CASA is built for schools. We do not sell student, guardian or staff personal data. Schools generally decide why student and school records are processed, while CASA provides the technology used to process those records on their instructions.
1. Who we are
CASA School (“CASA”, “we”, “us” or “our”) provides software and related technology services to educational institutions. CASA helps schools manage activities that may include student registration, attendance, identity verification, physical student cards, campus operations, staff access, academic administration and communications with authorised parents or guardians.
Privacy enquiries may be sent to casaschools1@gmail.com or made by telephone on 0807 946 0647 or 0704 139 8709.
2. Our role and the school’s role
The legal role CASA plays depends on the processing activity. For information a school places in CASA to operate its institution, the school will ordinarily determine the purposes of processing and CASA will process that information on the school’s documented instructions, subject to applicable law and contractual terms.
CASA may act as a data controller for limited information it determines how and why to process itself, including business contact information, account administration, security logs, service support, website enquiries and information required to operate, secure and improve the service.
3. Personal data we may process
- student identity, date of birth, class, campus and enrolment details;
- parent or guardian names, relationships, telephone numbers and notification preferences;
- attendance, arrival, departure, absence and early-departure records;
- staff identity, role, account, authentication, access and audit information;
- student-card information and credential lifecycle records;
- facial images or biometric information where an authorised identity-verification feature is enabled;
- device, security and technical information necessary to protect and support the platform;
- communications and support records.
4. Children’s and students’ data
CASA is designed for use by schools and therefore may process personal data relating to children. Children’s information requires heightened protection. Schools are responsible for establishing an appropriate lawful basis, providing required privacy information and obtaining or verifying parental or guardian consent where consent is required by applicable law.
Where biometric or other sensitive personal data of a child is used, the school must ensure that all additional legal requirements applicable to that processing have been satisfied before enabling the relevant CASA feature.
5. Why personal data is used
- provide and administer CASA services requested by a school;
- maintain student, guardian and staff records;
- authenticate users and enforce role-based access;
- record and manage attendance and school-presence events;
- verify identity where an authorised biometric feature is enabled;
- manage student credentials and cards;
- send authorised operational notifications to eligible guardians;
- prevent misuse, investigate incidents and protect service security;
- provide support and comply with legal obligations.
6. Lawful bases
Processing must have a lawful basis under applicable data-protection law. Depending on the activity, this may include contract, legal obligation, legitimate interests, consent or another lawful basis recognised by law. Where consent is required, the relevant controller must ensure that consent is valid, informed, specific and capable of being demonstrated, including age or parental-authorisation requirements.
7. Biometrics and identity verification
CASA may provide identity-verification functionality that uses a student’s facial image or derived biometric information. Such functionality is used only for authorised school identity and attendance purposes and not for advertising. Schools must satisfy applicable notice, consent, necessity, proportionality and data-protection-impact requirements.
8. WhatsApp and notifications
When a school enables messaging, CASA may use a communications provider such as the WhatsApp Business Platform operated by Meta to deliver authorised operational notifications to parents or guardians. The school determines which eligible guardians should receive notifications and is responsible for accurate destination details and lawful use of the messaging channel.
9. Sharing and service providers
CASA does not sell personal data. We may use service providers for cloud hosting, databases, communications, security, identity or biometric verification and technical support. Such providers are expected to process information only for authorised purposes and subject to appropriate safeguards.
10. International transfers
Some technology providers may process or store information outside Nigeria. Where an international transfer is subject to the Nigeria Data Protection Act 2023 or other applicable law, the responsible controller must ensure that the transfer is supported by a lawful transfer mechanism or other recognised safeguards.
11. Security
CASA applies technical and organisational measures intended to protect personal data against unauthorised access, alteration, disclosure, loss and misuse. No internet-connected system can be guaranteed to be absolutely secure.
12. Retention and deletion
Personal data is retained only for as long as reasonably necessary for the purpose for which it was collected, required by a school’s instructions or applicable contract, or required by law, security or legitimate record-keeping obligations.
13. Data-protection rights
Subject to applicable law, individuals may have rights to be informed, request access, correction, deletion, restriction, objection, portability and protection from certain solely automated decisions, and may complain to the Nigeria Data Protection Commission. Where CASA processes a school record only on the school’s instructions, the request may need to be handled by that school.
14. Public website and cookies
CASA’s public website may process ordinary technical information required to deliver the website securely. CASA does not currently rely on non-essential advertising cookies on this public website. If analytics, advertising or other non-essential tracking is introduced, this Policy and any required consent controls should be updated before use.
15. Data incidents
CASA maintains procedures for assessing suspected personal-data incidents. Where notification is required by applicable law, CASA and the relevant school will cooperate to make required notifications within the applicable timeframe.
16. Nigerian data-protection law
This Policy is intended to support compliance with the Nigeria Data Protection Act 2023 and applicable regulations, guidance and other Nigerian privacy requirements. Nothing in this Policy limits any right that cannot lawfully be limited.
17. Changes
CASA may update this Policy as the service, law or processing practices change. The latest version will be published on this page with an updated revision date.
18. Contact and complaints
For privacy questions or requests, contact casaschools1@gmail.com, 0807 946 0647 or 0704 139 8709. Individuals may also raise a complaint with the Nigeria Data Protection Commission where applicable.