic records must remain subject to the school’s applicable approval and correction procedures.

5.6 Financial and transaction information

Where relevant functionality is enabled, information may include:

School fee schedules and invoices.
Student billing records.
Payment amounts and transaction references.
Payment status, receipts and outstanding balances.
Discounts, scholarships and adjustments.
Financial reports and audit trails.

Where a third-party payment provider is used, that provider may process payment information under its own applicable terms and privacy notice.

Servizora will not claim that SMS stores or processes full card details unless that capability is actually implemented and verified.

5.7 Communications and support information

We may process information contained in support requests, emails, service enquiries, training records, customer feedback, announcements, notification logs and related correspondence.

Where communication services are integrated, the relevant provider may also process delivery metadata and contact information.

5.8 Technical and usage information

Where collected by the actual deployment, this may include:

IP address and device or browser information.
Login timestamps and session information.
Security events and audit logs.
Error reports and diagnostic information.
Service usage and performance metrics.
Cookie identifiers and similar technologies.

Collection must be limited to appropriate, documented purposes.

6. Purposes for processing personal data

Depending on the relevant activity, we may process personal data to:

Create and administer authorised accounts.
Provide the contracted school-management service.
Support school administration and academic workflows.
Facilitate authorised parent and student access.
Maintain attendance, assessment, examination and reporting workflows.
Support fee administration and transaction reconciliation.
Deliver authorised service communications and notifications.
Configure, onboard and train customer schools.
Respond to enquiries and provide technical support.
Maintain account security, investigate misuse and protect system integrity.
Maintain relevant operational, billing and audit records.
Monitor service reliability and diagnose technical faults.
Meet applicable legal and regulatory obligations.
Exercise or defend legal claims where appropriate.
Improve the Service using appropriately authorised and proportionate methods.

We will not treat a person’s mere use of SMS as unrestricted permission to use their personal data for unrelated purposes.

7. Lawful bases for processing

Personal data must be processed under an applicable lawful basis recognised by Nigerian data-protection law.

Depending on the activity, this may include:

Contract: where processing is necessary to enter into or perform a contract with the relevant individual.
Legal obligation: where processing is required to comply with an applicable legal obligation.
Consent: where valid consent is the appropriate lawful basis.
Legitimate interests: where applicable, after the necessary assessment and subject to the individual’s rights.
Vital interests or other legally recognised grounds: where the relevant statutory conditions are met.

A school and Servizora must not assume that consent is always necessary or that consent automatically makes every form of processing lawful.

Where a school determines the lawful basis for student or parent data, it must document that basis and provide appropriate information to the affected individuals. Servizora will process such information in accordance with its applicable contractual and legal responsibilities.

8. Children’s personal data

SMS is intended to support school operations and may process personal data relating to children.

We recognise the need for heightened care when processing children’s information.

Accordingly:

Schools should collect and upload only information necessary for legitimate educational or administrative purposes.
Schools must establish the appropriate lawful basis and any required parental, guardian or other authorisation before processing.
Age-appropriate privacy information should be provided where required.
Access to student records must be restricted according to role, legitimate need and properly established relationships.
Student photographs, contact details, academic results and other personal records must not be disclosed to unauthorised users.
Children’s data must not be used for unrelated advertising or profiling merely because it is available in the Platform.
Where an individual’s age affects the applicable legal requirements, the relevant safeguards must be applied.

Parents and guardians may exercise rights on behalf of a child where legally authorised. A child’s own rights and applicable legal requirements must also be respected.

Servizora will support schools in handling relevant requests within the scope of its contractual and legal responsibilities.

9. Disclosure and sharing of personal data

We may disclose personal data only where reasonably necessary, authorised and legally permitted.

Potential recipients include:

9.1 The relevant school

The school and authorised personnel may access information needed for their approved educational and administrative responsibilities.

9.2 Hosting and infrastructure providers

Third-party providers may store or process information required to operate SMS. The actual providers, locations and arrangements must be verified for the relevant deployment.

9.3 Communication providers

Email, SMS or messaging providers may process contact details and message-related information where these services are enabled.

9.4 Payment providers

Payment processors may receive transaction information necessary to process payments, confirm transactions or reconcile records.

9.5 Technical and professional service providers

Authorised service providers, security specialists, auditors, legal advisers or other professionals may receive information where required for legitimate and appropriately controlled purposes.

9.6 Regulators and lawful authorities

We may disclose information where required by applicable law, a valid legal process or a lawful and properly authorised request.

9.7 Corporate transactions

Where legally permissible and genuinely necessary, information may be disclosed in connection with a proposed or completed corporate transaction, subject to appropriate confidentiality, legal safeguards and applicable data-protection requirements.

We do not authorise third parties to use school records for unrelated purposes merely because they provide services to SMS.

10. International data transfers

Depending on the hosting environment and third-party integrations, personal data may be processed or accessed outside Nigeria.

Before an international transfer occurs, the responsible party must assess and satisfy the applicable requirements of Nigerian data-protection law, including any required adequacy assessment, safeguards, contractual measures, regulatory conditions or other lawful transfer mechanism.

Servizora should maintain a record of relevant hosting locations, subprocessors and transfer arrangements.

The use of a foreign hosting or messaging provider must not be treated as automatically lawful simply because the provider is commercially established.

11. Data retention

We retain personal data only for as long as reasonably necessary for the documented purpose, applicable contract, legitimate operational requirement or legal obligation.

Retention considerations may include:

Active account and school-service records.
Academic and administrative record requirements.
Financial, billing and transaction records.
Security logs and audit trails.
Support and incident records.
Legal claims and regulatory obligations.
Backup and disaster-recovery requirements.

There is no single retention period appropriate for every category of school data.

The applicable school agreement and data-retention schedule should define the relevant periods, deletion triggers, archival requirements and exceptions.

When the purpose for processing ends, the responsible party should delete, anonymise or otherwise dispose of the information as appropriate, unless continued retention is lawfully required.

Backups may retain residual copies for a defined period. Such copies must remain protected and be removed through the documented backup lifecycle.

12. Data security

We recognise that student, parent, staff, academic and financial records require appropriate protection.

Depending on the actual deployment, relevant safeguards should include:

Secure authentication and session management.
Role-based access and least-privilege permissions.
Logical separation of school records and environments.
Appropriate encryption in transit and, where suitable, at rest.
Secure file upload and storage controls.
Audit logging and monitoring.
Vulnerability management and software updates.
Backup protection and restoration testing.
Controlled technical and administrative access.
Incident detection, investigation and response procedures.

These are security objectives and controls to be verified, not a representation that every listed control is already implemented in every SMS deployment.

No internet-connected system can be guaranteed to be completely secure. We will seek to maintain safeguards appropriate to the nature of the information, the risks involved and our applicable obligations.

13. Personal data breaches and security incidents

A suspected or confirmed incident involving personal data must be assessed promptly.

Our incident-response process should include, as applicable:

Identifying and containing the incident.
Assessing the categories of data and individuals affected.
Determining the potential consequences and severity.
Preserving relevant evidence and incident records.
Informing affected schools and other responsible parties as required.
Making notifications to regulators and affected individuals where required by law.
Taking corrective and preventive measures.
Documenting the incident and its resolution.

Where Servizora acts as a processor, it will notify the relevant school or controller in accordance with the applicable DPA and legal requirements, without undue delay as required by the applicable arrangements and law.

A school remains responsible for its own notification duties to the extent required by law. Contractual arrangements must not be used to avoid statutory obligations.

14. Your data-protection rights

Subject to applicable law and the circumstances of processing, individuals may have the right to:

Be informed about the processing of their personal data.
Request access to their personal data.
Request correction of inaccurate or incomplete information.
Request deletion where the legal conditions are satisfied.
Request restriction of processing in applicable circumstances.
Object to certain forms of processing.
Request data portability where applicable.
Withdraw consent where processing relies on consent.
Seek human intervention or challenge certain decisions made solely through automated processing where the law provides that right.
Lodge a complaint with the Nigeria Data Protection Commission.

These rights are subject to applicable legal conditions and exceptions. They do not mean that every record must be deleted immediately upon request.

For information maintained by a school, requests should ordinarily be directed to the relevant school or its designated privacy contact. Servizora will assist the school where required under the applicable DPA and law.

For personal data that Servizora controls directly, individuals may contact the privacy contact listed in this Policy.

We may request reasonable information to verify identity and authority before disclosing or modifying personal data.

15. Access, correction and deletion requests

A request should identify the relevant individual, the school or account concerned, the nature of the request and sufficient information for verification.

Requests may be submitted to:

Privacy email: support@sms.servizora.com

We will review and respond within the period required by applicable law. Where additional information is reasonably necessary, or where a lawful exception applies, we will explain the relevant position as appropriate.

If a parent requests access to a student’s information, we may need to verify the parent-child relationship, legal authority and any applicable safeguarding or confidentiality restrictions.

16. Cookies and similar technologies

The use of cookies and similar technologies depends on the actual website and application configuration.

Where implemented, these technologies may be used to:

Maintain login sessions.
Protect the Service against misuse.
Remember necessary settings.
Measure website or application performance.
Understand service usage, where appropriately authorised.

Strictly necessary technologies may be required for core functionality. Non-essential analytics, advertising or tracking technologies should be used only where the applicable legal requirements and user-choice requirements have been satisfied.

A separate cookie notice or consent mechanism should be implemented if required by the technologies deployed and applicable law.

We do not represent that SMS currently uses advertising cookies or any particular analytics provider unless verified.

17. Direct marketing and service messages

We may send service-related communications concerning accounts, security, billing, onboarding, technical incidents, renewals and material service changes.

Marketing communications must be handled separately from essential operational messages and in accordance with applicable law.

Where consent or another required permission is necessary, it must be obtained before the relevant marketing activity. Individuals must be able to exercise applicable objection or opt-out rights.

A marketing opt-out does not necessarily prevent essential service or legally required communications.

18. Automated processing and artificial intelligence

The SMS product strategy may consider AI-assisted administration, summaries, reporting or other functions in the future.

The availability of such a capability must not be assumed unless it has been implemented and verified.

Where automated processing or AI functionality is introduced, Servizora and the relevant school must assess:

The purpose and lawful basis.
The categories of data processed.
The accuracy and reliability of the output.
The risk of bias or inappropriate inference.
The effect on students, parents and staff.
Appropriate transparency and human oversight.
The security and confidentiality of submitted data.
The applicable data-protection requirements.

AI-generated content must not automatically be treated as an authoritative student result, financial record, disciplinary decision or other official school record without the required validation and approval.

19. Third-party websites and services

SMS may contain links to external websites or integrations operated by third parties.

Those services may have their own privacy policies, security arrangements and contractual terms. Servizora is not responsible for the independent processing practices of a third party merely because the service is linked to or integrated with SMS.

Before enabling an integration, the responsible parties should assess its necessity, data access, permissions, security and contractual safeguards.

20. Data portability and termination of school services

Subject to the applicable contract, legal requirements and technical arrangements, a school should have a documented process for requesting an export of its records when its service ends or a migration is required.

The process should define:

Who may request an export.
How the request is authenticated.
The available export formats.
The records included and any lawful exclusions.
Applicable charges, if any, disclosed in advance.
The delivery method and security controls.
The applicable retention and deletion schedule.
The treatment of backups and legally required records.

A school’s termination of service does not automatically mean that every copy of every record can be deleted immediately. Legal obligations, outstanding claims, backup cycles and other lawful requirements may affect the process.

Servizora should not retain customer data indefinitely merely because deletion or export procedures have not been formalised.

21. Changes to this Policy

We may update this Policy to reflect changes in the Service, data-processing practices, legal requirements or security arrangements.

Material changes should be communicated through appropriate channels where required by law or contract.

The published version should display its effective date or last-updated date. Changes to contractual data-processing arrangements must be handled in accordance with the relevant agreements.

22. Complaints and contact

Questions, concerns or requests relating to this Policy may be directed to:

Servizora Technologies Limited
SMS – School Management System
Privacy email: support@sms.servizora.com
Business address: #9 Harmony Close, Omachi Estate Rumuodomaya, Port Harcourt
Website: sms.servizora.com

We will review privacy concerns and take appropriate steps to address them.

Individuals may also contact the Nigeria Data Protection Commission through its official channels where they believe their rights have been infringed or their concerns have not been adequately resolved.

Related documents: SMS Terms and Conditions; applicable customer agreement; School Data Processing Agreement; relevant school privacy notice.

End of Privacy Policy.