GDPR & Data Rights

Draft date: 16 August 2026
Effective date: 16 August 2026

This page is a practical guide to privacy rights in connection with MySchoolPilot. It supplements the Privacy Policy and does not reduce any right available under the Nigeria Data Protection Act 2023 (NDPA), the UK GDPR/Data Protection Act 2018, the EU GDPR or another applicable law.

1. Identify the correct controller

For student, applicant, parent, guardian, staff, academic, attendance, fee, medical, counselling, safeguarding and other school records, the school or institution is normally the controller. It decides why and how the data is used. Send your request to the school's privacy contact or administrator first.

Foregate Technologies Limited (RC 7941211) normally acts as the school's processor when it hosts those records or accesses them for authorised support. We will promptly route and assist with a request as required by our DPA; we do not use the processor role to obstruct a valid request.

Foregate is the controller for its own website, sales, School Owner account, billing, security, support-management and business records. For those records, contact contactus@myschoolpilot.com.

2. Your rights

Depending on the law and circumstances, you may request:

• Information and access: confirmation of processing and a copy of relevant personal data, with required information about its use.
• Rectification: correction of inaccurate data and completion of incomplete data.
• Erasure: deletion where the controller no longer has a lawful reason to retain the data.
• Restriction: limited use while accuracy, lawfulness or an objection is assessed.
• Portability: eligible data you provided in a structured, commonly used and machine-readable format, and direct transfer where technically feasible.
• Objection: objection to processing based on legitimate interests or public task, and an absolute objection to direct marketing.
• Withdrawal of consent: withdrawal at any time where consent is the basis, without affecting earlier processing.
• Automated-decision safeguards: information, human intervention and an opportunity to express your view or challenge a qualifying solely automated decision.
• Complaint and remedy: complaint to a competent supervisory authority and any judicial remedy available by law.

These rights are not absolute. Exemptions may protect another person's rights, safeguarding, legal privilege, examination scripts or marking, legal claims, public interests or records that law requires the controller to keep. The controller will explain a refusal or limitation where law permits.

3. How to make a request

For school records, contact the institution and include:

1. your name and contact details;
2. your relationship to the institution and, if known, account or student identifier;
3. the right you wish to exercise;
4. a focused description of the records or period; and
5. whether you are acting for another person and the basis of that authority.

For Foregate-controlled data, email contactus@myschoolpilot.com with the subject "Data rights request" or write to 1 Iludun Street, Osogbo, Osun State, Nigeria.

Do not send passwords, full payment-card details or unnecessary identity documents. The controller may ask for proportionate information to verify identity, guardianship or authority. A parent does not automatically replace a capable child's own rights; age, capacity, best interests and applicable law must be considered.

4. Response process and timing

We will acknowledge and route the request, search relevant systems, consult the controller where required, and respond within the deadline imposed by applicable law. For GDPR requests this is ordinarily one month, subject to a lawful extension for complexity or volume. The NDPA requires a response without undue delay and within any period prescribed by the Nigeria Data Protection Commission. Where a lawful extension or limitation applies, we will explain it.

Requests are normally free. A reasonable fee or refusal may be permitted for a manifestly unfounded or excessive request, but only after documented assessment and as allowed by law. We will securely deliver the response and keep an audit record.

5. Children and safeguarding

Children have privacy rights. Information and request channels should be concise, prominent and age appropriate. The institution must consider whether the child can exercise a right directly and whether a parent or guardian is authorised to act.

A request will not be handled in a way that creates an avoidable safeguarding risk. Information may be withheld or disclosed where necessary and lawful to protect a child or another person, and the controller may involve its designated safeguarding lead or a competent authority.

6. Automated decisions and AI

MySchoolPilot may provide optional analytics, automation or AI-assisted insights. These tools should support - not replace - human judgement. If you believe a decision with legal or similarly significant effects was based solely on automated processing, tell the controller what decision you are challenging and request meaningful human review. Academic, disciplinary, admissions, employment, medical, counselling and safeguarding decisions should have an accountable human decision-maker.

7. Complaints

We encourage you to contact the relevant controller first so the issue can be investigated. This does not remove the right to complain directly to a regulator.

• Nigeria: Nigeria Data Protection Commission
• United Kingdom, where UK law applies: Information Commissioner's Office
• European Economic Area, where EU GDPR applies: the supervisory authority in the country of habitual residence, work or alleged infringement

8. Information for institutional customers

Before production use, each institution should:

• document whether it, Foregate and each integration provider are controllers, joint controllers or processors;
• sign a DPA containing all mandatory processor terms;
• give layered adult and child-friendly privacy notices;
• record lawful bases and sensitive-data conditions by module;
• complete a data protection impact assessment for high-risk processing, including children's data, welfare records, AI, monitoring and large-scale school deployments;
• configure least-privilege roles, retention, export, deletion, consent and incident procedures;
• assess international transfers and subprocessors;
• establish a verified process for rights requests and personal-data breaches; and
• determine whether it or Foregate must register or file with the NDPC or another regulator, including as a controller or processor of major importance.

9. Contact

Foregate Technologies Limited (RC 7941211)
1 Iludun Street, Osogbo, Osun State, Nigeria
Email: contactus@myschoolpilot.com
WhatsApp: +234 807 618 2936