Our commitment to responsible, lawful, and transparent data processing. This policy governs how EduSphere Cloud protects institutional and personal data.
This Data Protection Policy applies to all entities that access or process data through EduSphere Cloud. It complements our Privacy Policy and sets out the governance framework for data protection across our platform. Schools using EduSphere Cloud are considered Data Controllers, while Soloz Technologies acts as a Data Processor on their behalf.
Soloz Technologies is committed to processing data in line with applicable data protection legislation and ensuring that all personal data is handled responsibly throughout its lifecycle.
We recognize that data protection is not merely a legal obligation — it is a fundamental right of individuals. Educational data in particular is highly sensitive, covering students who may be minors, and we treat it with the utmost care and responsibility.
This policy applies to:
All personal data processed through EduSphere Cloud is handled in accordance with the following principles:
Data is processed only where there is a legitimate lawful basis and in a manner that is transparent to individuals.
Data is collected for specified, explicit, and legitimate purposes and never processed in ways incompatible with those purposes.
We collect only the data that is necessary and relevant for the specific purpose of delivering school management services.
Reasonable steps are taken to ensure personal data is accurate, kept up to date, and corrected when necessary.
Data is retained only for as long as necessary for the purposes for which it was collected, then securely deleted.
Data is protected using appropriate technical and organizational measures against unauthorized processing, loss, or damage.
EduSphere Cloud processes personal data under the following lawful bases:
| Processing Activity | Lawful Basis |
|---|---|
| Account creation & authentication | Contract performance |
| Student record management | Legitimate interests / Legal obligation |
| Fee processing & financial records | Contract performance / Legal obligation |
| Attendance & academic tracking | Legitimate interests of the school |
| Platform analytics & improvement | Legitimate interests (anonymized) |
| Security monitoring & audit logs | Legitimate interests / Legal obligation |
| Marketing communications (to schools) | Consent / Legitimate interests |
A Data Processing Agreement (DPA) is available to schools requiring formal documentation of our processor relationship. Contact privacy@edusphere.cloud to request a DPA.
We implement a defense-in-depth security strategy across our platform:
In the event of a confirmed or suspected data breach, we follow a structured response procedure:
Identify and confirm the scope of the incident
Isolate affected systems and stop further exposure
Alert affected schools within 72 hours
Fix root cause and implement improvements
Schools are responsible for notifying affected individuals and relevant regulatory authorities (where required) upon receiving our breach notification. We will provide all necessary information to support this process.
To report a suspected security incident, contact our security team immediately at security@edusphere.cloud. Do not report security vulnerabilities publicly.
EduSphere Cloud is primarily designed for operation within Africa and similar jurisdictions. Where data is stored or processed by infrastructure providers in other countries, we ensure appropriate safeguards are in place:
Schools with specific data residency requirements should contact us to discuss available options.
We work with a limited number of trusted third-party processors to deliver our services. All third-party processors are:
| Processor Type | Purpose | Data Shared |
|---|---|---|
| Cloud Hosting Provider | Platform infrastructure & storage | All platform data (encrypted at rest) |
| Payment Gateway (Flutterwave) | Subscription billing processing | Billing contact & transaction amounts only |
| Email Service Provider | System notifications & alerts | Email addresses only |
We do not share student academic or personal data with any third-party processor beyond those required to run the platform infrastructure.
All Soloz Technologies employees who may access institutional data are required to:
Access to production data is strictly limited to authorized personnel on a need-to-know basis, with additional controls for any access to live institutional data.
If you believe your data protection rights have been violated or this policy has not been followed, you have the right to:
We take all complaints seriously and will respond within 30 business days. Where violations are confirmed, we will take prompt corrective action and inform affected parties accordingly.