TERMS OF SERVICE

Mahhfaz School Management Platform

Operated by Mahhfaz Group

Effective date: 1 July 2026

Last updated: 22 July 2026

1. Definitions

In these Terms of Service, the following defined terms apply. Words in the singular include the plural and vice versa.

1.1. "Mahhfaz", "we", "us", "our" means Mahhfaz Group, a company incorporated in the Federal Republic of Nigeria with registration number 9612441 and registered office at No. 17, Kasuwan Yelwa Street, Palace Way, Jalingo, Taraba State, Nigeria.

1.2. "Platform" or "Service" means the multi-tenant, cloud-based school-management software application made available by Mahhfaz, including its web application, application programming interfaces, administrative tools, and related documentation.

1.3. "School", "Subscriber", "you", or "your" means the educational institution that subscribes to the Platform under these Terms, and includes its authorised Users.

1.4. "User" means any natural person authorised by a School to access the Platform, including a proprietor, principal, vice principal, headmaster, admin or admission officer, academic officer, bursar or accountant, exam officer, ICT officer, librarian, transport officer, teacher, class master, parent or guardian, student, or applicant.

1.5. "Super-Admin" means the platform-owner administrator role controlled by Mahhfaz.

1.6. "School Data" means all data that a School or its Users submit to, upload to, or generate within the Platform, including data relating to students, applicants, parents/guardians, and staff.

1.7. "Personal Data", "Data Subject", "Data Controller", "Data Processor", and "Sensitive Personal Data" have the meanings given to them in the Nigeria Data Protection Act 2023 ("NDPA") and the General Application and Implementation Directive 2025 ("GAID") issued by the Nigeria Data Protection Commission ("NDPC").

1.8. "Sub-processor" means a third party engaged by Mahhfaz to process School Data in connection with the Service, as listed in the Privacy Policy and the Data Processing Agreement.

1.9. "Commission" means the amount earned by Mahhfaz on school-fee and application-fee collections, as described in Clause 4. There is no separate subscription or maintenance fee. "Fees", where used, means any other amounts (if any) agreed to be payable by the School.

1.10. "Paystack" means Paystack Payments Limited, the third-party payment processor integrated into the Platform.

1.11. "Data Protection Laws" means the NDPA, the GAID, any regulation, directive, or guidance issued by the NDPC, and, to the extent applicable to a Data Subject, the EU/UK General Data Protection Regulation ("GDPR").

1.12. "Privacy Policy" and "DPA" mean, respectively, the Mahhfaz Privacy Policy and the Mahhfaz Data Processing Agreement, each as amended from time to time and incorporated into these Terms by reference.

2. Agreement and Acceptance

2.1. These Terms form a binding agreement between Mahhfaz and the School. By subscribing to, accessing, or using the Platform, the School accepts these Terms, the Privacy Policy, and the DPA.

2.2. Acceptance is by electronic (click-through) acceptance during onboarding, together with execution of the DPA by the School. The person accepting on behalf of a School warrants that they are authorised to bind that School.

2.3. Where a School issues access credentials to its Users, the School is responsible for ensuring those Users comply with these Terms and any applicable acceptable-use rules.

3. Description of the Service

3.1. The Platform is a multi-tenant school-management system that enables a subscribing School to administer, among other functions: student admissions and applicant management; student records and registration; class and academic administration; attendance; examinations, scoring, and results; health/clinic records; hostel allocation; library administration; transport administration; staff records, payroll, leave, and attendance; messaging to parents, guardians, staff, and students; and online collection of school fees and application fees.

3.2. Each School operates within its own logically separated tenant. Mahhfaz maintains technical and organisational measures intended to prevent one School from accessing another School's data.

3.3. Mahhfaz may add, modify, or discontinue features of the Platform. Where a change materially reduces core functionality, Mahhfaz will give the School not less than 30 days' prior notice by email or in-Platform notice.

3.4. The Platform is provided as software-as-a-service. Mahhfaz does not provide legal, accounting, tax, medical, or educational-compliance advice, and the School remains responsible for its own regulatory obligations.

4. No Subscription Fee; the Commission Model

4.1. No subscription or maintenance fee. The Platform is provided to the School with no upfront, subscription, or maintenance fee. The School's access continues on an ongoing basis until terminated by either party under Clause 14. Mahhfaz's remuneration is the Commission.

4.2. Commission. Mahhfaz earns a Commission on school-fee and application-fee payments processed through the Platform. The Commission is added to the amount payable by the payer at checkout, so that the payer (and not the School) bears the Commission. The applicable Commission rate is that agreed with the School during onboarding and recorded in the School's account.

4.3. Split settlement. Fee payments made by parents, guardians, applicants, or students are collected through Paystack and settled by split settlement, with the School's portion routed to the School's designated bank subaccount and Mahhfaz's Commission routed to Mahhfaz. The School is responsible for providing and maintaining accurate subaccount and settlement details.

4.4. Paystack charges. Paystack's transaction charges are borne by the payer and added to the amount payable at checkout.

4.5. Taxes. All amounts are exclusive of value-added tax and any other applicable taxes or levies. Each party is responsible for the taxes for which it is liable under applicable law.

4.6. Sums owing. Where any sum is properly owing to Mahhfaz and remains unpaid after 14 days' written notice, Mahhfaz may suspend the Service in accordance with Clause 14.

4.7. Commission non-refundable. Commission already earned on completed transactions is non-refundable, save where a payment is reversed or refunded to the payer, in which case the parties will reconcile amounts in good faith.

4.8. Changes to Commission. Mahhfaz may revise the Commission rate on not less than 30 days' written notice. A revised rate applies to transactions occurring after the notice period. If the School does not accept the revised rate, its remedy is to terminate under Clause 14.2.

5. Payment Processing and Card Data

5.1. All card and payment-instrument processing is performed by Paystack. Mahhfaz does not collect, store, or have access to full card numbers, card verification values (CVV), or card PINs. Card data is handled entirely within Paystack's environment.

5.2. The School acknowledges that payment processing is subject to Paystack's own terms of service and privacy policy, and that Mahhfaz is not liable for acts, omissions, downtime, settlement delays, or decisions of Paystack. See also Clause 11.

5.3. The School authorises Mahhfaz to instruct Paystack to effect split settlement as described in Clause 4.3.

6. Acceptable Use

6.1. The School and its Users must not:

(a) use the Platform for any unlawful purpose or in breach of Data Protection Laws;

(b) upload School Data that the School has no lawful basis to process;

(d) probe, scan, or test the vulnerability of the Platform, or circumvent any security or authentication measure, except with Mahhfaz's prior written consent;

(e) introduce malware or any harmful code;

(f) reverse engineer, decompile, or disassemble the Platform except to the extent this restriction is prohibited by applicable law;

(g) resell, sublicense, or provide the Platform to a third party that is not an authorised User, without Mahhfaz's written consent;

(h) use the Platform to send unlawful, harassing, defamatory, or fraudulent communications; or

(i) upload content that infringes the intellectual-property or privacy rights of any person.

6.2. The School must enforce role-based access appropriately and must not grant a User a role or permission broader than that User's legitimate function requires.

6.3. Mahhfaz may investigate suspected breaches of this Clause 6 and may suspend access under Clause 14 where necessary to protect the Platform, other Schools, or Data Subjects.

7. Intellectual Property

7.1. Mahhfaz IP. Mahhfaz and its licensors own all intellectual-property rights in and to the Platform, including its software, source code, object code, design, structure, user interfaces, documentation, and all improvements and derivative works. Nothing in these Terms transfers any such right to the School.

7.2. Licence to the School. Subject to these Terms, Mahhfaz grants the School a non-exclusive, non-transferable, non-sublicensable, revocable licence to access and use the Platform during the term for the School's internal administrative purposes.

7.3. School Data. As between the parties, the School owns all School Data. The School grants Mahhfaz a licence to host, process, transmit, and display School Data solely to provide, secure, support, and improve the Service, and as instructed by the School, in accordance with these Terms, the Privacy Policy, the DPA, and Data Protection Laws.

7.4. Feedback. If the School provides suggestions or feedback, Mahhfaz may use them without restriction or obligation.

7.5. Aggregated/anonymised data. Mahhfaz may generate and use aggregated and de-identified statistics that do not identify any School or Data Subject, for product improvement and analytics. Such data is irreversibly anonymised before use and is not treated as Personal Data.

8. Data Protection — Roles and Processing

8.1. Controller and Processor roles. With respect to School Data (data about students, applicants, parents/guardians, and staff):

(a) the School is the Data Controller; and

(b) Mahhfaz is the Data Processor, processing School Data only on the documented instructions of the School and as described in the Privacy Policy and the DPA.

8.2. Mahhfaz as Controller. With respect to the School's own account, settlement, and marketing data, and to Platform audit and security logs generated for Mahhfaz's own compliance and security purposes, Mahhfaz acts as a Data Controller.

8.3. Compliance status. Mahhfaz is a data controller/processor of major importance under the NDPA and GAID and is registered with the NDPC accordingly, has appointed a Data Protection Officer, and maintains the records and audit returns required of such an entity.

8.4. Parental consent for minors. The School, as Controller, is responsible for obtaining and maintaining the parental or legal-guardian consent required under the NDPA for the processing of children's Personal Data, and for establishing the lawful basis for all School Data. Mahhfaz provides tools to assist but does not determine lawful basis on the School's behalf.

8.5. DPA prevails. The DPA sets out the full processing terms and, in case of conflict on the subject matter of data processing, prevails over this Clause 8.

9. Service Levels and Availability

9.1. Mahhfaz will use commercially reasonable efforts to keep the Platform available and to maintain reasonable security and backup practices.

9.2. The Service is provided on a reasonable-efforts basis. Mahhfaz does not commit to a formal service-level agreement or guaranteed uptime figure at this time.

9.3. Availability excludes: scheduled maintenance (for which Mahhfaz will give reasonable notice where practicable); emergency maintenance; failures of third-party services (including Paystack, SMS, email, hosting, and connectivity providers); and events of Force Majeure under Clause 15.

10. Warranties and "AS IS" Disclaimer

10.1. Mahhfaz warrants that it will provide the Service with reasonable skill and care.

10.2. Except as expressly stated in these Terms, and to the fullest extent permitted by applicable Nigerian law, the Platform is provided "AS IS" and "AS AVAILABLE", and Mahhfaz disclaims all other warranties, conditions, and representations, whether express, implied, statutory, or otherwise, including any implied warranties of merchantability, fitness for a particular purpose, accuracy, and non-infringement.

10.3. Mahhfaz does not warrant that the Platform will be uninterrupted, error-free, or free from harmful components, or that all defects will be corrected.

10.4. The School is responsible for the accuracy, quality, and legality of School Data and for the manner in which its Users use the Platform.

11. Third-Party Dependencies

11.1. The Platform relies on third-party services, including Paystack (payments), Termii (SMS), Resend (email), Laravel Cloud (hosting and PostgreSQL database), Amazon Web Services / AWS S3 (file and media storage), and Cloudflare (marketing sites and content delivery).

11.2. Mahhfaz is not responsible for the availability, performance, security, acts, or omissions of these third parties. Interruptions, delays, data incidents, or failures originating from a third party are outside Mahhfaz's control, and Mahhfaz's liability for them is excluded to the extent permitted by law, subject to Mahhfaz's own obligations as Processor under the DPA.

11.3. In particular, Mahhfaz is not liable for payment settlement delays, failed transactions, reversals, or chargebacks arising from Paystack or the banking system.

12. Limitation of Liability

12.1. Cap on liability. To the fullest extent permitted by applicable Nigerian law, Mahhfaz's total aggregate liability to the School arising out of or in connection with these Terms and the Service, whether in contract, tort (including negligence), breach of statutory duty, or otherwise, is limited to the total Commission and Fees actually earned by, or attributable to, the School's account in the twelve (12) months immediately preceding the event giving rise to the claim.

12.2. Excluded losses. To the fullest extent permitted by applicable law, Mahhfaz is not liable for any: indirect, incidental, special, punitive, or consequential loss; loss of profits, revenue, business, goodwill, or anticipated savings; or loss or corruption of data (except to the extent such data loss results directly from Mahhfaz's failure to meet its security obligations under the DPA), in each case however arising and even if advised of the possibility.

12.3. Non-excludable liability. Nothing in these Terms limits or excludes any liability that cannot be limited or excluded under applicable Nigerian law, including liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or any statutory liability under the NDPA that cannot lawfully be limited.

12.4. The exclusions and limitations in this Clause 12 apply to the maximum extent permitted by law and survive termination.

13. Indemnification

13.1. By the School. The School will indemnify and hold harmless Mahhfaz, its officers, employees, and agents against all claims, losses, liabilities, damages, costs, and reasonable expenses (including reasonable legal fees) arising out of or in connection with: (a) the School's or its Users' misuse of the Platform; (b) the School's breach of these Terms or of Data Protection Laws; (c) School Data that the School had no lawful basis to process, or that infringes a third party's rights; or (d) the School's failure to obtain any required consent, including parental or guardian consent for minors.

13.2. By Mahhfaz. Mahhfaz will indemnify the School against third-party claims that the Platform software, as provided by Mahhfaz and used in accordance with these Terms, infringes that third party's intellectual-property rights, subject to the limitation of liability in Clause 12. This does not apply to claims arising from School Data or from modifications or use not authorised by Mahhfaz.

13.3. The indemnifying party's obligations are conditional on the indemnified party promptly notifying the claim, not admitting liability, and giving reasonable cooperation.

14. Suspension, Termination, and Data After Termination

14.1. Suspension. Mahhfaz may suspend the School's or a User's access where: (a) a sum properly owing remains unpaid after notice under Clause 4.6; (b) there is a security risk to the Platform or to Data Subjects; (c) continued use would breach the law or these Terms; or (d) required by a competent authority. Mahhfaz will restore access promptly once the cause is resolved.

14.2. Termination for convenience. Either party may terminate on 30 days' written notice.

14.3. Termination for cause. Either party may terminate immediately on written notice if the other commits a material breach that is not remedied within 30 days of notice, or becomes insolvent or unable to pay its debts.

14.4. Effect of termination. On termination, the School's licence ends and the School must cease using the Platform. Accrued payment obligations survive.

14.5. Data export. For 30 days after termination, Mahhfaz will make School Data available for export in a commonly used, machine-readable format. As part of a School's offboarding, examination results and transcripts are made available for download before deletion.

14.6. Deletion. After the export window, Mahhfaz will delete or irreversibly anonymise School Data in accordance with the deletion process and retention schedule set out in the Privacy Policy, except where a longer retention period is required by law (for example, the six-year statutory retention of financial and payroll records) or is necessary to establish, exercise, or defend legal claims.

15. Force Majeure

15.1. Neither party is liable for failure or delay in performing its obligations (other than payment obligations) caused by events beyond its reasonable control, including acts of God, flood, fire, epidemic or pandemic, war, civil unrest, terrorism, governmental action, changes in law, failure of national power grids, telecommunications or internet failure, or failure of a third-party service or Sub-processor.

15.2. The affected party will notify the other and use reasonable efforts to mitigate. If the event continues for more than 30 days, either party may terminate the affected Service on written notice.

16. When Things Go Wrong — Incident Handling, Remedies, and Disputes

16.1. Incident handling. If a security incident or personal-data breach affecting School Data occurs, Mahhfaz will handle it in accordance with the breach-notification provisions of the Privacy Policy and the DPA, including notifying the School without undue delay so the School (as Controller) can meet its own obligations to the NDPC and to Data Subjects.

16.2. Remedies. The School's remedies for defects or failures are, at Mahhfaz's option and to the extent applicable, correction of the defect or re-performance of the affected Service, subject always to Clauses 11 and 12.

16.3. Complaints and good-faith resolution. Before commencing formal proceedings, a party with a complaint will raise it in writing to the other party's designated contact, and the parties will attempt in good faith to resolve it within 30 days.

16.4. Arbitration. Any dispute not resolved under Clause 16.3 will be referred to and finally resolved by arbitration under the Arbitration and Mediation Act 2023 of Nigeria. The seat of arbitration is the State in which the School is located or, where appropriate arbitration facilities are not available there, the nearest State with such facilities. The arbitration will be conducted in English before a sole arbitrator appointed in accordance with that Act (ad hoc).

16.5. Governing law. These Terms and any dispute arising out of them are governed by the laws of the Federal Republic of Nigeria.

16.6. Jurisdiction for excluded matters. Matters not subject to arbitration (for example, urgent injunctive relief, or the enforcement of an award) are subject to the exclusive jurisdiction of the courts of Nigeria.

17. Changes to These Terms

17.1. Mahhfaz may amend these Terms from time to time. Mahhfaz will give notice of material changes by email or in-Platform notice not less than 30 days before they take effect. Continued use of the Platform after the effective date constitutes acceptance of the amended Terms. If the School does not accept a material change, its remedy is to terminate under Clause 14.2.

18. General

18.1. Confidentiality. Each party will keep the other's confidential information confidential and use it only for purposes of these Terms.

18.2. Assignment. The School may not assign these Terms without Mahhfaz's written consent. Mahhfaz may assign to an affiliate or in connection with a merger or sale of assets, on notice.

18.3. Notices. Notices must be in writing and sent to the contact details on the account or to Mahhfaz at admin@mahhfaz.com.ng.

18.4. Entire agreement. These Terms, the Privacy Policy, and the DPA constitute the entire agreement between the parties and supersede prior agreements on their subject matter. The order of precedence is: (1) the DPA; (2) the Privacy Policy; (3) these Terms.

18.5. Severability. If any provision is held unenforceable, the remaining provisions continue in effect.

18.6. No waiver. A failure to enforce a provision is not a waiver of it.

18.7. No partnership. Nothing in these Terms creates a partnership, agency, or employment relationship between the parties.

18.8. Language. These Terms are in the English language.

19. Contact

Mahhfaz Group

Registered office: No. 17, Kasuwan Yelwa Street, Palace Way, Jalingo, Taraba State, Nigeria

Company registration number: 9612441

General enquiries: info@mahhfaz.com.ng

Legal notices: admin@mahhfaz.com.ng

Data Protection Officer: Anas Muhammad Yahaya — dpo@mahhfaz.com.ng