Who is responsible for what
Data protection law gives different duties to the organisation that decides how personal data is used (the controller) and an organisation that handles it on the controller's behalf (a processor).
| Who | Role | What that means |
|---|---|---|
| Your institution | Controller | Decides who has an account, what is used and kept, and answers requests from students, parents and staff. Gives any notices and gets any consents the law requires. |
| EDU54 | Processor, only when we set up or support your box | Acts only on your written instructions, keeps what we see confidential, and does not open student conversations, work or safety alerts. |
| EDU54 | Controller, for our own business data | Website, enquiries, orders and invoices, as set out in our Privacy Policy. |
Because the box runs on your network and does not send student data to us, there are no sub-processors for student data.
What the box stores, and the tools you get
| Data | Where | Default |
|---|---|---|
| Accounts: display name, username, role, class | Your box | Until the person is removed |
| Conversations with the AI tutor | Your box | Deleted after 90 days. Admins can set 7 to 365 days. |
| Lessons, assignments, submissions, projects, progress | Your box | Until removed by staff or admin |
| Safety alerts | Your box, visible only to designated safety contacts | Per your school's policy |
| Admin actions (audit log) | Your box | Kept for accountability |
In the admin area you can export one person's data (for an access or portability request), export your people list, delete a person, set how long tutor conversations are kept, back up the box, and read the audit log. Everyone signs in with their own account, and each role (student, teacher, safety contact, admin) sees only what it needs. Checks are enforced on the box itself, not just hidden in the screens.
We do not use your data for advertising and we do not train AI models on it. The AI models run on the box.
The laws we design for
EDU54 is sold across Africa, starting with English-speaking countries. These are the main laws schools raise with us. This is a plain summary, not legal advice; please check with your own adviser.
| Country | Law and regulator | Points that matter for schools |
|---|---|---|
| Nigeria | Nigeria Data Protection Act 2023 and the General Application and Implementation Directive (GAID) 2025. Nigeria Data Protection Commission (NDPC). | A child is anyone under 18: processing a child's data needs consent from a parent or guardian, unless another lawful basis applies. Controllers of major importance must register with the NDPC. Breaches likely to cause risk must be reported to the NDPC within 72 hours. |
| Ghana | Data Protection Act 2012 (Act 843). Data Protection Commission. | Data controllers, including schools, must register with the Data Protection Commission. Processing a child's data generally needs a parent or guardian's consent. Data must be kept secure and no longer than needed. |
| Kenya | Data Protection Act 2019. Office of the Data Protection Commissioner. | Education institutions processing personal data must register. Children's data needs parental consent and must be processed in the child's best interests. |
| South Africa | Protection of Personal Information Act (POPIA). Information Regulator. | Children's information needs a competent person's consent or another listed ground. Responsible parties must appoint an information officer. |
| EU and UK | General Data Protection Regulation (GDPR) and UK GDPR. | Applies to institutions in Europe or offering services to people there. Requires a written processor agreement (Article 28), privacy notices and breach reporting within 72 hours. The UK Children's Code also applies to online services likely to be used by children. |
| United States | FERPA and COPPA. | For US schools, we act under the school's direct control as a "school official", and the school can authorise collection for educational use under COPPA. |
What your institution should do
- Register with your data protection authority if the law requires it (for example the NDPC in Nigeria or the Data Protection Commission in Ghana).
- Tell people: add EDU54 to the privacy notice you give students, parents and staff. We can give you wording.
- Get consent where needed: for students under 18 in Nigeria, and for children elsewhere, collect any parent or guardian consent your law and policies require.
- Name safety contacts who will act on safety alerts.
- Set retention: confirm how long tutor conversations are kept, in the admin settings.
- Keep the box secure: a locked, ventilated place; strong admin passwords; regular backups kept safely.
- Remove leavers and handle requests using the export and delete tools.
Agreements we will sign
On request we provide, for your records or your data protection officer:
- a data processing agreement covering our setup and support access, in line with the Nigeria Data Protection Act, the GDPR and similar laws;
- a one-page data inventory and data flow for the box;
- wording for your privacy notice to students, parents and staff;
- written confirmation of data return and deletion if a box is returned to us for repair or at the end of its use.
Ask at [email protected].
If something goes wrong
If we become aware of a security incident affecting personal data on your box or in our systems, we will tell your institution without undue delay, with what we know, what we are doing about it, and what you may need to do. That lets you meet your own deadlines (72 hours to the regulator in Nigeria, under the GDPR and in several other countries).
If you suspect a problem, contact [email protected] straight away.