This Data Processing Agreement (“DPA”) forms an integral part of the Master Services Agreement between Azed Labs LTD (Processor) and the subscribing educational institution (Controller).
1. Statutory Roles & Scope of Processing
In compliance with Sections 29 and 30 of the Nigeria Data Protection Act (NDPA) 2023 and Article 28 of the GDPR:
- Controller (School): The School determines the purpose and lawful basis for collecting student rosters, teacher demographics, exam marks, and tuition fees.
- Processor (Azed Labs LTD): Prismera processes personal data solely on the documented instructions of the School to deliver multi-tenant cloud school management, grading, timetable generation, and fee billing services.
2. Obligations of the Data Processor (Prismera)
Azed Labs LTD covenants that it shall:
- Process Strictly on Instructions: Process customer personal data solely on documented instructions from the School, including with respect to cross-border cloud hosting.
- Confidentiality: Ensure all engineers and staff authorized to access tenant databases are committed to strict contractual confidentiality.
- Technical & Organizational Measures: Implement robust security controls including PostgreSQL schema isolation, TLS 1.3 in transit, and AES-256 cloud volume encryption at rest.
- Data Subject Rights Assistance: Provide technical tools enabling the School to service parent and student access, correction, and portability requests under NDPA §§34–39.
- Post-Termination Return & Wipe: Provide a 30-day grace period upon contract termination for the School to export its database, followed by permanent schema drop within 90 days.
3. Subprocessor Governance & Advance Notice
The School grants general authorization to Prismera to engage our verified infrastructure subprocessors:
| Subprocessor | Processing Purpose | Location & Safeguard |
|---|---|---|
| Google Cloud & Gemini AI | Timetable generation, lesson plan drafting, fee OCR, paper register OCR. | Global Cloud • Zero Foundational Retraining Terms |
| Paystack Payments Ltd | Online card, bank transfer, and USSD tuition fee payments. | Lagos, Nigeria • PCI-DSS Level 1 |
| Render Services Inc. / AWS | Cloud container hosting and managed PostgreSQL databases. | Global Cloud / EU • SOC 2 Type II / ISO 27001 |
| Termii Mobile | Transactional SMS dispatch (attendance alerts, fee payment reminders). | Lagos, Nigeria • Direct Telco DPA |
Prismera provides at least fourteen (14) days' advance notice before adding or replacing any subprocessor. The School holds the right to object on reasonable data protection grounds.
4. Security Breach Notification SLA
In the event of a confirmed Personal Data Breach affecting the School's records, Prismera shall notify the School without undue delay and within forty-eight (48) hours of becoming aware of the breach, providing forensic details and recommended remediation steps.
5. Contact & Compliance Desk
Azed Labs LTD (RC 9432305)
Attn: Data Protection Officer & Compliance Desk
Address: 6, Zoo Road, Kano, Kano State, Nigeria
Email: privacy@prismera.ng | dpo@prismera.ng