Skip to content

FOR SCHOOLS

Data Processing Agreement

Last updated Version 2026-11-01

INTELLIYA CONSULT LTD, trading as Akadaa, RC 7827471 · Kano, Nigeria

1. Who this agreement is between

This Data Processing Agreement ("DPA") is between your organisation (the school, college, university or group of schools using Akadaa) as the controller, and INTELLIYA CONSULT LTD, trading as Akadaa, RC 7827471 ("Akadaa"), based in Kano, Nigeria, as the processor. It forms part of our Terms of Service and applies from the moment your organisation accepts them. It covers the duties of a processor under the Nigeria Data Protection Act 2023 (NDPA) and the GAID 2025.

2. What we process for you

  • Purpose: to provide Akadaa to your organisation: storing records, showing them to the right people, sending messages you trigger, producing documents such as report cards and receipts, and supporting you.
  • People concerned: your students (many of them children), their parents and guardians, your staff, applicants, and other people you record, such as sponsors.
  • Types of information: the records you choose to keep, such as names, contact details, dates of birth, photos, classes, attendance, results, fees and payments, documents, and any health or other sensitive records you add.
  • How long: for as long as your organisation uses Akadaa, and then until the records are deleted or returned under section 11.

3. We act only on your instructions

We process your records only to provide Akadaa as described in the Terms, through the features and settings your organisation uses, and as you otherwise ask in writing. We will tell you if we believe an instruction breaks the law. If the law requires us to process records in another way, we will tell you first unless the law forbids it.

4. Your duties as controller

You decide what is recorded and why. You are responsible for having a lawful basis for it, for getting a parent's or guardian's consent for children where the law requires it, for telling the people concerned how their information is used, and for the accuracy of what you record.

5. Confidentiality

Only people working on Akadaa who need access to do their job (for example, to fix a fault or answer a support request) can reach your records, and they must keep them confidential. When our support staff sign in as one of your users, it is recorded in an audit log.

6. Security

We keep security measures suited to the risk, including:

  • HTTPS for all connections, and secure sign-in cookies that page scripts cannot read;
  • passwords stored only as bcrypt hashes, and optional two-factor sign-in with backup codes;
  • encryption of two-factor secrets and school bank account numbers (AES-256-GCM);
  • private request links and parent consent codes stored only in a scrambled form;
  • role-based access limited to each school or organisation, remote sign-out of sessions, and sign-out after inactivity;
  • rate limits on sign-in, password reset and public forms; and
  • audit logs of sensitive actions.

7. Sub-processors

You allow us to use the providers listed below to run Akadaa. We give each one only what its job needs, and we choose providers that commit to protecting personal information. Before we add or replace a provider that will handle your records, we will update this list and tell organisation administrators. If you object for a good data protection reason, tell us at support@akadaa.com; if we cannot address it, you may close your account.

  • Railway

    In use
    What for
    Hosting for the Akadaa app and its database.
    What it receives
    Everything stored in Akadaa, including uploaded documents and photos, which are kept in the database.
    Where
    Railway's EU region (Amsterdam, Netherlands), for both the app and its database

  • Resend

    In use
    What for
    Sending Akadaa's emails, and receiving email sent to akadaa.com addresses such as support@akadaa.com.
    What it receives
    Recipients' names and email addresses and the content of each email (for example notices, password links and application confirmations). Emails sent to our support address.
    Where
    Resend's EU (Ireland) region; Resend is a US company

  • Google (Gmail)

    In use
    What for
    The mailbox that receives messages sent to support@akadaa.com and sales@akadaa.com (Resend forwards them there).
    What it receives
    Emails people send to our support and sales addresses, with their names and email addresses.
    Where
    Google's servers outside Nigeria

  • Upstash

    In use
    What for
    Rate limiting, to slow down password guessing and abuse of public forms.
    What it receives
    IP addresses, account IDs and some email addresses, used as short-lived counters.
    Where
    Upstash cloud servers outside Nigeria

  • DeepSeek

    In use
    What for
    AI features: the help assistant, the student AI Tutor, smart spreadsheet import and dashboard insights.
    What it receives
    What a user types into the assistant or AI Tutor, earlier messages in that chat, the page they are on, their role and their school's name and type. Smart import from a spreadsheet sends column headings, the kind of data in each column and class names, never the names or contact details in the file; a pasted list, or the text read on the device from a photo of one, is sent as written, names and contact details included. Insights send school-wide totals only, with no names.
    Where
    China
    Note
    Schools can turn the AI Tutor off in Settings → Modules.

  • OpenAI

    Switched off
    What for
    Back-up AI provider for the help assistant and AI Tutor.
    What it receives
    The same chat content as DeepSeek, only if DeepSeek is not set up.
    Where
    United States
    Note
    Not set up: Akadaa uses DeepSeek. We will update this list before it is switched on.

  • Intelliyya CBT (hosted on Supabase)

    Only when used
    What for
    Computer-based tests and exam practice, for schools that connect it.
    What it receives
    Students' names, admission numbers, email addresses, class or programme and internal record IDs, sent when a student opens a test or the school shares its class list. Scores come back into Akadaa.
    Where
    Supabase cloud servers outside Nigeria

  • Telegram

    Only when used
    What for
    The Akadaa Telegram bot, for people who choose to link their Telegram account.
    What it receives
    The phone number shared to link an account, and what the bot sends in that chat: children's names, fees, results, attendance, announcements and payment receipt photos.
    Where
    Telegram's servers outside Nigeria

  • Paystack

    Only when used
    What for
    Online card and bank payments, only for a school that adds its own Paystack account.
    What it receives
    The payer's email address, the amount and the payment reference.
    Where
    Nigeria

  • Termii

    Switched off
    What for
    Text messages (SMS).
    What it receives
    Phone numbers and message text.
    Where
    Nigeria
    Note
    Switched off. Akadaa sends email only. We will update this list before it is switched on.

  • Meta (WhatsApp Business)

    Switched off
    What for
    WhatsApp messages.
    What it receives
    Phone numbers and message text.
    Where
    Outside Nigeria
    Note
    Switched off. Akadaa sends email only. We will update this list before it is switched on.

8. Transfers outside Nigeria

Some providers above handle records outside Nigeria, including in the European Union (Ireland), the United States and China. Where records leave Nigeria, we rely on the grounds the NDPA allows for such transfers, and send only what the feature needs.

9. Helping with requests and checks

  • If a parent, student, staff member or applicant asks us directly about their records, we will pass the request to you and not answer it ourselves unless you ask us to.
  • We will help you respond to requests to see, correct, delete, limit or move records. Many of these you can do yourself inside Akadaa.
  • We will give you reasonable help with data protection impact assessments and with questions from the Nigeria Data Protection Commission (NDPC).

10. Personal data breaches

If we become aware of a breach affecting your records, we will tell you without undue delay. We will share what we know (what happened, what records and people are affected, and what we are doing about it) so you can meet your duty to notify the NDPC within 72 hours where required, and to inform the people affected.

11. At the end

When your organisation closes its account, or asks us to, we will return your records to you in a common format or delete them, as you choose. We may keep a copy only where the law requires us to, and we will keep protecting it under this DPA.

12. Showing that we comply

We will give you the information you reasonably need to show that this DPA is being followed, and answer your written questions about how we protect your records. Email support@akadaa.com.

13. General

The limits of responsibility in the Terms of Service apply to this DPA. If this DPA and the Terms disagree about personal information, this DPA wins. Nigerian law governs this DPA. Our Privacy Policy explains more about how information is handled.