Privacy notice

Last updated 21 August 2026

Who this is about

Kundi is operated by DaboLinux Technologies (BN3238495), Kano, Nigeria. It is school management software sold to schools.

For the pupil, guardian and staff records inside a school's account, the school is the data controller and Kundi is the data processor. The school decides what is collected and why. We hold and process it on the school's instruction, under a data processing agreement, and for nothing else.

For our own business records, such as people who contact us about a demo, we are the controller. That is the only part of this notice where we make the decisions.

Data a school puts into Kundi

What a school stores is the school's choice. In practice it includes:

• Pupil records: name, sex, date of birth, admission number, photograph, guardians
• Guardian contact details: phone number, email, relationship to the pupil
• Attendance, assessment scores, report cards, and programme enrolment
• Fee invoices, payments, receipts, and the school's accounting entries
• Staff records where the school uses payroll
• Messages the school sends to guardians through Kundi

Most of this is children's data, which the Nigeria Data Protection Act 2023 treats as the most sensitive category. We handle it on that basis.

Why we hold it

Only to provide the service the school is paying for: running its register, its results, its fees and its books, and keeping those records available to the school. We do not have a second purpose.

Specifically, we do not:

• Sell or rent data, or advertise against it
• Use one school's data to build or improve anything for another
• Train machine learning models on pupil records
• Contact a school's guardians on our own behalf

Who else sees it

Sub-processors, meaning the suppliers we need in order to run the service. Each is named in the data processing agreement a school signs, along with what it does and where it operates. Categories today:

We tell schools before adding or changing a sub-processor. We do not give anyone else access, and we respond to a request from a government body only where the law requires it, telling the school unless we are forbidden to.

How long it is kept

The school decides. Student academic records are typically kept for years after a pupil leaves, because a school may need to reissue a result or a certificate. Message delivery logs are kept far less. A published retention schedule per data class, with automated purge, is one of the items still being built, and we will link it here when it exists.

When a school leaves Kundi, it can export everything first. We then delete the school's data on request.

Rights

Under the Act, a person whose data is held can ask to see it, correct it, have it deleted, or object to how it is used.

Because the school is the controller, a parent, pupil or member of staff should ask their school first. The school can answer directly from Kundi. If you contact us instead, we will pass the request to the school and help them answer it rather than act on our own.

If a school is not responding, you can complain to the Nigeria Data Protection Commission.

Security

Each school's data is separated inside the database itself, so a query that forgets its filter returns nothing rather than another school's records. Our security page explains how that works, and is honest about which parts of our compliance programme are still in progress.

Where data is held

We are settling data residency before signing a long-term hosting contract, because some schools will require that records stay in Nigeria. Until this section names a specific region, ask us and we will tell you exactly where your school's data would sit.

Breaches

If data is exposed, we tell the affected schools and the Commission within 72 hours of becoming aware, with what happened, what was affected, and what we are doing about it. Building and testing that path is on the list on the security page.

Contact

Email hello@kundihq.com. A named Data Protection Officer will be published here once appointed.