Data Processing Agreement

How Palmgrade processes personal data on behalf of your school

Effective Date: May 1, 2026

Last updated: August 24, 2026

1. Roles of the Parties

This Data Processing Agreement ("DPA") forms part of, and is governed by, the Palmgrade Terms of Service between Cevatronic Systems Limited (RC 9750428), a company incorporated in Nigeria and the operator of the Palmgrade platform ("Palmgrade", "we", "our", "us"), and the school or organisation using our services ("you"). For personal data of students, parents, and staff that you provide or that is generated through your use of the platform:

You are the Data Controller — you determine the purposes and means of processing.
Palmgrade is the Data Processor — we process that personal data only on your behalf and on your instructions.
Where you act as a processor for another party (e.g., a government body), Palmgrade acts as a sub-processor on the same terms.

2. Definitions

Terms such as "personal data", "processing", "data controller", "data processor", "data subject", and "personal data breach" have the meanings given in the Nigeria Data Protection Act (NDPA) 2023 and, where applicable, the EU General Data Protection Regulation (GDPR).

3. Scope and Nature of Processing

Subject matter & duration: Processing takes place for the duration of your subscription and the retention periods described in our Privacy Policy.

Nature & purpose: Hosting and operating a school management platform — including computer-based testing, student records, gradebook and reports, fee tracking, and parent/teacher communication.

Types of personal data: Identification and contact details, educational records (grades, attendance, exam results), guardian details, and limited technical/usage data.

Categories of data subjects: Students (typically minors under 18), parents/guardians, teachers, and your administrative staff.

4. Our Obligations as Processor

Palmgrade will:

Process personal data only on your documented instructions, including this DPA and your use of the platform, unless required otherwise by law (in which case we will inform you, where legally permitted).
Ensure that personnel authorised to process personal data are bound by confidentiality.
Implement appropriate technical and organisational security measures (see our Security Practices page).
Assist you, taking into account the nature of processing, in meeting your own obligations under the NDPA / GDPR.
Not sell personal data or use it for our own purposes (such as advertising).

5. Sub-Processors

You authorise Palmgrade to engage the following sub-processors to deliver the service. Each is bound by data protection terms no less protective than this DPA:

Supabase — database, authentication, and file storage hosting
Vercel — application hosting and content delivery
Paystack — payment processing, including the collection of school fees from parents where you enable it
Zoho — transactional and account email delivery

This list is exhaustive: These are the only third parties that process personal data on our behalf. We do not use analytics, advertising or profiling services. If we introduce a new category of sub-processor — for example an SMS or messaging provider to deliver notifications to parents — it will be added to this list under Section 6 before it begins processing any personal data.

6. Changes to Sub-Processors

We will give you reasonable notice of any new or replacement sub-processor (via the platform or email) before it begins processing personal data, so you have the opportunity to object on reasonable data protection grounds.

7. Assisting with Data Subject Requests

Taking into account the nature of the processing, we will assist you — by appropriate technical and organisational measures, and insofar as possible — to respond to requests from data subjects exercising their rights (access, rectification, erasure, restriction, portability, and objection). Where a data subject contacts us directly about data we process for you, we will refer them to you, the controller.

8. Personal Data Breaches

We will notify you without undue delay, and in any event within 48 hours of confirming a personal data breach affecting your data, and provide the information you reasonably need to meet your own breach-notification obligations. This window is deliberately shorter than the 72 hours in which you may be required to notify the NDPC, so that you have time to assess and report. Where the full facts are not yet established we will notify you of what we know within that window and update you as the investigation progresses, rather than delaying the first notice. See our Security Practices page for our incident-response approach.

9. Impact Assessments

We will provide reasonable assistance with your data protection impact assessments and any prior consultation with the NDPC or a supervisory authority, taking into account the information available to us.

10. International Transfers

Where personal data is transferred outside Nigeria (for example, to our hosting providers' regions), such transfers rely on the safeguards described in Section 6 of our Privacy Policy — NDPA Section 41 mechanisms and, for EU/EEA data, the GDPR Chapter V safeguards (adequacy or Standard Contractual Clauses) in our providers' agreements.

Schools outside Nigeria: This agreement is written to the Nigeria Data Protection Act 2023 and its implementing directives, with GDPR safeguards where EU/EEA data subjects are involved. Other African jurisdictions have their own data protection statutes — including Kenya's Data Protection Act 2019, Ghana's Data Protection Act 2012 and South Africa's POPIA — with their own requirements on localisation, cross-border transfer and breach notification. Where we onboard a school established outside Nigeria, we will agree a jurisdiction-specific addendum to this agreement covering the applicable law before processing begins. Until such an addendum is agreed, this agreement governs processing on the basis set out above.

11. Return and Deletion of Data

On termination or expiry of your subscription, we will retain, then delete, your personal data in accordance with the retention schedule in our Privacy Policy (including the post-subscription reinstatement window). You may request export or earlier deletion of your data by contacting us.

12. Audits and Information

We will make available to you the information reasonably necessary to demonstrate compliance with this DPA, and will contribute to audits — including by providing relevant documentation from our sub-processors or supporting a mutually agreed audit on reasonable notice, subject to confidentiality and without compromising the security of other customers.

13. Precedence

This DPA forms part of the Terms of Service. In the event of a conflict between this DPA and the Terms of Service regarding the processing of personal data, this DPA prevails. All other terms (including limitations of liability) remain as set out in the Terms of Service.

14. Governing Law

This DPA is governed by the laws of the Federal Republic of Nigeria, consistent with the Terms of Service.

Contact Us

Email: legal@palmgrade.com

Phone: +234 706 172 6605

Address: Trinity Mall, 79 Obafemi Awolowo Way, Ikeja, Lagos State 101233, Nigeria