CASA is built for schools. We do not sell student, guardian or staff personal data. Schools generally decide why student and school records are processed, while CASA provides technology used to process those records on their instructions. Facial verification is used only for authorised identity and attendance workflows and is subject to additional controls described below.
1. Who we are
CASA School ("CASA") provides school-operations technology for student registry, identity, attendance, access administration, student credentials and authorised communications. This Policy covers the CASA platform and the public website at casaschool.com.ng.
2. Our role and the school's role
The legal role CASA plays depends on the processing activity. For information a school places in CASA to operate its institution, the school will ordinarily determine the purposes of processing and CASA will process that information on the school's documented instructions, subject to applicable law and contractual terms.
CASA may act as a data controller for limited information it determines how and why to process itself, including business contact information, account administration, security logs, service support, website enquiries and information required to operate, secure and improve the service.
3. Personal data we may process
- student identity, date of birth, class, campus and enrolment details;
- parent or guardian names, relationships, contact details and notification preferences;
- attendance, arrival, departure, absence and authorised exception records;
- staff identity, role, account, authentication, access and audit information;
- student-card information and credential lifecycle records;
- facial verification data where an authorised biometric feature is enabled;
- device, security and technical information necessary to protect and support the platform;
- communications and support records.
4. Children's and students' data
CASA is designed for use by schools and therefore may process personal data relating to children. Children's information requires heightened protection. Schools are responsible for establishing an appropriate lawful basis, providing required privacy information and obtaining or verifying parental or guardian consent where consent is required by applicable law.
Where biometric or other sensitive personal data of a child is used, the school must ensure that the additional legal, governance, necessity, proportionality, consent and data-protection-impact requirements applicable to that processing have been satisfied before enabling the relevant CASA feature.
5. Why personal data is used
- provide and administer CASA services requested by a school;
- maintain student, guardian and staff records;
- authenticate users and enforce role-based access;
- record and manage attendance and school-presence events;
- verify identity where an authorised biometric feature is enabled;
- manage student credentials and cards;
- send authorised operational notifications to eligible recipients;
- prevent misuse, investigate incidents and protect service security;
- provide support and comply with legal obligations.
6. Lawful bases
Processing must have a lawful basis under applicable data-protection law. Depending on the activity, this may include contract, legal obligation, legitimate interests, consent or another lawful basis recognised by law. Where consent is required, the relevant controller must ensure that consent is valid, informed, specific and capable of being demonstrated, including age and parental-authorisation requirements.
7. Biometrics and facial identity verification
Where a school enables facial verification, CASA uses it for authorised student identity and attendance workflows. The ordinary attendance flow identifies the student from the student credential, performs a live facial-verification check, compares the current face against the student's enrolled biometric profile, and records attendance only when the required checks and attendance rules are satisfied.
CASA currently uses Amazon Rekognition for face liveness and facial matching. A short live camera capture is processed by Amazon Rekognition. The service returns a liveness confidence result and a reference image used for face comparison or enrolment. CASA's current configuration does not request audit images from the liveness session.
CASA does not store the raw liveness video or the ordinary verification reference image as a permanent student photograph in its application database. A current verification image may be held transiently during the verification transaction and displayed to an authorised attendance terminal. CASA's database stores the biometric provider reference, profile status, timestamps, verification identifiers, confidence results and related security or audit records. Amazon Rekognition stores an indexed mathematical face representation and associated face metadata in a school-scoped face collection; the indexed collection does not store the original image bytes.
If liveness or face matching does not satisfy CASA's configured verification rules, the biometric attendance path is rejected and the failed check does not by itself create a successful attendance event. The school may retry the verification or, where CASA provides an authorised supervised or exception workflow and school policy permits it, use that process for staff-reviewed attendance handling. A failed biometric result is not intended to be treated as proof that a student is absent or as a disciplinary conclusion.
Biometric processing is probabilistic and may produce false accepts or false rejects. Schools must keep appropriate human oversight and must not use CASA facial verification for unrelated surveillance, advertising, discriminatory profiling or covert monitoring.
Access to biometric operations and records is limited to authorised school personnel, authorised CASA personnel where operational support or security requires it, and service providers acting for the authorised purpose. CASA uses role and scope controls intended to prevent access outside the relevant school or authorised operational role.
CASA does not apply one universal fixed retention period to every biometric record because schools may have different contractual, legal and record-retention obligations. Liveness sessions are short-lived operational sessions. Active face representations and related profile references are retained while needed for the authorised service and applicable school instructions. When a student is re-enrolled biometrically, the previous biometric profile is revoked and CASA attempts to delete the previous Amazon Rekognition face representation. Other biometric records, verification evidence and audit records may be retained for integrity, security, accountability, dispute handling or legal requirements. When the school relationship or relevant processing purpose ends, deletion or return is handled in accordance with the service agreement, the school's lawful instructions and applicable law.
8. Notifications and communications
When a school enables communications, CASA may use email, push notifications or communications providers such as the WhatsApp Business Platform to deliver authorised operational messages. The school determines which eligible recipients should receive notifications and is responsible for accurate destination details and lawful use of the communication channel. Delivery may depend on the recipient device, network and third-party provider.
9. Sharing and service providers
CASA does not sell personal data. We may use service providers for cloud hosting, databases, communications, security, email, identity and biometric verification and technical support. This includes Amazon Web Services and Amazon Rekognition for the biometric functions described above, and may include other providers such as Google and Meta where the relevant service is enabled. Providers are used only for authorised operational purposes and are subject to applicable contractual and security safeguards.
10. International transfers
Some technology providers may process or store information outside Nigeria. Where an international transfer is subject to the Nigeria Data Protection Act 2023 or other applicable law, the responsible controller must ensure that the transfer is supported by a lawful transfer mechanism or other recognised safeguard.
11. Security
CASA applies technical and organisational measures intended to protect personal data against unauthorised access, alteration, disclosure, loss and misuse, including scoped access controls, audit records and security controls around sensitive operations. No internet-connected system can be guaranteed to be absolutely secure.
12. Retention, return and deletion
Personal data is retained only for as long as reasonably necessary for the authorised purpose, required by a school's lawful instructions or applicable contract, or required for security, accountability, dispute handling or legal obligations. When a school's service ends, CASA will handle return, export and deletion in accordance with the service agreement, applicable law and any retention that remains legally or operationally necessary. Residual copies may remain temporarily in protected backups or logs until ordinary retention cycles expire.
13. Data-protection rights
Subject to applicable law, individuals may have rights to be informed, request access, correction, deletion, restriction, objection, portability and protection from certain solely automated decisions, and may complain to the Nigeria Data Protection Commission. Where CASA processes a school record only on the school's instructions, the request may need to be handled by that school, with CASA providing reasonable assistance where required.
14. Public website and cookies
CASA's public website may process ordinary technical information required to deliver the website securely. CASA does not currently rely on non-essential advertising cookies on this public website. If analytics, advertising or other non-essential tracking is introduced, this Policy and any required consent controls should be updated before use.
15. Data incidents
CASA maintains procedures for assessing suspected personal-data incidents. Where notification is required by applicable law, CASA and the relevant school will cooperate to make required notifications within the applicable timeframe.
16. Nigerian data-protection law
This Policy is intended to support compliance with the Nigeria Data Protection Act 2023 and applicable regulations, guidance and other Nigerian privacy requirements. Nothing in this Policy limits any right that cannot lawfully be limited.
17. Changes
CASA may update this Policy as the service, law or processing practices change. The latest version will be published on this page with an updated revision date.
18. Contact and complaints
For privacy questions or requests, contact casaschools1@gmail.com, 0807 946 0647 or 0704 139 8709. Individuals may also raise a complaint with the Nigeria Data Protection Commission where applicable.