Privacy Policy

1 Who We Are & Our Legal Framework

SmartEduPlus is an enterprise digital education technology platform specializing in AI-powered School Operating Systems (School OS), comprehensive Learning Management Systems (LMS), administrative automation, and interactive student engagement.

• Main Operations & Engineering: Founded and engineered by technical operations based in Nigeria, the enterprise is actively establishing its European corporate headquarters in Lisbon, Portugal, under the IAPMEI Startup Visa framework.
• Dedicated Privacy Contact: For all privacy-related inquiries, Data Processing Agreement (DPA) requests, regulatory correspondence, or data subject rights submissions, our dedicated operational data desk is accessible at: privacy@smarteduplus.com.

2 Our Legal Role: Data Controller vs. Data Processor

Under the EU General Data Protection Regulation (GDPR Article 4), the Nigeria Data Protection Act 2023 (NDPA), and related global privacy statutes, personal data handled by SmartEduPlus is treated under two strict, clear classifications:

3 Data Routing & Sub-Processors

To deliver high-availability cloud infrastructure, low-latency School OS performance, and practical AI educational tools, SmartEduPlus partners with vetted third-party sub-processors. All pipelines are contractually bound under Article 28 GDPR requirements to industry-leading security and confidentiality standards:

Sub-Processor Objection Rule

SmartEduPlus maintains a formal sub-processor management procedure. We will notify school administrators at least thirty (30) calendar days prior to onboarding any new sub-processor or making material modifications to existing sub-processor assignments.

4 International Data Transfers & Safeguards

Because our core technical engineering, maintenance, and DevOps infrastructure management is conducted directly by our founder and engineering team based in Nigeria, accessing the EU-based infrastructure constitutes a cross-border data transfer under Chapter V of the General Data Protection Regulation (GDPR).

Because Nigeria has not yet received an adequacy decision under GDPR Article 45, SmartEduPlus executes and enforces the following safeguards to protect this cross-border pipeline:

• EU Standard Contractual Clauses (SCCs): Remote management and engineering activities are legally bound under the European Commission's Standard Contractual Clauses (Module 2: Controller-to-Processor & Module 3: Processor-to-Processor), guaranteeing an equivalent level of protection to that provided within the EEA.
• Encrypted VPN Tunnels: All remote DevOps and maintenance connections must pass through dedicated, end-to-end encrypted VPN tunnels with strict IP whitelisting.
• Mandatory Multi-Factor Authentication (MFA): Hardware/app-based MFA is strictly enforced for all server root, database console, and deployment access.
• Comprehensive Audit Logging: Every remote operational session, administrative query, and database interaction is logged with tamper-evident audit trails.
• Zero-Local-Download Policy: Technical staff are strictly prohibited from downloading or storing live production student data or database dumps onto local workstations or client laptops.
• EU Data Localization: All primary student database tables, multimedia files, and backup snapshots remain persistently housed inside the AWS eu-west-1 (Dublin, Ireland) cloud.

5 Artificial Intelligence Data Protections (Alia & AI Tutor)

Our integrated AI features—including the Alia Course Synthesis Engine and the SmartEdu AI Interactive Tutor—are architected with strict, privacy-by-design boundaries:

• Zero Model Training: Our upstream enterprise AI providers (Google and Groq) are contractually and programmatically prohibited from using your institutional prompts, student questions, or curriculum content to train, retrain, or improve their public foundational models.
• Programmatic Anonymization: All student personal identifiers (including real names, admission numbers, emails, and school IDs) are automatically stripped prior to sending any prompt to external AI APIs.
• Human-in-the-Loop Oversight: All automated course outlines, lesson modules, and assessment items generated via the Alia engine require explicit review and deployment approval by an authorized school administrator or instructor before becoming accessible to learners.
• Strict 90-Day Retention Limit: AI conversation logs, tutor interaction transcripts, and session states are automatically purged and permanently overwritten on our EU servers after 90 days.
• Disclosed US Processing Architecture: Institutional prompts submitted to Google Gemini or Groq are processed within SOC 2 / ISO 27001 certified data center facilities located in the United States, fully encrypted in transit via TLS 1.3 and at rest via AES-256.

6 Children's Data & Institutional Mandates

SmartEduPlus serves primary and secondary educational institutions. We process personal data relating to minors strictly under the institutional authority and contractual direction of the contracting educational institution.

• School Responsibility for Parental Consent: Under applicable child privacy laws—including GDPR Article 8, the Children's Online Privacy Protection Act (COPPA), and the NDPA 2023—the contracting School (as Data Controller) holds sole legal responsibility for obtaining verifiable parental or legal guardian consent prior to creating minor student accounts or inputting student records into the School OS.
• Zero Advertising & Profiling: We maintain a strict zero-commercialization mandate across all platform tiers. SmartEduPlus never sells student data, never displays behavioral or contextual advertisements, and never creates behavioral profiles of minors for commercial or third-party tracking purposes.
• Parental Review Rights: Parents and legal guardians wishing to review, correct, or request the deletion of their child's educational records should direct their request directly to their school administrator. SmartEduPlus will assist the school in executing verified requests promptly.

7 Regulatory Oversight & Complaints

Data subjects and institutional clients have the unequivocal legal right to lodge formal inquiries or complaints regarding our data protection practices directly with competent supervisory authorities:

We encourage users and school administrators to contact our dedicated data privacy desk at privacy@smarteduplus.com first so that we may swiftly investigate and resolve any concerns.

8 Data Subject Rights (EU GDPR, NDPA 2023, CCPA)

Subject to statutory conditions, every individual whose personal data is processed through SmartEduPlus possesses the following core privacy rights:

How to Exercise Rights: Where SmartEduPlus acts as a Data Processor on behalf of a school, requests concerning student or teacher records must be submitted directly to the school administration. We provide schools with the administrative tools needed to fulfill these requests within statutory timeframes (30 days). For controller-level records, submit your request directly to privacy@smarteduplus.com.

9 Technical & Organizational Security Measures (TOMs)

SmartEduPlus implements multi-layered technical, physical, and administrative safeguards designed to ensure a level of security appropriate to the risk:

• Encryption Standards: AES-256 encryption for all data at rest on AWS Dublin volumes, and TLS 1.3 encryption for all data in transit across public networks.
• Role-Based Access Control (RBAC): Strict cryptographic authorization partitioning system administrators, school leaders, teachers, students, and parents.
• Automated Backups & Disaster Recovery: Redundant encrypted snapshots generated daily and retained in secure EU cloud facilities with automated integrity verification.
• Vulnerability Management: Continuous code dependency scanning, periodic penetration audits, and strict code review pipelines prior to deployment.

10 Data Retention & Permanent Purging

We retain institutional data only for as long as necessary to fulfill our contractual obligations to the contracting educational institution:

• Active School Subscriptions: Academic records, student rosters, and grades are retained throughout the active duration of the school's contract.
• Contract Termination: Upon institutional contract termination, schools have a 90-day grace period to export all historical data, after which the institutional database partition is permanently purged from production servers and backup rotation cycles.
• AI Interaction Logs: Pureed automatically every 90 days from EU storage.

11 Cookies & Tracking Technologies

SmartEduPlus utilizes strictly essential first-party cookies necessary for core platform functionality, including session authentication, CSRF security verification, and interface preference retention.

We do not deploy third-party advertising cookies, cross-site behavioral tracking scripts, or commercial data broker pixels.

12 Policy Updates & Changes

SmartEduPlus reserves the right to amend this Privacy Policy to reflect changing regulatory requirements, platform improvements, or entity reorganization (including formal establishment of our Portuguese headquarters under the IAPMEI Startup Visa framework).

Whenever material updates are made, school administrators will receive notice via email and an administrative dashboard announcement at least thirty (30) days prior to the new terms taking effect.

13 Contact Information & Data Privacy Desk

For questions, legal notices, Data Processing Agreement (DPA) execution, or data rights inquiries: