Privacy Policy
1. Who we are
AttendSys is an attendance platform operated by W2 Studio, 98 murtla mohammed highway, Calabar, Nigeria (“AttendSys”, “we”, “us”). You can contact us at support@attendsys.site.
Our role depends on the data:
- Attendance data in the student and lecturer apps. The university that uses AttendSys is normally the data controller, and AttendSys acts as its data processor under a written agreement. We process this data only to run the service for the university.
- Website visitors and enquiries. For people who visit this website or contact us, AttendSys is the data controller.
2. Information we process
Students
- Student ID and matriculation number, full name, department and level, supplied by the university.
- A device identifier that links your account to your registered phone.
- For each check-in: the time, your phone’s GPS latitude, longitude and accuracy, the distance from the lecture venue, the QR code used, and the result (accepted, flagged or rejected) with a risk score.
- Your password, stored in hashed form and not as plain text.
Lecturers and administrators
- Name, email address, department and staff identifier, and a hashed password.
- Records of the sessions they start and end.
Website visitors
- Messages and contact details you send us.
- Standard server logs, including IP address, browser type, pages requested and time.
3. Why we process it
- To record and report attendance for the university and its lecturers.
- To keep the service secure and prevent false check-ins, for example by checking the registered device, location, time and QR code.
- To support users and respond to enquiries.
- To meet our legal obligations.
Under the Nigeria Data Protection Act 2023, the lawful basis for attendance processing is determined by the university as controller, for example the performance of its academic and administrative functions, or its legitimate interests. For enquiries to us, our basis is our legitimate interest in responding, or steps you ask us to take before an agreement.
4. Automated flags and rejections
The system automatically rejects some check-ins, for example one made outside the venue area, with an expired QR code, or from an unregistered device. It may also flag a check-in as suspicious. Flags are shown to lecturers and administrators for review. If you believe a check-in was wrongly rejected or flagged, contact your lecturer or your institution, or write to us.
5. Where data is stored and transfers outside Nigeria
Data is hosted with Amazon Web Services in its Cape Town, South Africa region. This means personal data is stored outside Nigeria. We rely on the safeguards the Nigeria Data Protection Act 2023 requires for such transfers.
6. Who we share data with
- The university that uses AttendSys, which receives the attendance records for its students and staff.
- Our hosting provider, Amazon Web Services, which stores the data on our behalf.
- Regulators, courts or law enforcement where the law requires it.
We do not sell personal data.
7. How long we keep it
Attendance records are kept for the period agreed with the university, which by default is two years after the pilot ends. After that they are deleted or returned to the university. Backups are overwritten on a fixed schedule, so deleted data can remain in backups until they expire. Website enquiries are kept only as long as needed to deal with them.
8. How we protect data
- All traffic to our apps is encrypted in transit (HTTPS).
- Passwords are hashed.
- Access is role-based, and the database accounts used by each part of the system are limited to what they need.
- Backups are taken of the database.
No system is completely secure. If a breach affects personal data in a way the law requires us to report, we will notify the Nigeria Data Protection Commission and affected parties within the time the Act requires.
9. Cookies and similar technologies
- Apps. The student and lecturer apps store session information and a device identifier in your browser to keep you signed in and to link your account to your device. These are strictly necessary for the service.
- This website. The website itself sets no tracking cookies. It may show advertisements served by Google AdSense. Google and its partners may use cookies to serve and measure ads. You can manage this in Google’s ad settings, and read how Google uses data at policies.google.com/technologies/partner-sites.
- Advertising is not shown inside the student and lecturer apps.
10. Your rights
Under the Nigeria Data Protection Act 2023 you have rights over your personal data, including to be informed, to access it, to have inaccurate data corrected, to have it erased or its processing restricted in the cases the Act allows, to object to processing, to receive your data in a portable format, and to withdraw consent where processing is based on consent.
For attendance data, please contact your university first, because it is the controller. You can also write to us at support@attendsys.site, and we will help or pass your request to the university. You may also complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
11. Children
AttendSys is intended for university students and staff and is not directed at children. Where a student is under 18, the university is responsible for obtaining any parent or guardian consent the law requires.
12. Changes to this policy
We may update this policy. The effective date at the top shows when it last changed. Material changes will be communicated to the universities we work with.
13. Contact
W2 Studio
98 murtla mohammed highway, Calabar, Nigeria
support@attendsys.site