Effective Date: 1/8/2026

This Data Processing Agreement ("DPA") forms part of the agreement between RUSHDAH INNOVATIVE RESOURCE LTD., operating SchoolFlow ERP ("SchoolFlow", "Processor") and the subscribing school, educational institution or organisation ("Customer", "Controller").

1. Purpose

This DPA governs the processing of personal data by SchoolFlow on behalf of the Customer in connection with the SchoolFlow ERP service.

2. Roles

The Customer determines the purposes and means of processing Customer Data and generally acts as the Data Controller.

SchoolFlow acts as Data Processor where it processes personal data on the Customer's documented instructions.

The parties acknowledge that their roles may differ for particular processing activities where applicable law requires a different classification.

3. Processing Instructions

SchoolFlow will process personal data only:

• to provide the SchoolFlow service;
• on the Customer's documented instructions;
• as necessary to maintain and secure the Service;
• as necessary to comply with applicable law; and
• as otherwise permitted by this DPA.

4. Categories of Data

Depending on Customer configuration, personal data may include:

• identification information;
• contact information;
• student information;
• academic information;
• attendance information;
• behavioural or activity information;
• parent/guardian information;
• teacher/staff information;
• financial and fee information;
• authentication information;
• technical information; and
• other information submitted by the Customer.

5. Categories of Data Subjects

Data subjects may include:

• students;
• prospective students;
• parents;
• guardians;
• teachers;
• school administrators;
• employees;
• contractors;
• suppliers;
• customers; and
• other individuals whose information the Customer submits.

6. Sensitive and Special Categories

The Customer must not submit sensitive or special-category personal data unless SchoolFlow expressly supports such processing and the Customer has a lawful basis for doing so.

Where such information is processed, the parties will implement additional safeguards required by applicable law.

7. Confidentiality

SchoolFlow will ensure that persons authorised to process Customer Data are subject to appropriate confidentiality obligations.

8. Security

SchoolFlow will maintain appropriate technical and organisational security measures proportionate to the risks associated with processing.

Measures may include:

• access control;
• authentication;
• encryption;
• secure infrastructure;
• monitoring;
• logging;
• backup procedures;
• incident response;
• vulnerability management; and
• business continuity measures.

9. Subprocessors

The Customer authorises SchoolFlow to engage subprocessors necessary to provide the Service.

SchoolFlow will maintain reasonable oversight of subprocessors and require appropriate contractual obligations concerning security and confidentiality.

A current list of material subprocessors may be made available through the SchoolFlow website or upon request.

10. International Data Transfers

Where personal data is transferred internationally, SchoolFlow will implement applicable safeguards required by relevant data-protection law.

11. Data Subject Requests

Taking into account the nature of processing, SchoolFlow will provide reasonable assistance to the Customer in responding to data-subject requests where technically and legally appropriate.

The Customer remains responsible for responding to data subjects as the controller unless applicable law provides otherwise.

12. Security Incidents

SchoolFlow will notify the Customer without undue delay after becoming aware of a confirmed personal-data breach affecting Customer Data.

The notification will contain information reasonably available to SchoolFlow concerning:

• the nature of the incident;
• affected systems or data;
• known or reasonably suspected consequences;
• containment measures; and
• remediation steps.

13. Regulatory Assistance

Where reasonably necessary, SchoolFlow will provide information required to demonstrate compliance with applicable processor obligations, subject to confidentiality and security restrictions.

14. Audits

The Customer may request reasonable information concerning SchoolFlow's security and privacy practices.

Audits must:

• be reasonable in scope;
• occur during normal business hours;
• respect confidentiality;
• not compromise other customers' information;
• not disrupt SchoolFlow operations; and
• be conducted at the Customer's expense unless otherwise agreed.

15. Data Retention

SchoolFlow will retain Customer Data for the duration of the subscription and for any additional period required by law or agreed under the applicable service terms.

16. Return and Deletion

Following termination, SchoolFlow will provide reasonable mechanisms for Customer Data export where technically available.

After the applicable retention period, Customer Data will be deleted or anonymised unless retention is legally required.

17. Customer Responsibilities

The Customer must:

• establish an appropriate lawful basis for processing;
• provide required privacy notices;
• obtain required consents;
• maintain appropriate user access controls;
• use the Service lawfully;
• provide lawful processing instructions; and
• ensure that Customer Data does not violate third-party rights.

18. Data Protection Laws

This DPA is intended to support compliance with applicable data-protection legislation, including, where applicable, the Nigeria Data Protection Act 2023 and relevant international data-protection laws.

The NDPC's framework expressly provides for regulation of personal-data processing and protection of data-subject rights.

19. Conflict

If this DPA conflicts with the SchoolFlow Terms of Service concerning data protection, this DPA will prevail to the extent of the conflict.

20. Contact

Privacy/Data Protection:

support@schoolflow.ng

RUSHDAH INNOVATIVE RESOURCE LTD.

Office 237 18 Young St, Unit Lge,
Edinburgh, Scotland,
United Kingdom, EH2 4JB