Privacy Policy

1. Who We Are

PerAnkh Limited (RC: 8992805) ("PerAnkh", "we", "us", "our") is a company registered in Nigeria. We are the authorised Nigerian licensee for sERP — a school management and administration platform — and we operate the schoolerpnigeria.com website and related services ("the Platform").

Contact: serp@perankh.africa

2. Scope of This Policy

This Privacy Policy applies to:

• Website visitors who browse schoolerpnigeria.com;
• Prospective customers who submit enquiries via our contact form;
• School customers and their authorised staff who access the sERP platform.

It does not govern data that your school (as a data controller) collects from students, parents, and staff within your own sERP deployment. For that data, your school is the data controller and should maintain its own privacy notice. PerAnkh processes that data only as your data processor, under your instructions and pursuant to a Data Processing Agreement (DPA).

3. Data We Collect

3.1 Website visitors

We collect standard server access logs (IP address, browser type, pages visited, referrer) for security and analytics purposes. We do not use tracking pixels or third-party advertising cookies.

3.2 Contact form submissions

When you submit an enquiry, we collect: name, email address, phone number, school name, state, and message content. This is used solely to respond to your enquiry.

3.3 Customer account data

When you purchase a licence, we collect business contact information (name, role, email, phone, school name, address) and payment/invoice records (no card data — payments processed separately via bank transfer or our payment partners).

3.4 Platform data (schools' data)

Data entered into your school's sERP instance — student records, staff records, academic results, fee records, and HR data — is Customer Data. PerAnkh accesses this data only when required to provide technical support, perform system maintenance, or as required by law. We do not use your Customer Data for our own commercial purposes.

4. Legal Basis for Processing

We process personal data under the following lawful bases (NDPA Section 25):

• Contract performance: to deliver the services you have purchased;
• Legitimate interests: to respond to enquiries, maintain platform security, and improve our services — where these interests are not overridden by your rights;
• Legal obligation: where required by Nigerian law (e.g. tax records, court orders);
• Consent: for optional communications such as product updates (you may withdraw consent at any time).

5. How We Use Your Data

• To respond to your contact form enquiry or demo request;
• To set up, deliver, and support your sERP deployment;
• To issue invoices and manage billing;
• To send you service notifications (system updates, maintenance notices, renewal reminders);
• To comply with our legal and regulatory obligations;
• To improve the Platform and our services (using aggregated, non-identifiable data).

6. Data Sharing

We do not sell your personal data. We may share data with:

• Darrel Technologies Ltd (Ghana) — the Platform developer — for technical development, bug fixes, and major updates. Data shared is limited to what is strictly necessary and is covered by a data sharing agreement.
• Nigerian hosting providers — who host your school's data on our behalf (data processors bound by DPA);
• SMS gateway providers — for delivery of automated and bulk SMS messages from your sERP instance (telephone numbers only, no other personal data);
• Regulatory authorities — where required by Nigerian law, including FIRS (tax), NITDA, and NDPC.

All third-party processors are contractually obligated to process data only on our instructions and to maintain appropriate security measures.

7. Data Residency

Your school's data is hosted in Nigeria by default, using Nigerian data centres, to comply with NDPR and NDPA data localisation principles. We do not transfer Customer Data (student, staff, or financial records) outside Nigeria without your explicit written consent, except as permitted under the NDPA where adequate data protection standards are met at the destination.

8. Data Retention

• Contact form enquiries: retained for 2 years from the date of submission, then securely deleted;
• Customer account data: retained for 7 years from contract end to comply with Nigerian tax law (FIRS requirements), then deleted;
• Platform / Customer Data: retained for 30 days after subscription cancellation, then securely deleted unless you request an earlier deletion or a data export;
• Server access logs: retained for 90 days for security purposes, then automatically purged.

9. Your Rights

Under the NDPA, you have the following rights in relation to your personal data:

• Right of access: to request a copy of personal data we hold about you;
• Right of rectification: to ask us to correct inaccurate or incomplete data;
• Right of erasure: to request deletion of your personal data (subject to legal retention obligations);
• Right to restrict processing: to ask us to limit how we use your data;
• Right to data portability: to receive your data in a machine-readable format;
• Right to object: to processing based on legitimate interests or direct marketing;
• Right to withdraw consent: at any time, where processing is based on consent.

To exercise any of these rights, email us at serp@perankh.africa. We will respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).

10. Security

We implement appropriate technical and organisational measures to protect personal data, including:

• TLS encryption for all data in transit;
• Database-level access controls and isolated per-school databases;
• Role-based access controls within the Platform;
• Staff training on data handling;
• Regular security review of the hosting environment.

Despite our measures, no internet-connected system can be guaranteed 100% secure. In the event of a personal data breach that is likely to result in risk to individuals, we will notify you and the NDPC within 72 hours of becoming aware, as required by the NDPA.

11. Cookies

This website uses only session cookies necessary for the contact form and navigation to function. We do not use tracking, analytics, or advertising cookies. No cookie consent banner is required for strictly necessary cookies.

12. Children's Data

sERP is a business-to-business platform sold to and used by schools. The school (as data controller) is responsible for obtaining any parental consent required under Nigerian law for the processing of data relating to students under 13. PerAnkh does not knowingly collect personal data from children directly via this website.

13. Data Processing Agreement

As PerAnkh processes Customer Data on behalf of your school, we can provide a formal Data Processing Agreement (DPA) that sets out our respective obligations under the NDPA. Please contact us at serp@perankh.africa to request a DPA.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, our services, or our data practices. We will notify existing customers by email of material changes at least 14 days before they take effect. The "last updated" date at the top of this page will always reflect the most recent version.

15. Contact & Complaints

For any privacy-related queries, requests, or complaints:

• Email: serp@perankh.africa
• Or use our Contact page

If you are unsatisfied with our response, you may escalate your complaint to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.