Privacy & Data Protection Notice
1. Who we are
This platform is operated as DasticOS (Dastiocos). Our registered address is Port Harcourt, Rivers State. You can reach us using the details in section 12.
2. When we are a controller, and when we are a processor
This distinction decides who you should contact about your data:
- Your school is the data controller for the records it keeps about its pupils, guardians and staff - admissions, attendance, results, fees, photographs, documents and messages. The school decides what to collect and why. DasticOS only stores and processes that data to provide the service to the school, on the school's instructions. If your question is about a child's records, ask that child's school first; they are the controller and, in most cases, the fastest route to a correction.
- DasticOS is the data controller for a small set of data we collect for ourselves: enquiries sent through the "Book a demo" form on our website, accounts we create for platform administrators, and the technical logs described in section 7.
3. What personal data is collected
Depending on your relationship with a school, the data held through the platform may include:
| Pupils | Full name, date of birth, sex, class, admission number, photograph, guardian details, address, medical notes a school chooses to record, uploaded documents (e.g. birth certificate, previous results), attendance, assessment scores and results, fee and payment records. |
|---|---|
| Guardians / parents | Name, relationship to the pupil, phone number, email and address, and the messages exchanged with the school. Parents sign in using their child's student ID - there is no separate parent account. |
| Staff | Name, staff ID, role, contact details, photograph, employment-related records the school keeps, and activity within the system. |
| Applicants | Information submitted through an admission or entrance-exam form, including a child's and guardian's names, contact details and any documents uploaded to support the application. |
| Website enquiries | If you use the "Book a demo" form: your name, your school's name, email, and any phone number or message you provide. |
| Technical | A session cookie (see section 10), and server logs recording IP address, browser and pages requested, kept to keep the service secure and working. |
4. Children's data
Most of the pupils on this platform are children. Their data is treated with extra care, and the responsibility for collecting it lawfully sits with the school as controller:
- A school should collect a child's data with the consent of a parent or guardian, or under another lawful basis available to it (for example, its own legal duties as an educational institution).
- Children's records are only visible inside the school that owns them. The platform is multi-tenant: one school can never see another school's pupils, staff or files.
- Documents such as a birth certificate, a passport photograph or a medical note are stored privately and are never served from a public web address. They are released only to a signed-in user of the same school whose role permits it.
- We do not use children's data for advertising, profiling or any purpose beyond running the school's own system.
5. Why the data is used, and the lawful basis
Personal data is processed to deliver the service a school has signed up for - keeping the register, producing report cards, tracking fees, running admissions and entrance exams, and letting a school communicate with its families. The lawful bases relied on (as set out in the Nigeria Data Protection Act) are, depending on the case:
- Consent - e.g. a guardian agreeing to a school holding their child's data, or a website visitor sending a demo enquiry.
- Performance of a contract - providing the platform to a school that has subscribed to it.
- Legal obligation - where a school or the operator must keep certain records.
- Legitimate interest - keeping the service secure and working, in a way that does not override your rights.
6. Who the data is shared with
Personal data is not sold and is not shared for advertising. It is shared only:
- within the school that owns it, according to each user's role;
- with the service providers we rely on to run the platform ("sub-processors"), which act on our instructions - principally our hosting provider and the email provider that sends system emails such as report-card notices, fee reminders and the reply to a demo enquiry: Hostinger (hosting), Hostinger (email delivery);
- where the law requires it, or to protect the rights and safety of users.
If any provider is located outside Nigeria, any transfer is made in line with the conditions for cross-border transfers in the Nigeria Data Protection Act.
7. How the data is protected
The platform is built with the following safeguards, among others:
- traffic is served over HTTPS, and session cookies are marked secure, HTTP-only and same-site;
- each school's data is strictly isolated from every other school's;
- private files (photographs, documents, exam images) are never at a public URL - they are served only through an authenticated gatekeeper that checks the viewer's school and their relationship to the record first;
- passwords are stored only as secure one-way hashes, never in plain text, and sensitive platform credentials are stored encrypted;
- repeated failed sign-in attempts are throttled to slow down guessing;
- access to data within a school follows the user's role.
No system can promise perfect security, but these measures are intended to keep personal data - and children's data in particular - protected against unauthorised access.
8. How long the data is kept
Records are kept while your school uses the platform. When you leave or ask us to remove them, we delete or anonymise them within a reasonable period, except where the law requires us to keep some for longer.
Demo enquiries are kept only for as long as needed to respond and follow up.
9. Your rights
Under the Nigeria Data Protection Act you have the right to:
- ask what personal data is held about you, and get a copy;
- have inaccurate data corrected;
- ask for data to be deleted, where there is no lawful reason to keep it;
- object to, or ask us to restrict, certain uses of your data;
- ask to receive your data in a portable form, or have it moved;
- withdraw a consent you previously gave, at any time;
- lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your data has been mishandled.
For a pupil's, guardian's or staff record, the quickest route is usually the school that holds it (the controller). For data we hold as controller, or if a school does not resolve your request, contact us using section 12.
10. Cookies and similar technology
The platform uses a single session cookie to keep you signed in while you use it - it carries no advertising identifier. Your browser also stores a small preference for light or dark mode. We do not use third-party advertising or cross-site tracking cookies.
11. Changes to this notice
We may update this notice as the platform or the law changes. The "last updated" date at the top always reflects the current version; significant changes will be made clear.
12. How to contact us
For any privacy question, or to exercise a right above:
- Email: Info@dasticos.com (Data Protection Officer)
- Phone: 08030631257
- Address: Port Harcourt, Rivers State
Complaints can also be made to the Nigeria Data Protection Commission (NDPC).