Privacy policy

Who we are

Skublooms is a school management platform operated by Skublooms Ltd, a company registered in Nigeria, at 22 Uche Street, Aba, Abia State. You can reach us at contact@skublooms.com or 0902 054 2326.

For data about students, staff and guardians, the school is the data controller and Skublooms is the data processor: the school decides what is recorded and why, and we hold and process it on their instructions. For a school's own account and billing records, we are the controller.

What we collect

From schools and their staff

• School name, branches, address and contact details
• Staff names, email addresses, phone numbers and roles
• Bank account details used to settle collected fees
• Sign-in records and security events

About students and guardians

• Student name, admission number, class and enrolment history
• Guardian name, phone number and email address
• Academic records — marks, results, attendance and assignments
• Fees charged, waivers granted and payments made

Automatically

• Device and browser information, and IP address
• Pages visited and actions taken within the application

We do not collect card numbers. Payments are handled entirely by our licensed payment providers; card and bank credentials are entered on their systems and never reach ours. We store only a payment reference, the amount, and whether it succeeded.

Why we hold it

• To run the service the school signed up for — records, results, fees and messaging
• To collect school fees and route them to the school
• To send notifications and reminders that the school chooses to send
• To keep accounts secure and investigate misuse
• To meet legal, tax and regulatory obligations in Nigeria

Our lawful bases under the Nigeria Data Protection Act 2023 are the contract with the school, our legitimate interest in operating and securing the platform, and legal obligation where the law requires us to keep records. Where consent is the basis — marketing email to a school contact, for example — it can be withdrawn at any time.

Who else sees it

We do not sell personal data, and we do not share it for anyone else's advertising. We share it only with:

• Payment providers — to take a payment and settle it to the school. They receive the payer's email, the amount and a reference.
• Messaging providers — to deliver SMS and email a school sends. They receive the recipient's number or address and the message.
• Hosting and infrastructure providers — who store the data on our behalf under contract.
• Authorities — where we are legally required to disclose.

One school can never see another school's data. Separation between schools is enforced at the database level, not left to application code.

Where it is held, and for how long

Data is held on managed infrastructure under contract with our hosting provider. Where it is stored or processed outside Nigeria, we rely on the contractual safeguards the NDPA requires, and the provider is bound by them.

• Sent messages — the delivery record, including recipient phone numbers, is deleted after 90 days.
• Student and academic records — kept for as long as the school remains on Skublooms, and deleted or returned on request after they leave.
• Payment and accounting records — kept for the period Nigerian tax and financial regulation requires, which is longer than the school's own retention.

Your rights

Under the NDPA you may ask to access your data, correct it, have it deleted, restrict or object to how it is used, or receive a copy in a portable form.

If you are a parent or a student, ask your school first. The school decides what is held about a child, and it can correct or remove records directly. Where a request has to reach us, the school will pass it on, and we will act on it within 30 days.

You may also complain to the Nigeria Data Protection Commission.

Keeping it safe

• Traffic is encrypted in transit; passwords are hashed and never stored in readable form
• Access is limited by role — a teacher sees their classes, not the school's finances
• Every school's data is isolated from every other school's
• We do not store card or bank credentials at any point

If a breach affects your data, we will notify the school and the Commission as the NDPA requires.

Children

Skublooms is used by schools to hold records about children, on the school's instructions and under its authority as controller. Children do not sign up to Skublooms directly; a student account exists only because a school created it.

Changes

If we change this policy in a way that materially affects how data is used, we will tell schools before it takes effect. The date at the top always reflects the current version.