Privacy Policy

Last updated: 14 October 2026

1. Who we are and what this Policy covers

SchoolOval is a school management web application at https://school-oval.com, including its school portals. It is a product of Gazelle Web-Tech LTD, the company that publishes and operates it.

In this Privacy Policy ("Policy"), "we", "us", and "our" mean Gazelle Web-Tech LTD. "SchoolOval" means our software and related services. "You" and "your" mean a person whose personal information is handled through the service, including visitors, applicants, students, parents, guardians, school staff, and school representatives.

Personal information is information that identifies someone or can reasonably be linked to them. This Policy explains what information is handled, why it is used, who may receive it, and how to ask questions or exercise your rights. It should be read alongside your school's privacy notice.

2. Our role and your school's role

For school records, the school normally decides why information is collected and how it is used. In data protection law, this usually makes the school the "data controller". We normally act as its "data processor": we provide the software and handle those records on the school's documented instructions, subject to legal obligations.

For our own business activities, Gazelle Web-Tech LTD is the data controller. These activities include handling website enquiries, registering school customers, managing our billing and customer relationships, and protecting the service.

The role depends on the particular activity. A payment provider may also act as an independent controller for activities such as payment verification and fraud prevention. Its own notice explains those activities.

If your request concerns a child's school record, result, attendance, school fee, or school-managed account, contact the school first. We assist schools with requests and will explain or redirect enquiries sent to us where appropriate. Schools remain responsible for their own privacy notices and lawful instructions.

3. Information handled through SchoolOval

The information depends on the features a school uses and what you or the school provide. It may include:

• Account and contact details: names, email addresses, phone numbers, role, school, account credentials, and verification records.
• Admissions and student records: application details, date of birth, photographs, addresses, previous schools, documents, classes, enrolment history, assessments, grades, reports, and attendance.
• Family and safeguarding details: parent or guardian relationships, emergency contacts, authorised pickup details, and pickup verification records.
• Sensitive information: health declarations, recorded temperatures, or information such as ethnicity where a school collects it. This information needs additional care and a lawful basis or condition that applies to it.
• Staff information: employment details, qualifications, contracts, salary records, bank details where needed for payment, and leave requests.
• Payment and order information: charges, balances, amounts paid, receipts, payment references, transaction status, and school shop orders.
• Communications: enquiries, messages, attachments, announcements, and support correspondence.
• Technical information: IP addresses, browser or device information, sign-in and security events, error logs, and session identifiers needed to operate the service.

Do not provide information that is unnecessary for the activity. Payment providers handle payment credentials through their own systems; do not send card security codes, passwords, or banking login details through SchoolOval messages or support requests.

4. Where information comes from

Information may come directly from you when you complete a form, create an account, send a message, or make a payment. It may also come from your school, an authorised parent or guardian, an employer, or another person authorised to supply it.

Payment providers send transaction confirmations and related status information. Some technical information is generated when you visit or use the service. A school that supplies information about another person must have authority and a lawful reason to do so and provide any required notice.

5. Why information is used

On a school's instructions, we use information to provide the school functions it chooses, including admissions, records, attendance, academic reporting, fees, staff administration, communication, and orders.

For our own business purposes, we use relevant information to:

• Respond to enquiries and arrange demonstrations.
• Register and verify school customers and manage their service.
• Manage our invoices and customer relationships.
• Provide support, troubleshoot errors, and maintain the service.
• Detect unauthorised access, prevent misuse, and investigate security incidents.
• Meet legal obligations and handle complaints or legal claims.

We do not claim ownership of personal information. School records are to be used to provide the service and meet lawful obligations, rather than for unrelated advertising or sale. Any proposed new use must be assessed and explained before it begins, with consent where legally required.

6. Legal reasons for using information

For activities where we are the controller, the legal reason depends on the purpose. It may be taking steps you request before a contract, carrying out our contract with you, meeting a legal obligation, or a legitimate interest such as securing the service and answering business enquiries. When relying on a legitimate interest, we must consider its effect on people's rights and interests, especially children's.

Where consent is required, we must ask for it in a clear and specific way. You can withdraw consent for future use through the relevant contact or setting. Withdrawal does not make earlier lawful use unlawful. We do not treat acceptance of the Terms as blanket consent to every use of personal information.

A school must identify and explain the legal reasons for its own activities. Sensitive information and children's information may require additional conditions or safeguards under applicable law. We process school-controlled information under the school's lawful instructions and the applicable data processing agreement.

7. Who may receive information

Information may be available to authorised school users according to their permissions, and to parents or guardians where the school authorises access. A parent account should only access records linked to that person's authorised relationship.

We may use service providers for hosting, storage, email or message delivery, technical support, and payment processing. Providers receive only the information needed for their role and must be subject to appropriate confidentiality and data protection arrangements. Payment processing may involve providers such as Paystack or Flutterwave, depending on the configured service.

Authorised Gazelle Web-Tech LTD personnel may access information where needed for support, maintenance, security, or legal obligations. A school's separate database does not mean that authorised platform administrators can never access it.

Information may also be disclosed where required by law, a valid court order, or a lawful regulatory request, or where lawfully necessary to protect rights or address fraud or a security threat. Any proposed business transfer must preserve applicable data protection obligations, with notice where required.

External websites, payment pages, and services have their own privacy notices. Ask us about the providers relevant to your school's service using the contact details below.

8. Storage and transfers between countries

Hosting, storage, and support locations depend on the providers and deployment used for a school's service. Do not assume that all information stays in Nigeria or in the country where a school is located.

Before transferring personal information internationally, the responsible controller must establish a permitted transfer basis and appropriate safeguards under applicable law. Depending on the circumstances, this may involve an assessment of the destination's protection and suitable contractual safeguards. We must follow those requirements for our own transfers and the school's lawful instructions for school-controlled records.

Contact us for the storage locations, recipient countries, and applicable safeguards for your service. These details must be confirmed in the relevant service and data processing arrangements.

9. Security and incident handling

We are responsible for maintaining technical and organisational measures appropriate to the information and risks involved. Access must be limited to authorised people for legitimate purposes. Schools are responsible for assigning suitable permissions and keeping their users' access up to date.

No internet service can promise complete security. Keep account details private, use a strong password, and sign out on shared devices. Do not share sensitive records through public links or with unauthorised recipients.

Report suspected unauthorised access or disclosure to your school and to us promptly. Where a personal data breach occurs, we must notify the relevant school without undue delay when acting as its processor, and fulfil any reporting or notification duties that apply to us. Schools and other controllers must fulfil their own duties to affected people and regulators.

10. How long information is kept

SchoolOval retains personal information only for as long as necessary to fulfil its intended purpose, comply with applicable legal requirements, and meet legitimate operational obligations. Records will be securely deleted or irreversibly anonymised when they are no longer required, unless further retention is required by law.

For school-controlled records, we follow the school's lawful instructions and the applicable service or data processing agreement. The school should explain its retention periods to families and staff. Closing an account or leaving a school does not automatically require the deletion of records that still need to be kept for a lawful purpose.

For information we control, the retention period depends on the reason it was collected, the customer relationship, legal record-keeping requirements, and any ongoing complaint, security investigation, or legal claim. Legitimate operational needs must be specific and lawful; they do not justify keeping information indefinitely.

At the end of a school's service, return, export, and deletion arrangements will be set out in the relevant agreement. This includes applicable retention periods, export windows, and backup deletion schedules. Backup copies retained until their scheduled deletion must remain protected and must not be used for unrelated purposes.

11. Your privacy rights

Subject to applicable law and any lawful exceptions, you may ask to be informed about how your information is used, access it, correct it, delete it, restrict or object to its use, or receive or transfer it in a usable format. You may withdraw consent where the use relies on consent. You may also have rights concerning decisions made solely by automated processing that have legal or similarly significant effects.

Contact your school for school-controlled records, or us for information we control. We may need to verify your identity and, where relevant, your authority to act for a child or another person. We will only request what is reasonably needed for that check. Requests must be handled within the applicable legal deadlines. If a request cannot be granted in full, the responsible controller should explain the reason and available complaint routes.

12. Children's information

SchoolOval is used by schools and authorised adults to manage education-related records, including records about children. Children must not create independent accounts under our Terms. Records about a child may still be processed through an authorised school, parent, or guardian.

Schools must provide appropriate information to families, identify a lawful basis, obtain and verify parent or guardian consent where required, and apply any legally permitted exceptions carefully. The child's interests, age, and privacy needs must guide decisions. Children should not be asked to supply unnecessary information.

Parents and guardians may exercise applicable rights on a child's behalf where they have the necessary authority. Access must also take account of the child's own rights, court orders, and any legal restrictions. Tell the school and us if you believe a child's information has been collected or shared without proper authority.

13. Cookies and similar technologies

SchoolOval uses cookies and session-related technology to maintain sign-ins, remember necessary session information, and protect forms and accounts. These technologies help the service function. Blocking them may prevent you from signing in or using some features.

This Policy does not provide consent for optional advertising or analytics cookies. Before introducing non-essential tracking, we must explain the provider, purpose, and duration and provide any choices or consent required by applicable law. Browser settings can also help you manage or delete cookies.

14. Changes to this Policy

We may update this Policy as the service, our practices, or legal requirements change. We will publish the revised Policy with its effective date and give appropriate notice of material changes. Where a new activity requires consent, we must obtain it before beginning that activity.

15. Contact and complaints

Operator: Gazelle Web-Tech LTD, publisher and operator of SchoolOval.

Website: https://school-oval.com

Privacy contact: privacy@gazelleweb-tech.com

For school records, contact your school's administration or privacy contact first. For Gazelle Web-Tech LTD's own processing, security concerns, or help identifying the responsible contact, use the confirmed details above. Do not include passwords or unnecessary sensitive records in an initial enquiry.