Privacy Policy

01 Introduction

ClassNex is a school management software platform developed, owned, and operated by ProHub Digital Solutions

ClassNex provides educational institutions with technology and tools to manage students, guardians, users, school administration, academic information, financial information, payments, communications, and related educational and administrative activities.

We recognize that information handled through a school management platform can be highly personal and may include information relating to children, students, parents, guardians, teachers, employees, and other individuals.

This Privacy Policy explains how ProHub Digital Solutions, through the ClassNex platform, collects, uses, stores, protects, and discloses personal information.

ClassNex is intended for use by schools and educational institutions in Africa and other jurisdictions where the Service may be made available.

This Privacy Policy should be read together with the applicable school's own privacy notices, policies, agreements, data-protection obligations, and any applicable ClassNex Data Processing Agreement (DPA).

Because data-protection laws differ between African countries and may change over time, the rights, obligations, and requirements applicable to a particular school or individual may depend on the country in which the relevant processing takes place.

02 Important Relationship Between ProHub Digital Solutions, ClassNex, and Schools

In those circumstances, the school may act as the data controller, responsible party, or equivalent responsible entity under applicable law, while ProHub Digital Solutions, through ClassNex, may act as a data processor, service provider, operator, or equivalent entity processing information on behalf of the school, depending on the applicable jurisdiction and legal framework.

The school generally determines:

• what personal information is collected;
• why the information is collected;
• which individuals' information is entered into ClassNex;
• how that information is used for school administration;
• how long school records should be retained;
• which users should have access to the information; and
• the appropriate lawful basis for processing the information.

ClassNex provides role-based access controls designed to help schools control access to school information. Schools may assign users to the roles made available within ClassNex, based on the responsibilities of those users within the school.

The roles available in ClassNex may include:

• Super Administrators;
• System Administrators;
• Principals;
• Vice Principals;
• Registrars;
• Accountants;
• Bursars;
• Cashiers;
• Administrators;
• Class Teachers;
• Subject Teachers;
• Guardians; and
• other roles made available by ClassNex.

The permissions associated with these roles are defined and maintained by ClassNex. A school does not independently create or define the underlying permissions associated with a ClassNex role. By assigning a user to a role, the school provides that user with the permissions associated with that role as defined by ClassNex.

The current roles and their associated permissions are described in the official ClassNex product documentation, available at docs.classnex.com .

ClassNex may modify, add, remove, or otherwise update available roles and the permissions associated with those roles as the Platform evolves. The permissions available to a particular role may therefore change over time.

The school remains responsible for determining which individuals should receive access to its information, assigning users to appropriate ClassNex roles, reviewing user access periodically, and removing or disabling access when a user is no longer authorized to access the school's information.

The school is also responsible for reviewing the permissions associated with a role before assigning that role to a user. The school should ensure that the role selected is appropriate for the user's responsibilities and the level of access that the user should have.

ProHub Digital Solutions processes school information through ClassNex to provide, maintain, secure, support, and operate the Service and as otherwise permitted by applicable law and the applicable agreement with the school.

ProHub Digital Solutions may separately act as a data controller or equivalent responsible entity for information it collects directly for its own legitimate business purposes, including account administration, billing, security, customer support, marketing preferences, service improvement, legal compliance, fraud prevention, and operation of its business.

03 Personal Information We May Process

Depending on how ClassNex is configured and used by a school, ProHub Digital Solutions may process the following categories of personal information through the ClassNex platform.

3.1 Student Information

This may include:

• full name;
• student identification number;
• date of birth;
• gender where collected by the school;
• nationality where collected by the school;
• class, stream, track, and enrollment information;
• academic information;
• attendance information;
• assessment and academic performance information;
• grades and marks;
• report cards and other academic records;
• school-related documents;
• photographs where uploaded by the school;
• guardian relationships;
• student status, including enrollment, transfer, withdrawal, or graduation information; and
• other information reasonably necessary for legitimate school administration.

3.2 Guardian and Parent Information

This may include:

• name;
• email address;
• telephone number;
• address;
• relationship to the student;
• communication preferences;
• account credentials;
• invoices and account information;
• payment and transaction records;
• student relationships; and
• other information provided by or on behalf of the school.

3.3 Teacher, Staff, and Other User Information

This may include:

• name;
• email address;
• telephone number;
• employment or staff information where entered by the school;
• assigned role;
• permissions;
• class or subject assignments;
• login credentials and authentication information;
• account status;
• activity and audit logs; and
• other information entered into the Platform by or on behalf of the school.

3.4 Academic and School Administration Information

ClassNex may process information relating to:

• academic sessions;
• academic terms;
• classes;
• class streams;
• class tracks;
• subjects;
• class and subject assignments;
• student enrollment;
• attendance;
• assessments;
• grades and marks;
• report cards;
• assignments;
• academic records;
• student transfers;
• student withdrawals;
• student status;
• school notices;
• communications;
• documents; and
• other information used for legitimate educational and administrative purposes.

3.5 Financial Information

ClassNex may process information relating to:

• fee types;
• invoices;
• fees and charges;
• discounts;
• scholarships;
• payments;
• payment references;
• payment status;
• student balances;
• account transactions;
• refunds;
• expenses;
• school income;
• financial transactions; and
• payment-related communications.

ClassNex generally does not need to store a user's full payment-card number or card security code when payments are processed through an external payment provider.

3.6 School and Organization Information

ClassNex may also process information relating to the school or organization using the Platform, including:

• school name;
• contact information;
• address;
• academic structure;
• school configuration;
• subscription information;
• billing information;
• user and role configuration;
• payment configuration;
• communication settings; and
• other information necessary to administer the school's ClassNex account.

04 Information Collected Directly From Users

When you interact directly with ClassNex or ProHub Digital Solutions, we may collect:

• name;
• email address;
• telephone number;
• account credentials;
• organization or school information;
• support requests;
• communication records;
• device information;
• browser information;
• IP address;
• security and authentication information;
• logs relating to use of the Platform;
• information concerning account activity; and
• information necessary to operate and secure the Service.

The specific information collected will depend on how you interact with ClassNex and the functions you use.

05 How We Use Personal Information

ProHub Digital Solutions processes personal information in connection with ClassNex for different purposes depending on how the information is collected and our role in relation to that information.

Where a school provides personal information to ClassNex for school-management purposes, ProHub Digital Solutions generally processes that information on behalf of the school and in accordance with the school's lawful instructions, the applicable agreement, and applicable data-protection law.

Such processing may include:

• providing and operating ClassNex services;
• creating and managing user accounts;
• authenticating users;
• applying the roles and permissions defined by ClassNex to authorized users;
• providing school-management functionality;
• managing student and guardian information;
• supporting academic administration;
• managing enrollment and school records;
• managing financial information;
• processing or facilitating payment transactions through ClassNex and applicable third-party payment providers;
• generating invoices and receipts;
• recording financial transactions;
• sending service-related communications;
• providing customer and technical support;
• monitoring and maintaining system performance;
• maintaining the security and integrity of the Platform;
• detecting, preventing, and investigating fraud, abuse, and security threats;
• investigating and responding to Security Incidents;
• maintaining backups and business continuity measures;
• complying with legal and regulatory obligations applicable to ProHub;
• enforcing applicable agreements;
• resolving disputes;
• maintaining necessary business and operational records; and
• maintaining, developing, improving, and securing ClassNex.

The roles and permissions applied to users within ClassNex are defined and maintained by ClassNex. Schools determine which authorized users receive access and which available ClassNex roles are assigned to those users. The permissions associated with each role are not independently defined by the school.

Information about available ClassNex roles and their associated permissions is provided in the official ClassNex product documentation at docs.classnex.com .

ProHub Digital Solutions may also process certain personal information for purposes for which ProHub acts independently as a data controller or equivalent responsible entity. These purposes may include:

• account administration;
• customer and billing administration;
• security and fraud prevention;
• customer support and service administration;
• maintaining business and operational records;
• legal and regulatory compliance;
• enforcing our agreements and protecting our rights and property;
• service analytics and performance monitoring;
• improving and developing ClassNex;
• managing marketing preferences and communications where applicable; and
• other purposes described in this Privacy Policy or permitted by applicable law.

Where ProHub acts as a data controller or equivalent responsible entity, ProHub will determine the purposes and means of the relevant processing and will process the information in accordance with applicable data-protection law.

We may also create or use aggregated, statistical, anonymized, or appropriately de-identified information that does not reasonably identify an individual for purposes including:

• analytics;
• reporting;
• research;
• statistical analysis;
• security;
• performance monitoring;
• service improvement;
• product development;
• benchmarking; and
• other legitimate purposes permitted by applicable law.

We will not intentionally use identifiable student information or other identifiable School Data for unrelated commercial purposes. Where ProHub processes School Data on behalf of a school, such processing will remain subject to the school's lawful instructions, the applicable ClassNex agreement, and applicable data-protection law.

06 Legal Bases for Processing

Depending on the circumstances and applicable law, ProHub Digital Solutions or the relevant school may process personal information based on one or more lawful grounds.

These may include:

• performance of a contract;
• compliance with a legal obligation;
• legitimate interests;
• consent;
• protection of vital interests;
• performance of a task carried out in the public interest where applicable; or
• another lawful basis recognized under applicable law.

Where a school determines the purposes and means of processing information through ClassNex, the school is generally responsible for determining and documenting the appropriate lawful basis for the relevant processing activities.

ProHub Digital Solutions will process school data in accordance with the school's lawful instructions and the applicable contractual and legal requirements governing the relationship.

Because data-protection laws differ across African jurisdictions, the specific lawful basis applicable to a particular processing activity may vary by country.

07 Children and Student Information

We do not intend for students to independently create unauthorized school-management accounts.

Schools are responsible for ensuring that student information is collected and processed in accordance with applicable child-protection and data-protection requirements.

Schools should only provide ClassNex with information reasonably necessary for legitimate educational, administrative, financial, or other lawful purposes.

Where applicable law requires parental, guardian, or other authorization for the processing of children's information, the relevant school is responsible for obtaining such authorization unless otherwise agreed in writing.

ProHub Digital Solutions applies reasonable technical and organizational safeguards designed to reduce unnecessary access, disclosure, misuse, or loss of student information.

08 Payment Information

Where online payments are available, ClassNex may use third-party payment processors.

Payment information may be transmitted to the relevant payment provider to facilitate the transaction.

Depending on the payment provider, the provider may collect and process information such as:

• payer name;
• email address;
• telephone number;
• transaction amount;
• currency;
• transaction reference;
• payment status; and
• payment method information.

ProHub Digital Solutions may receive transaction information necessary to:

• record payments;
• reconcile transactions;
• verify payment status;
• update school financial records;
• generate receipts; and
• administer payment-related services.

ClassNex does not store payment-card numbers or card security codes.

Third-party payment providers operate under their own privacy policies, security practices, and terms.

09 Information Sharing and Access

ProHub Digital Solutions may disclose or make personal information available to the following categories of recipients where necessary and lawful.

9.1 Authorized School Users

Information entered into ClassNex by or on behalf of a School may be accessible to authorized users of that School in accordance with the role assigned to each user and the permissions associated with that role.

ClassNex uses role-based access controls and permissions designed to restrict access to School information based on the user's assigned role and the permissions established for that role within ClassNex.

Schools are responsible for determining which individuals are authorized to access their information and for assigning those individuals to the appropriate available roles in ClassNex.

The roles and the permissions associated with those roles are established by ClassNex and may be updated by ProHub Digital Solutions as the Platform develops. Schools do not independently define the underlying permissions associated with ClassNex roles.

Depending on the role assigned to a user and the functionality available to the School, different users may have different levels of access to School information.

Examples of role-based access may include:

• financial personnel may have access to financial records and financial functions associated with their assigned role;
• registrars may have access to student registration, enrollment, and related administrative information associated with their assigned role;
• principals and other authorized administrators may have broader administrative access according to the permissions associated with their assigned roles;
• class teachers may have access to information and functionality relevant to their assigned classes, where supported by their role;
• subject teachers may have access to information and functionality relevant to their assigned subjects, where supported by their role; and
• guardians may have access to information relating to their own children or wards, subject to the applicable ClassNex functionality and authorization.

The exact access available to a user depends on factors including:

• the role assigned to the user by the School;
• the permissions established by ClassNex for that role;
• the user's responsibilities and authorization;
• the School information involved;
• the School's configuration and use of available ClassNex functionality; and
• the functionality and access controls available within ClassNex.

Detailed information about ClassNex roles, permissions, and the access associated with available roles may be provided in the official ClassNex documentation and user manual available through docs.classnex.com. Such documentation may be updated from time to time as ClassNex evolves.

Schools are responsible for assigning users only to roles appropriate to their responsibilities and authorization and for promptly changing or removing a user's role when that user is no longer authorized to access the relevant School information.

9.2 Service Providers

We may use trusted service providers for services such as:

• cloud hosting;
• database infrastructure;
• email delivery;
• payment processing;
• security;
• backups;
• monitoring;
• technical support;
• infrastructure management;
• communications; and
• other services required to operate ClassNex.

These providers may process information only as necessary to provide their services to ProHub Digital Solutions, ClassNex, or the relevant school, or as otherwise permitted by applicable law.

9.3 Legal and Regulatory Authorities

We may disclose information where reasonably necessary to:

• comply with applicable law;
• respond to lawful requests;
• comply with court orders;
• comply with regulatory requirements;
• protect rights or property;
• investigate suspected fraud;
• address security incidents;
• enforce our agreements; or
• protect users or the public.

9.4 Business Transactions

If ProHub Digital Solutions or the ClassNex business is involved in a merger, acquisition, restructuring, financing, sale of assets, investment, or similar transaction, personal information may be transferred as part of that transaction, subject to applicable legal requirements and appropriate safeguards.

10 International and Cross-Border Data Transfers

ProHub Digital Solutions may use infrastructure and service providers located outside the country in which a school operates.

As a result, personal information may be transferred to, stored in, or processed in another country.

Cross-border data transfers may be subject to additional requirements under the data-protection laws applicable in the relevant African country.

Where an international transfer of personal information is subject to Applicable Data Protection Law, ProHub Digital Solutions will take reasonable steps to ensure that the transfer is handled using legally appropriate safeguards.

These safeguards may include:

• contractual protections;
• appropriate transfer mechanisms;
• data minimization;
• access controls;
• security measures;
• confidentiality obligations; and
• other safeguards required or recognized by applicable law.

Where a school is the relevant data controller or equivalent responsible entity, the school remains responsible for determining whether any international transfer associated with its use of ClassNex satisfies its legal obligations, except to the extent otherwise agreed or required by law.

11 Data Security

Depending on the system component and circumstances, safeguards may include:

• encryption;
• secure HTTPS/TLS connections;
• password hashing;
• secure handling of authentication credentials;
• role-based access control;
• authentication controls;
• database access restrictions;
• server security controls;
• logging and monitoring;
• backups;
• vulnerability management;
• security updates;
• access-control management;
• incident-response procedures; and
• administrative and organizational security measures.

We periodically review our security practices and may modify or improve them as reasonably necessary to address changing security risks and operational requirements.

No electronic system or method of transmission over the internet is completely secure.

Users and schools are also responsible for maintaining the security of their accounts, devices, passwords, and other access credentials.

12 Retention of Personal Information

ProHub Digital Solutions retains personal information only for as long as reasonably necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by applicable law.

For school information processed on behalf of a school, retention may also be determined by:

• the school's requirements;
• the applicable agreement;
• the applicable Data Processing Agreement;
• legal requirements;
• regulatory requirements; and
• legitimate operational and security requirements.

Retention periods may depend on:

• the type of information;
• the purpose for which it was collected;
• the school's requirements;
• contractual obligations;
• legal and regulatory requirements;
• accounting requirements;
• dispute-resolution requirements;
• security requirements; and
• backup and disaster-recovery processes.

When information is no longer required, ProHub Digital Solutions may delete, anonymize, or securely dispose of it in accordance with applicable requirements and contractual obligations.

13 Data Subject Rights

Depending on applicable law, individuals may have rights concerning their personal information, including rights to:

• request access to personal information;
• request correction of inaccurate information;
• request deletion where legally applicable;
• request restriction of processing;
• object to certain processing;
• request portability of information where applicable;
• withdraw consent where processing is based on consent;
• request information concerning processing activities; and
• lodge a complaint with an applicable data-protection authority.

The availability and scope of these rights may differ between African jurisdictions.

Where a school controls the relevant personal information, requests concerning student, guardian, teacher, employee, or other school records may need to be directed to the relevant school first.

ProHub Digital Solutions may assist the school in responding to legally valid requests where required by applicable law or the applicable agreement.

Where ProHub Digital Solutions independently acts as a data controller or equivalent responsible entity, individuals may submit relevant requests directly to ProHub Digital Solutions.

14 Africa and Applicable Data-Protection Laws

ClassNex is intended to support schools operating across Africa.

ProHub Digital Solutions recognizes that African countries have different data-protection laws, regulatory requirements, and legal frameworks.

Depending on the country in which a school operates or personal information is processed, applicable requirements may include, among others:

• the Nigeria Data Protection Act 2023 and applicable requirements of the Nigeria Data Protection Commission;
• the Botswana Data Protection Act 2018, as amended or replaced from time to time;
• the Protection of Personal Information Act (POPIA) of South Africa;
• the Kenya Data Protection Act 2019;
• the Ghana Data Protection Act 2012;
• the Uganda Data Protection and Privacy Act 2019;
• the Rwanda Law Relating to the Protection of Personal Data and Privacy;
• the Tanzania Personal Data Protection Act 2022;
• the Zambia Data Protection Act 2021;
• the Zimbabwe Cyber and Data Protection Act 2021;
• and other applicable national, regional, or sector-specific data-protection requirements.

This list is provided for general information and is not intended to be an exhaustive list of African data-protection laws.

The applicable law will depend on factors including:

• where the school is located;
• where the individuals are located;
• where the personal information is processed;
• the nature of the processing;
• the categories of personal information involved;
• whether children are involved;
• whether information is transferred across borders; and
• other circumstances recognized under applicable law.

ProHub Digital Solutions will seek to comply with data-protection requirements applicable to its role and activities.

Schools remain responsible for complying with the laws applicable to their own processing activities and for providing ProHub with lawful instructions.

Where appropriate, the parties may enter into a School–ClassNex Data Processing Agreement (DPA) to establish additional responsibilities concerning the processing of personal information.

15 Cookies and Similar Technologies

ClassNex may use cookies and similar technologies necessary to:

• maintain login sessions;
• authenticate users;
• protect against security threats;
• remember preferences;
• maintain Platform functionality;
• monitor system performance; and
• understand how the Service is used.

Where legally required, ProHub Digital Solutions will obtain appropriate consent before using non-essential cookies or similar technologies.

Users may be able to manage certain cookie preferences through their browser or available ClassNex settings.

16 Marketing Communications

ProHub Digital Solutions may send service-related communications necessary to operate an account or provide ClassNex services.

Where permitted by applicable law, ProHub Digital Solutions may also send promotional communications concerning:

• ClassNex;
• ProHub Digital Solutions;
• new features;
• service updates; or
• related products and services.

Users may unsubscribe from non-essential marketing communications using the available unsubscribe mechanism.

Transactional, security, account, billing, legal, and other essential service communications may continue even after marketing preferences are changed.

17 Data Breach and Security Incidents

If ProHub Digital Solutions becomes aware of a security incident involving personal information, we will assess the incident and take reasonable steps to:

• contain the incident;
• investigate the incident;
• mitigate potential harm;
• remediate the incident where appropriate;
• preserve relevant evidence; and
• implement reasonable measures to reduce the likelihood of recurrence.

Where notification is required by applicable law, ProHub Digital Solutions will make or facilitate the required notifications within the applicable legal timeframe.

Where a school is the relevant data controller or equivalent responsible entity, ProHub Digital Solutions may notify the school in accordance with applicable law and the applicable contractual agreement so that the school can fulfil its own legal and regulatory obligations.

18 Your Responsibilities

Users and schools must:

• protect account credentials;
• use only accounts assigned to them;
• avoid sharing accounts;
• access only information they are authorized to access;
• use ClassNex only for legitimate school or otherwise authorized purposes;
• provide accurate information where responsible for entering or maintaining information;
• avoid uploading unnecessary personal information;
• assign users only to roles that are appropriate for their responsibilities;
• review the roles assigned to users periodically;
• promptly disable or remove users who are no longer authorized to access ClassNex;
• maintain appropriate security practices;
• notify ProHub Digital Solutions or the relevant school of suspected security incidents; and
• comply with applicable data-protection and privacy laws.

Schools are responsible for determining which individuals are authorized to access their ClassNex account and for assigning those individuals to appropriate roles made available by ClassNex.

The permissions associated with each ClassNex role are defined and maintained by ClassNex. Schools do not independently create, modify, or define the underlying permissions associated with those roles. By assigning a user to a particular role, the school gives that user the permissions associated with that role as defined by ClassNex.

Schools are responsible for reviewing the roles available to them and selecting roles that appropriately correspond to each user's responsibilities and the level of access that the user should have.

Information about ClassNex roles and their associated permissions is maintained in the official ClassNex product documentation, available at docs.classnex.com .

Users are responsible for using the access granted to them only for legitimate purposes and within the scope of their assigned responsibilities. Users must not attempt to circumvent, bypass, modify, or otherwise interfere with the access controls or permissions implemented by ClassNex.

19 Third-Party Websites and Services

ClassNex may contain links to or integrations with third-party services.

Third-party services may include:

• payment processors;
• communication providers;
• authentication services;
• analytics services;
• hosting providers;
• email providers;
• cloud infrastructure providers; and
• other external technology services.

Third-party services may have their own privacy policies, terms, security practices, and data-processing arrangements.

ProHub Digital Solutions is not responsible for the independent privacy practices of third-party websites or services except to the extent required by applicable law or expressly agreed in writing.

Users should review the privacy policies and terms of relevant third-party providers before using their services.

20 Data Minimization

Schools should provide ClassNex with only the personal information reasonably necessary for legitimate educational, administrative, financial, operational, or other lawful purposes.

Schools should avoid uploading:

• unnecessary personal information;
• excessive personal information;
• information unrelated to the school's use of ClassNex; or
• sensitive information that the school is not legally permitted or authorized to process.

Where sensitive or special-category information is necessary, the school is responsible for ensuring that appropriate legal grounds, safeguards, permissions, and other requirements have been satisfied.

21 Sensitive and Special-Category Information

Certain categories of personal information may receive enhanced protection under applicable law.

Depending on the jurisdiction, this may include information concerning:

• health;
• biometric identifiers;
• financial information;
• children's information;
• criminal records;
• genetic information;
• religious beliefs;
• political opinions;
• racial or ethnic information;
• sexual orientation; or
• other categories recognized as sensitive or special-category information.

Schools should not upload sensitive or special-category information to ClassNex unless it is reasonably necessary for a legitimate purpose and the school has satisfied all applicable legal requirements.

Where particularly sensitive information is processed, additional safeguards may be required.

22 Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

Changes may be made to:

• reflect changes to ClassNex;
• introduce new features;
• reflect changes in applicable law;
• improve security;
• reflect changes to our service providers;
• clarify our practices; or
• address regulatory or operational requirements.

Where changes are material, ProHub Digital Solutions may provide notice through the Platform, email, the ClassNex website, or another appropriate method.

The updated Privacy Policy will become effective on the date stated at the beginning of the policy.

23 Complaints

If you believe that your personal information has been processed unlawfully or that your privacy rights have been infringed, you may first contact ProHub Digital Solutions or the relevant school so that we can investigate and attempt to resolve the matter.

You may also have the right to lodge a complaint with the applicable data-protection authority or regulator in your country.

The appropriate regulatory authority will depend on the jurisdiction applicable to the relevant processing activity.

For school-controlled information, individuals may be required or encouraged to raise their request or complaint with the relevant school before ProHub Digital Solutions can take action.

24 Contact Us

25 Acceptance

By using ClassNex, you acknowledge that you have read this Privacy Policy.

Where applicable, additional privacy notices, contractual provisions, consent mechanisms, data-processing agreements, or other data-protection requirements may apply depending on:

• the nature of the services being provided;
• the school using ClassNex;
• the jurisdiction in which the school operates;
• the location of the relevant Data Subjects;
• the nature of the information processed; and
• applicable law.