School Data Processing Agreement (DPA)

Preamble & Statutory Background

This Data Processing Agreement ("DPA") supplements the Master Terms of Service between Harmony Digital Consults Ltd, a private company limited by shares registered under the laws of the Federal Republic of Nigeria with RC No. 8949899 ("Processor"), and the client educational institution ("Controller" or "School").

WHEREAS: The School utilizes Harmony’s educational management software platforms (including HavonTrack, HavonShield, DocBridge, TimeGrid, and associated cloud/local synchronization services) which necessitate the handling of personal data concerning students, pupils, guardians, teachers, and administrative personnel.

WHEREAS: Both parties resolve to satisfy the mandatory statutory standards established by the Nigeria Data Protection Act (NDPA) 2023 and directives promulgated by the Nigeria Data Protection Commission (NDPC).

1. Definitions

In this Agreement, terms capitalized and defined in the NDPA 2023 carry their statutory meanings:

• "Controller" / "Data Controller": The educational institution determining the purposes and means of processing student and staff records.
• "Processor" / "Data Processor": Harmony Digital Consults Ltd, processing personal data on behalf of and according to the instructions of the Controller.
• "Child Data": Personal data relating to individuals under eighteen (18) years of age, subject to heightened safeguards under Section 31 of the NDPA.
• "Personal Data Breach": A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to school personal data.
• "Sub-processor": Any third party engaged by the Processor to assist in fulfilling specific technical duties (e.g., encrypted cloud hosting, SMS delivery gateway).

2. Roles, Instructions & Lawful Basis

The parties acknowledge that:

1. The School acts as Data Controller and retains full statutory responsibility for establishing a lawful basis (e.g., student enrollment contract, legitimate institutional interest, or parental/guardian consent) for collecting pupil and teacher information.
2. Harmony acts strictly as Data Processor. Harmony shall process school data solely on documented instructions from the School, including with regard to data transfers outside Nigeria, unless required to do so by applicable Nigerian statutory law.
3. If Harmony believes an instruction from the School infringes the NDPA 2023 or other applicable data protection enactment, Harmony shall promptly inform the School’s designated Data Protection Officer (DPO).

3. Obligations of the Data Processor (Harmony)

Harmony Digital Consults Ltd covenants and warrants that it shall:

• Confidentiality: Ensure that all software engineers, support staff, and database administrators authorized to process school data have committed themselves to statutory confidentiality.
• Strict Purpose Limitation: Never use student or school data for targeted behavioral advertising, cross-institution analytics, or public AI model training without de-identification.
• Data Segregation: Implement multi-tenant logical segregation ensuring one school’s academic records can never be accessed or viewed by users of another school.

4. Technical & Organizational Security Measures (TOMs)

Pursuant to Section 39 of the NDPA 2023, Harmony maintains rigorous security controls:

5. Sub-processors

The School provides general written authorization for Harmony to engage verified technical sub-processors essential for service provision:

• Cloud Infrastructure: Tier-IV cloud providers (Vercel, Google Cloud Platform, Supabase) with ISO 27001/SOC 2 certifications.
• SMS & Notice Delivery: Licensed Nigerian telecommunication aggregators (Termii/Twilio) strictly for sending automated attendance alerts and fee notices to guardians.
• Sub-processor Standards: Harmony binds all sub-processors to data protection obligations no less stringent than those outlined in this DPA. Harmony remains fully liable to the School for any sub-processor failure.

6. Personal Data Breach Management & Notification (72 Hours)

In full compliance with Section 40 of the NDPA 2023:

1. Harmony shall notify the School’s registered Administrative Contact or DPO in writing without undue delay, and in any event within forty-eight (48) to seventy-two (72) hours of becoming aware of a verified Personal Data Breach affecting school records.
2. The notification shall specify:
   • The nature of the breach, including estimated numbers of students or staff affected.
   • The name and contact details of Harmony’s Lead Security Officer.
   • The likely consequences and risk assessment.
   • Remediation measures undertaken or planned to mitigate potential adverse impacts.
3. Harmony shall cooperate with the School to enable timely regulatory reporting to the Nigeria Data Protection Commission (NDPC) where mandated by law.

7. Assistance with Student & Parent Data Rights

Under Part VI of the NDPA 2023, parents, legal guardians, and adult students possess statutory rights to access, rectify, or request deletion of inaccurate personal data:

• Harmony shall provide administrative tooling inside HavonTrack and DocBridge enabling designated school officers to export, modify, or anonymize records in response to lawful requests.
• If Harmony directly receives an inquiry from a parent or student, Harmony will promptly redirect the request to the School without executing unauthorized changes.

8. Compliance Audits & NDPC Filings

Harmony shall make available to the School all reasonable documentation necessary to demonstrate compliance with this DPA and Section 24 of the NDPA. Upon at least fourteen (14) business days’ written notice, Harmony will cooperate with independent NDPA audit verifications conducted by licensed Data Protection Compliance Organizations (DPCOs) engaged by the School.

9. Termination, Data Return & Sanitization

Upon termination or expiration of the school’s software service contract:

• The School retains a thirty (30) day data transition window to export all broadsheets, student registers, financial accounts, and attendance logs in standardized CSV/Excel/SQL formats.
• Following confirmation of receipt by the School, Harmony shall permanently delete and sanitize all copies of school personal data from its active database servers within forty-five (45) days, retaining only immutable financial ledgers required under Nigerian corporate and tax statutes.

Schedule A: Description of Personal Data Processing

Schedule B: Institutional Execution Annex

This Schedule constitutes the formal signature annex for school proprietors, university administrators, or academy directors requiring an executed legal copy for institutional records and NDPC compliance files: