Data Processing Addendum

Effective date: 01-09-2026 Parties: Techvilla Technologies Ltd, trading as SchoolRev ("Processor") and the subscribing school/organisation ("Controller")

1. Purpose and precedence

This Data Processing Addendum (DPA) is incorporated into the SchoolRev customer agreement. It governs Processor’s processing of personal data for Controller through the SchoolRev service. If it conflicts with the customer agreement on personal-data processing, this DPA prevails to that extent.

2. Processing instructions

Processor will process personal data only on Controller’s documented instructions, including use of the service and support requests, unless required by applicable law. If law requires processing, Processor will inform Controller unless prohibited. Controller warrants that its instructions and data collection are lawful.

3. Processing details

Item	Description
Subject matter	Provision, security, support, maintenance and improvement of the SchoolRev service.
Duration	Subscription term plus the documented export/deletion period, unless law requires longer retention.
Nature/purpose	Secure school-revenue administration, invoicing/instructions, payment-confirmation evidence, verification workflows, receipts, reporting and authorised support.
Data subjects	Authorised school staff, school contacts, students, parents/guardians and other persons whose records the Controller lawfully enters.
Data types	Identity/contact, school/role, student, guardian, invoice, payment-confirmation, receipt, audit and support data; sensitive data only if Controller lawfully instructs and the service supports it.

4. Processor obligations

Processor will maintain appropriate technical and organisational safeguards; ensure authorised persons are bound by confidentiality; assist Controller reasonably with data-subject requests, security, impact assessments, consultations and breach obligations; keep records as required; and permit reasonable audit/assurance arrangements that protect other customers’ security and confidentiality.

Processor will notify Controller without undue delay after becoming aware of a personal-data breach affecting Controller data, provide available relevant information, and cooperate reasonably with Controller’s response. Processor will not make a regulatory or data-subject notification for Controller unless legally required or authorised by Controller.

5. Controller obligations

Controller is responsible for determining lawful bases, providing notices, obtaining consent where needed, responding to data-subject requests, configuring roles/access, checking data accuracy, protecting credentials, and ensuring an appropriate legal basis for any child or sensitive data. Controller must not use the service to make solely automated decisions with legal or similarly significant effects unless lawfully permitted and appropriately safeguarded.

6. Subprocessors and transfers

Controller authorises Processor to use the subprocessors, subject to written terms imposing data-protection obligations no less protective than this DPA. Processor will give [NOTICE PERIOD] notice of a material new subprocessor and provide Controller a reasonable opportunity to object on legitimate data-protection grounds. International transfers require an applicable lawful mechanism and safeguards under Nigerian law.

7. Return/deletion

At the end of the service, Controller may export its data using available service functionality during [EXPORT PERIOD]. Processor will delete or return Controller personal data within [DELETION PERIOD], except where retention is required by law, necessary for legitimate security/audit records, or otherwise documented.

8. Contacts and signatures

Controller privacy contact: schoolrev@thetechvilla.com Processor privacy contact: legal@thetechvilla.com