Contents
1. Who we are#
Mercan Brilliant Schools (“MBS”, “we”, “us” or “our”) operates the school portal at https://mercanbrilliantschools.com.ng/ and the MBS e-Connect mobile application (together, the “Services”). We are the data controller for the personal data described in this policy.
Address: Lagos, Nigeria
Email: hello@marvecodeit.dev
Data protection contact: hello@marvecodeit.dev (please use the subject line “Data Protection Request”).
2. Scope of this policy#
This policy applies to parents/guardians, students, teachers, school administrators and other staff who use the Services. It explains what we collect, why we collect it, who we share it with, how long we keep it, and the choices and rights available to you.
3. Information we collect#
3.1 Account and identity information
- Name, role (parent, student, teacher, administrator, etc.), email address and phone number.
- School identifiers such as student registration number, class, section and guardian relationships.
- Profile photo, chat display name and other profile preferences you choose to provide.
3.2 Authentication and security information
- Login credentials and one-time verification codes.
- Session tokens, device identifiers, push notification tokens and security logs.
- Approximate location derived from IP address, used for security and fraud prevention.
3.3 Facial recognition data (FACEIO)
Some accounts can use facial recognition for sign-in and identity verification. Facial recognition is optional. Where it is offered, you (or the student’s parent/guardian) must give clear consent before enrollment.
When you enrol or authenticate with facial recognition, we process:
- A facial image or short video captured by your device camera.
- Liveness and anti-spoofing signals generated during capture.
- A facial biometric template or embedding derived from the image. The template is a mathematical representation, not a stored photograph, but it is still treated as sensitive biometric data.
- Enrollment and authentication timestamps, results and related security logs.
Facial recognition is provided through FACEIO, a third-party facial authentication service. FACEIO processes the camera capture and biometric template on our behalf as a processor and may process data in countries other than Nigeria. You can read FACEIO’s privacy policy at https://faceio.net/privacy-policy.
We use facial recognition only to verify that the person signing in is the enrolled account holder. We do not use facial recognition for advertising, profiling, emotion detection, surveillance or any purpose unrelated to account authentication. Where a school uses facial recognition for student attendance or entry, the school will provide a separate notice at the point of collection and obtain any consent required by law.
3.4 School records and app activity
- Attendance records, results, class and section information, and teacher remarks.
- Chat messages, attachments, reactions, read receipts and moderation reports.
- Fees and payment references where the school makes those features available.
- Support requests and feedback you send to us.
3.5 Device and technical information
- Device type, operating system, app version and language settings.
- IP address, crash reports, performance data and diagnostic logs.
- Approximate usage information, such as which screens are opened and when.
3.6 Information about children
The Services are used by schools and families and therefore include data about children. Parents/guardians and the school provide this data. We do not knowingly allow children to create accounts or enrol facial recognition without the involvement of their parent/guardian and school. Where a student uses the Services, the student’s account is managed under the school’s authority and the parent/guardian’s consent.
4. How we use your information#
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and secure accounts; sign users in | Account, authentication, device and facial recognition data | Contract; consent (for facial recognition); legitimate interests (security) |
| Provide attendance, results, chat, notifications and school communications | School records, messages, contact details, push tokens | Contract; legitimate interests; legal obligation |
| Protect students, staff and the Services from fraud, abuse and unauthorised access | Authentication logs, device data, IP address, usage data | Legitimate interests; legal obligation |
| Provide support and improve the Services | Support messages, diagnostics, usage information | Legitimate interests |
| Comply with legal, regulatory and safeguarding duties | Relevant records as required by law | Legal obligation |
We may send service messages such as security alerts, attendance notices and result releases. You can manage non-essential notification preferences in the app.
5. Biometric data and consent#
- Consent is required. We enrol facial data only after the account holder, or a parent/guardian for a student, gives clear consent through the app or the school’s consent process.
- You can withdraw consent. You may stop using facial recognition and request deletion of your facial template at any time by contacting us. Withdrawing consent does not affect authentication methods that do not rely on facial recognition.
- Retention. A facial template remains active while facial recognition is enabled for the account. When consent is withdrawn or the account is closed, we instruct FACEIO to delete the template, subject to any legal retention obligations. Backup copies may take a short period to expire.
- No sale. We do not sell facial data or use it for advertising.
- Alternative access. Where facial recognition is used for sign-in, the school will provide an alternative authentication or verification method.
If you believe facial data was collected without valid consent, contact us immediately so we can investigate and, where appropriate, delete the data.
7. International transfers#
Some of our service providers, including FACEIO and cloud hosting providers, may process data in countries outside Nigeria. Where this happens, we take steps required by applicable law, such as contractual safeguards and ensuring the provider offers an appropriate level of protection.
8. How long we keep data#
- Account and school records: kept while the account or enrollment is active and for the period required by school policy and applicable law.
- Facial templates: kept until consent is withdrawn, facial recognition is disabled, or the account is closed, unless a longer period is required by law.
- Chat and attachments: kept while needed for the conversation and school records, then deleted or archived under the school’s retention policy.
- Security and diagnostic logs: kept for a limited period needed to investigate incidents and maintain security.
9. How we protect data#
We use administrative, technical and physical safeguards designed to protect personal data. These include encrypted connections (HTTPS), access controls, role-based permissions, secure storage of authentication tokens and monitoring for suspicious activity. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
10. Your rights#
Subject to applicable law, including the Nigeria Data Protection Act 2023 and, where relevant, the GDPR, you may have the right to:
- Access the personal data we hold about you.
- Ask us to correct inaccurate or incomplete data.
- Ask us to delete data that is no longer needed or lawfully held.
- Object to or restrict certain processing.
- Withdraw consent, including consent for facial recognition.
- Request a portable copy of data you provided to us.
- Lodge a complaint with the Nigeria Data Protection Commission (NDPC) or your local supervisory authority.
To exercise a right, email hello@marvecodeit.dev with the subject line “Data Protection Request”. We may need to verify your identity and authority (for example, a parent/guardian acting for a student) before acting on a request. We will respond within the period required by law.
12. Third-party links and services#
The Services may link to third-party websites or use third-party services such as FACEIO, push notification providers and image hosting. Their privacy practices are governed by their own policies. We encourage you to review them.
13. Changes to this policy#
We may update this policy to reflect changes in the Services, legal requirements or our practices. We will post the updated policy on this page and change the “Last updated” date. Where changes materially affect your rights, we will provide additional notice in the app or by email.
14. Contact us#
Questions, requests or concerns about this policy or your data can be sent to:
Mercan Brilliant Schools
Lagos, Nigeria
Email: hello@marvecodeit.dev
Website: https://mercanbrilliantschools.com.ng/