Privacy Policy

EasyResumption is a platform Nigerian schools use to sell books, collect school fees and hand over resumption items, and that parents use to order and pay for those things. This policy explains what personal information passes through it.

It is written to meet the Nigeria Data Protection Act 2023 and the Nigeria Data Protection Commission's General Application and Implementation Directive 2025. Where this policy and that law disagree, the law wins.

Reach us at help@easyresumption.com, on 0707 376 5902 or 0815 034 8205, or from the help and support page inside the app if you are signed in. Any of those routes reaches the people who can act on a privacy request.

Two different organisations decide what happens to information on this platform, and which one is answerable depends on the record. For your own account and for the things we sell you directly, we decide, and we answer to you for it. For your child's school record, the school decides and we act on its instructions.

In practice this means a request to correct your phone number is ours to action immediately, while a request about your child's grade or a fee invoice may have to go to the school. We will tell you when that happens rather than leaving you to guess.

We collect what the transaction needs and stop there. There is no browsing profile, no advertising identifier, and no data bought from anyone else.

We do not collect card numbers, PINs, CVVs or bank login details. Those are entered on the payment provider's own page and never reach our servers.

The Nigeria Data Protection Act treats anyone under 18 as a child, and almost every student on this platform is one. That shaped what the product collects.

• A child's record contains a first name, a last name, a school and a grade. There is no date of birth, no photograph, no address of their own, no academic record, no health information and no biometric data anywhere in the system.
• Children are not users. There is no student login, and a child cannot create an account.
• A child's record is created by their parent or guardian, or by a school administrator. By adding a child you confirm that you are their parent or legal guardian, or that you are otherwise entitled to give us that information.
• We never send marketing to a child, never build a profile of a child, and never make an automated decision about a child. Notifications about an order go to the parent's email address, not to the child.
• Bookstore staff packing an order see a student's name, grade and book list, because handing the right books to the right child requires it. They cannot see prices or payments: the queue they read is a database view that does not contain those columns at all, so the information is not merely hidden from them, it is not there.
• A school sees only its own students. That boundary is enforced in the database by row-level security, not only in the interface.

Identity is not verified when a child is registered; the in-person handover at pickup remains the checkpoint, as it was before the platform existed. If you believe someone has registered a child they have no right to register, tell us and we will remove the record and inform the school.

Every use below rests on one of the lawful bases in section 25 of the Act.

Where we rely on consent you can withdraw it at any time, and withdrawing it costs you nothing else on the platform. Where we rely on legitimate interests you can object, and we will stop unless we can show grounds that override yours.

• Your child's school. It sees its own students, its own orders, its own invoices and its own payments, and nothing belonging to any other school.
• Supabase, which provides our database, sign-in and file storage.
• Bachs, our payment provider. When you pay online we pass your name, your email address, your phone number where we have it, the amount and what it is for. Your card and bank credentials go to them directly, not through us.
• Distributors, when a school reorders stock. The message we generate carries the school's name and the titles and quantities to order. No parent or student information is in it.

We will also disclose information where the law requires it, for example under a court order or a lawful request from a regulator. We do not sell personal information, and we do not share it for advertising. Nobody buys access to this data.

Our hosting and payment providers operate infrastructure that may sit outside Nigeria, so your information may be processed abroad. Where that happens we rely on the transfer conditions in sections 41 to 43 of the Act, including the contractual data-protection commitments those providers give us. Ask us and we will tell you where a named provider processes data.

• Signing in uses a six-digit code sent to your email. There are no passwords anywhere on this platform, so there is no password of yours for anyone to steal from us.
• Every table enforces row-level security in the database. A school administrator's query cannot return another school's rows even if the application asked it to.
• Proof-of-payment uploads go to a private storage bucket. They are not reachable from a public link.
• Access rights are checked on the server for every request, not merely hidden in the interface.
• Online payment confirmations arrive on a signed webhook, are checked against the amount we asked for, and are recorded once even if the provider sends them twice.

No system is perfectly secure, and we will not pretend otherwise. If a breach occurs that is likely to affect your rights, we will notify the Nigeria Data Protection Commission within 72 hours and tell you directly where the Act requires it.

Under the Act you can ask us to do any of the following, for yourself and, as their parent or guardian, for your child.

• Tell you what we hold about you, and give you a copy.
• Correct anything that is wrong or incomplete.
• Delete what we no longer have a reason to keep.
• Restrict what we do with it while a dispute about it is resolved.
• Give you your information in a portable form, or send it to someone else where that is technically feasible.
• Stop relying on your consent, from the moment you withdraw it.
• Object to a use we base on our legitimate interests.

Write to help@easyresumption.com or call us. We answer within 30 days and charge nothing, unless a request is repetitive or manifestly excessive, in which case we will tell you before doing anything. We may ask you to confirm who you are first, so that nobody else can make a request in your name.

We make no automated decisions that produce legal effects for you, and we do not profile you. If that ever changes, this policy will say so before it starts.

If we handle a request badly you can complain to the Nigeria Data Protection Commission at ndpc.gov.ng. We would rather you came to us first, but that route is yours whether or not you do.

We use cookies for one purpose: keeping you signed in. The cookie is set when you log in and cleared when you log out.

There are no advertising cookies, no analytics, and no third-party trackers on this site. You will not find a cookie banner here because there is nothing to consent to beyond the sign-in cookie, which is strictly necessary for the service to work at all. Block it and you will not be able to stay logged in.

When we change this policy the date at the top changes with it. If a change materially affects what we do with your information, we will tell you in the app or by email before it takes effect, rather than relying on you to re-read the page.