Data Protection & Statutory Compliance Charter
Institutional legal and technical charter safeguarding student, family, and faculty records across global deployments. Certified compliance with Ghana Act 843, Nigeria NDPR/NDPA, UEMOA directives, UK/EU GDPR, and FERPA/COPPA principles.
1. Core Principles of Data Governance
Throughout all operations of the Encore SMS cloud infrastructure, the processing of personal data belonging to educational institutions is governed by six fundamental tenets:
Data is strictly processed for the administration, pedagogy, health oversight, and physical safety of the contracting school.
Only information strictly necessary for academic progression, family communications, and statutory reporting is collected.
Guardians and students can inspect and rectify contact profiles and emergency numbers in real-time through verified self-service.
Cryptographic database isolation via PostgreSQL Row Level Security; AES-256 at rest and TLS 1.3 in transit.
2. Data Controller vs. Data Processor Architecture
A strict statutory boundary is established under global data protection jurisprudence:
The institution maintains exclusive proprietary ownership of all pupil rosters, fees, and marks. The school alone determines what data is collected, for which term, and governs parental authorizations.
Encore SMS processes data strictly upon the verified programmatic instructions of the school. We never monetize, aggregate, sell, or profile student data for third-party advertising or commercial brokerage.
3. Regional Statutory Alignment
- Ghana — Data Protection Act 2012 (Act 843): Full compliance with the Data Protection Commission (DPC) standards for independent academies and GES/CAIE institutions.
- Nigeria — Nigeria Data Protection Act 2023 (NDPA / NDPR): Strict enforcement of NDPC mandates regarding minor consent, encrypted auditability, and sovereign regional processing.
- UEMOA & Côte d'Ivoire — Loi n° 2013-450: Guaranteed compliance with West African Francophone data protection charters governing private and international schools.
- UK & European Union — UK DPA 2018 & EU GDPR (2016/679): Gold-standard compliance guaranteeing data subject rights, right to data portability, and robust Standard Contractual Clauses.
4. Individual Data Subject Rights
Every parent, adult student, and faculty member retains enforceable rights under our platform architecture:
5. Incident Response & 72-Hour Breach SLA
Encore SMS maintains a zero-compromise incident protocol. In the event of a verified or suspected security vulnerability impacting tenant data, our technical team is bound by SLA to notify designated school leadership within 72 hours with forensic telemetry and mitigation countermeasures.
6. Educational Cloud & Google Workspace Integration
When schools connect Google Workspace for Education and Google Classroom, pupil identities (name, class section, institutional email) and homework marks are synchronized strictly for instructional purposes. All OAuth 2.0 credentials and refresh tokens are encrypted at rest using AES-256-GCM cryptographic vaults. In strict conformance with the Google Classroom API Terms of Service, student data is never used for commercial profiling or advertising. Institutions maintain full autonomy to revoke permissions and purge credentials at any time from the Integrations Hub.