Organisations processing personal data of more than the NDPC's prescribed threshold of data subjects, or processing certain categories of sensitive data, are required to register with the NDPC as a Data Controller or Processor of major importance. AariNAT tracks its school and student count against this threshold and will complete NDPC registration before scaling past its early-stage rollout, as reflected in our internal roadmap.
| Area | Measure |
|---|---|
| Infrastructure | Google Firebase (Firestore) — encrypted in transit (TLS) and at rest by the provider |
| Access control | Role-based access in the School Portal (Principal / Bursar / Class Teacher / Subject Teacher); fee data hidden from teaching staff |
| Admin access | Command Center restricted by admin password; only AariNAT staff hold this |
| Offline caching | Data cached locally on-device for offline use; cleared on logout |
| Payment data | Processed by licensed processor (Kora/Korapay); AariNAT does not store card or bank credentials |
| Backups | Firestore's built-in redundancy; admin-level manual export available on request |
Most data subjects in the Student module are minors. In line with NDPA requirements around children's data:
Data is hosted on Google Firebase, which may process data on servers outside Nigeria. The NDPA permits cross-border transfer where the recipient country/organisation provides an adequate level of protection, or where appropriate safeguards (such as standard contractual clauses) are in place. Google maintains globally recognised security and privacy certifications and standard data-processing terms that we rely on to meet this requirement. We continue to monitor NDPC guidance on approved transfer mechanisms as the regulatory framework matures.
Active-subscription data is retained for the life of the subscription. Following termination, data is retained for 24 months for account-recovery and record-keeping purposes, after which it is deleted or anonymised. Schools or individuals may request earlier deletion, subject to any legal retention obligation.
In the event of a data breach involving personal data likely to result in risk to affected individuals, AariNAT will notify the NDPC within the timeframe required by the NDPA and inform affected schools without undue delay, so schools can in turn notify affected parents/guardians as appropriate.
As AariNAT scales (per our staged rollout plan), we will conduct data protection impact assessments for new features that materially increase data-processing risk (e.g. biometric attendance, expanded payment integrations) before launch.
Email: aarinat.company.limited@gmail.com
Phone/WhatsApp: +234 814 507 3941
NDPC: ndpc.gov.ng