Data Processing Agreement (DPA) | SchoolHub Platform

Data Processing Agreement

Effective Date: March 17, 2026

This Data Processing Agreement (“DPA”) forms part of the agreement between SchoolHub (“Processor”) and the educational institution (“Controller”).

1. Roles

1
The School is the Data Controller
2
SchoolHub is the Data Processor

2. Scope of Processing

SchoolHub processes personal data only for:

Student management

Attendance tracking

Financial processing

Communication services

3. Types of Data Processed

Personal identification data
Academic records
Financial data
Biometric data (fingerprints, RFID authentication)

4. Purpose of Processing

Data is processed solely to:

Provide SchoolHub services
Ensure authentication and security
Support school operations

5. Processor Obligations

SchoolHub shall:

Process data only on documented instructions from the school
Ensure confidentiality of all data
Implement strong security measures
Notify the school of any data breach

6. Security Measures

We implement:

Encryption (data in transit and at rest)

Access control and authentication

Secure cloud infrastructure

Monitoring and logging systems

7. Sub-processors

SchoolHub may use third parties for:

Payment processing

SMS delivery

Cloud hosting

All sub-processors must meet data protection standards.

8. Data Subject Rights

SchoolHub assists schools in handling requests for:

Access

Correction

Deletion

Data portability

9. Data Retention and Deletion

Data is retained only as necessary
Upon termination, data may be deleted or returned to the school

10. Breach Notification

SchoolHub will notify the school without undue delay in case of:

Unauthorized access
Data leaks
Security incidents

11. Audit Rights

Schools may request reasonable audits or compliance verification.

12. International Transfers

Data may be stored in secure cloud environments outside Rwanda with adequate protection measures.

13. Liability

Each party is responsible for its own compliance with applicable data protection laws.