Privacy Policy

1. In short

Cosine helps schools bill and collect fees. To do that we handle personal information about schools, their staff, the parents and guardians who pay fees, and the students the fees relate to.

• We do not sell personal information.
• We do not use student information for advertising, marketing, or profiling.
• Schools decide what student and guardian information goes into Cosine. We handle it on their instructions.
• We do use payment information to work out who paid what, to send reminders, and to run our business.

This policy explains the detail. If anything here is unclear, write to security@trycosine.com and we will explain it.

---

2. Who we are

Cosine Technologies Limited provides the Cosine platform and mobile applications (the "Services").

Where this policy says "we", "us", or "our", it means Cosine Technologies Limited and, where relevant, its parent company and affiliates.

Data protection contact: security@trycosine.com

We are subject to the Nigeria Data Protection Act 2023 ("NDPA") and the directives and guidance issued under it by the Nigeria Data Protection Commission ("NDPC").

---

3. Who this policy is for

This policy applies to:

---

4. Our role: controller or processor

This distinction matters, because it decides who you go to with a question about your information.

Your school is in charge of student and guardian records. When a school uploads student information, enrolment records, guardian contact details, or attendance data, the school decides what is collected and why. In legal terms the school is the data controller and we are the data processor. We handle that information only on the school's instructions.

If you are a parent or student and you want your records corrected or deleted, ask your school first. We will help them, but we cannot change or delete a school's records on our own initiative. See section 11.

We are in charge of some things ourselves. We are the data controller, deciding for ourselves what to collect and why, when we:

• register and verify schools and their directors;
• prevent fraud, money laundering, and abuse of the Services;
• bill schools and keep our financial records;
• keep the Services secure and working;
• communicate with users about the Services; and
• comply with our own legal obligations.

---

5. What we collect

5.1 From schools and their staff

• Organisation name, address, registration details, and the sector you operate in
• Names, work email addresses, phone numbers, and roles of the people you give access to
• Login credentials and authentication data
• Identity and verification documents for directors and beneficial owners, where required by law or by our payment partners
• Bank account details for settlement
• Records of your activity in the Services, including logins, actions taken, and IP address
• Correspondence with our support and complaints team

5.2 About parents, guardians, and payers

Most of this comes from your school, not from you directly.

• Name, email address, phone number, and postal address
• Relationship to the student
• Invoices issued to you, amounts due, and payment history
• The name, bank, and account details that appear on payments you send, as provided by your bank
• Records of reminders we sent and how you responded
• Correspondence with us, including any payment arrangement discussed

5.3 About students

This comes from your school.

• Name, date of birth, sex, and photograph
• Student identifier, class, and enrolment records
• Attendance records
• Assessment results and report cards
• Link to the guardian or payer responsible for fees
• Fee and payment history

We do not collect health, medical, dietary, biometric, religious, or disciplinary information about students. The Services provide no field for it, and schools are contractually prohibited from entering it.

5.4 From website visitors

• Pages visited, referring page, approximate location derived from IP address
• Browser and device type
• Anything you send us through a contact form or by email

---

6. Why we use it, and our lawful basis

Under the NDPA we need a lawful basis for everything we do with personal information. Here is ours.

We do not send marketing to parents, guardians, or students.

Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights. You can ask us for a summary of that assessment at security@trycosine.com.

---

7. Students and children

The Services hold records about students, most of whom are under 18.

What your school is responsible for. Under section 31 of the NDPA, processing a child's personal information generally requires the consent of a parent or legal guardian. Your school is responsible for obtaining that consent, verifying it came from someone with parental responsibility, and telling you what it collects and why. Schools warrant to us in writing that they have done this.

What we commit to.

• We use student information only to run the school's fee billing, collection, and school management functions.
• We never use student information for advertising, marketing, or behavioural profiling.
• We never sell student information or share it with anyone for their own marketing.
• We do not disclose student information to anyone other than the sub-processors listed in our Sub-processor List, or where the law requires it.
• Where enrolment and payment history is used to assess a school for credit, it is aggregated at school level. No individual student's academic, attendance, or behavioural record is used.
• We apply the same security to student information as to everything else.

If you are a parent and you object to how your child's information is being handled, contact your school first, since the school decides what is recorded. You can also write to us at security@trycosine.com, and you can complain to the NDPC.

---

8. Who we share it with

We share personal information with:

Our sub-processors. Companies that help us run the Services, listed with their location and purpose in our Sub-processor List. They act on our instructions and cannot use the information for their own purposes.

Your school, if you are a parent, guardian, or student. Payment and enrolment information is visible to the school's authorised staff.

Payment and banking partners, to provide collection accounts, receive funds, and settle them. These partners are licensed and regulated in Nigeria and are subject to their own legal obligations.

Lending and fund partners, only where a school applies for a credit facility or enables a scholarship feature. These partners decide for themselves how to use what they receive and have their own privacy notices.

Professional advisers, such as auditors, lawyers, and insurers, where they need it and are bound by confidentiality.

Regulators, law enforcement, and courts, where we are legally required to disclose, or where disclosure is necessary to establish or defend a legal claim, prevent fraud, or protect someone's safety.

A buyer or investor, if we are involved in a merger, acquisition, financing, or sale of assets. We would require them to protect the information in line with this policy.

We do not sell personal information, and we do not share it with advertisers or data brokers.

---

9. Where your information is processed

Our main database and file storage are hosted in Stockholm, Sweden. Our web application is hosted in the United States. Our email delivery provider is in the United States. Our payment partner processes data in Nigeria. The full picture is in our Sub-processor List.

Transferring personal information out of Nigeria is permitted under sections 41 to 43 of the NDPA where appropriate safeguards are in place. We rely on binding written contracts with each provider that require them to protect the information to a standard substantially equivalent to the NDPA, including, where the provider is in the European Union, the European Commission Standard Contractual Clauses.

We keep records of these safeguards and of our assessment of each receiving country. You can request a summary at security@trycosine.com.

---

10. How long we keep it

Where we no longer need information but cannot yet delete it, we restrict it so it is not actively used.

---

11. Deleting your account and your data

If you are a school. You can close your account at any time under clause 21 of the Terms of Service. Write to hello@trycosine.com. After the export period, we delete or anonymise your data subject to the retention periods in section 10.

If you are a school's staff user. Ask your school administrator to remove your access. We delete your user record when the school instructs us to, or when the school's account closes.

If you are a parent, guardian, or student. Your records belong to your school's account. Contact your school first, since they decide what is held and are the only ones who can instruct us to delete it. If you cannot reach your school, or the school does not act, write to security@trycosine.com and we will contact the school on your behalf and tell you the outcome.

What we cannot delete. We are required by law to keep financial and transaction records, and identity records used for anti-money laundering checks, for the periods in section 10. We keep these even after an account closes, and we do not use them for anything else.

How to request deletion of a mobile app account. Email security@trycosine.com from the address on the account, with the account name and the school it belongs to. We will acknowledge within 2 business days and complete or explain the outcome within 30 days.

---

12. Your rights

Under the NDPA you have the right to:

• be told how your information is used, which is what this policy does;
• access the personal information we hold about you;
• correct information that is wrong or incomplete;
• delete information where there is no lawful reason for us to keep it;
• restrict how we use your information while a concern is being resolved;
• object to processing based on legitimate interests, including any direct marketing;
• portability, meaning a copy of information you gave us in a usable format; and
• withdraw consent at any time, where we relied on consent. This does not affect what we did before you withdrew it.

How to exercise them. Write to security@trycosine.com. Tell us what you want and enough detail for us to find your records. We may ask you to confirm your identity, so we do not disclose someone else's information by mistake.

We will respond within 30 days. If your request is complex we will tell you and explain why we need longer. We do not charge for this, unless a request is repetitive or excessive, in which case we will tell you the cost before doing the work.

If your request concerns records held by a school, we will pass it to the school, since they decide, and tell you we have done so.

---

13. Cookies and similar technologies

Our website and applications use cookies and similar technologies.

Strictly necessary. Needed for the Services to work: keeping you signed in, securing your session, remembering your preferences, and balancing traffic. These cannot be switched off, and we do not need your consent for them.

Analytics. Where we use analytics, we ask for your consent first, and you can decline without losing access to anything.

We do not use advertising cookies, and we do not allow third parties to track you across other websites through our Services.

Managing cookies. You can change your choice at any time through the cookie settings link on our website, or through your browser settings. Blocking strictly necessary cookies will stop parts of the Services from working.

---

14. How we protect it

We use technical and organisational measures appropriate to the risk, including encryption of data in transit and at rest, role-based access control, database-level isolation between organisations, multi-factor authentication on administrative access, least-privilege access for our staff, audit logging, encrypted backups, and a documented incident response procedure. The full list is in Annex 2 of our Data Processing Agreement.

No system is completely secure. If a breach occurs that is likely to affect you, we will notify the NDPC and, where required, the people affected, in line with section 40 of the NDPA.

Please help us by using a strong, unique password, enabling any additional security we offer, and telling us at security@trycosine.com if you think an account has been compromised.

Reporting a vulnerability. If you believe you have found a security vulnerability in our Services, please report it to security@trycosine.com. We will acknowledge your report and will not pursue action against researchers who report in good faith and do not access or alter other people's data.

---

15. Automated decisions

We use automated matching to work out which invoice an incoming payment relates to, based on the payer's name, the reference used, the amount, and the receiving account. This is a bookkeeping step and it is not always right. Schools can review and correct any attribution, and you can ask your school to check if a payment appears to have been misapplied.

We do not make automated decisions that produce legal or similarly significant effects about individuals. Credit assessments are made about schools, by lending partners, not about parents or students.

---

16. Changes to this policy

We may update this policy. When we make a material change, we will update the date at the top and notify schools by email or in-product notice at least 30 days before it takes effect. Continued use of the Services after that date means the updated policy applies.

Previous versions are available on request.

---

17. Complaints

If you are unhappy with how we have handled your information, write to security@trycosine.com. We will acknowledge within 2 business days and aim to resolve it within 30 days.

If you are still unsatisfied, you have the right to complain to the:

Nigeria Data Protection Commission Website: ndpc.gov.ng

If your concern is about a payment, a collection account, or a bank, you may also contact the Consumer Protection Department of the Central Bank of Nigeria.

---

18. Contact us

Cosine Technologies Limited