EduNexusData Processing Agreement
In short: the school is responsible for its student, parent and staff records (the data controller). EduNexus looks after them for the school (the data processor), only to provide EduNexus, and keeps them confidential and secure.
This agreement is part of the Terms of Service and applies to every school using EduNexus.
1. Parties and roles
This agreement is between the school using EduNexus (the data controller) and EduNexus (the data processor), as those terms are used in the Data Protection Act, 2012 (Act 843) of Ghana.
2. What is processed
| Subject | Details |
|---|---|
| Purpose | Providing the EduNexus school management system to the school, as chosen and used by the school. |
| People concerned | The school's students, their parents and guardians, and the school's staff. |
| Kinds of information | As listed in section 3 of the Privacy Policy, including, only where the school enters them, special personal data (religion and health information) and information about children. |
| Duration | While the school uses EduNexus, and until its records are returned or deleted as set out below. |
3. What EduNexus will do
- Follow the school's instructions. Process the records only to provide EduNexus as the school uses it (the school's settings and actions in EduNexus are its instructions), unless the law requires otherwise — in which case we will tell the school where we are allowed to.
- Confidentiality. Make sure anyone working on EduNexus for us keeps the records confidential.
- Security. Keep appropriate safeguards, including: secure (HTTPS) connections; each school's records kept separate; individual log-ins with roles; passwords stored only in hashed form; blocking of repeated wrong passwords; private storage for photos and signatures; an activity log of important actions.
- Service providers. Use only the providers listed in the Privacy Policy (hosting, SMS and WhatsApp delivery, payments, email), who must also keep the records confidential and secure. We will tell schools before adding or replacing a provider that receives school records.
- Requests from people. Help the school respond when a student, parent or staff member asks to see, correct or delete their information.
- Security breaches. Tell the school without undue delay after we become aware of a breach affecting its records, give the information it needs, and help it notify the Data Protection Commission and the people affected where required.
- At the end. When the school stops using EduNexus, give it a copy of its records if it asks, and delete them within 90 days of the school asking us to — except anything the law requires us to keep, which stays protected under this agreement.
- Information. Give the school the information it reasonably needs to show it is meeting its own duties under the law.
4. What the school will do
- Have a lawful reason, and parents' or guardians' consent where required, for the records it enters — especially children's special personal data such as religion and health — and tell parents and staff how their information is used (it may refer them to our Privacy Policy).
- Enter only the information it needs, and keep it accurate.
- Control who in the school has access, and remove access when staff leave.
- Register with the Data Protection Commission where the law requires.
5. Storage outside Ghana
The school agrees that its records may be stored on our hosting provider's servers outside Ghana, protected as described in this agreement and the Privacy Policy.
6. Contact
For anything about this agreement: phone 053 327 6454, WhatsApp 020 291 0808, email edunexusgh@gmail.com.