Terms of Service

1. Definitions

In these Terms of Service, the following defined terms apply. Words in the singular include the plural and vice versa.

1. 1.1. “Mahhfaz”, “we”, “us”, “our” means Mahhfaz Group, a company incorporated in the Federal Republic of Nigeria with registration number 9612441 and registered office at No. 17, Kasuwan Yelwa Street, Palace Way, Jalingo, Taraba State, Nigeria.
2. 1.2. “Platform” or “Service” means the multi-tenant, cloud-based college-management software application made available by Mahhfaz (the Mahhfaz College Portal), including its web application, application programming interfaces, administrative tools, and related documentation.
3. 1.3. “College”, “Subscriber”, “you”, or “your” means the tertiary educational institution that subscribes to the Platform under these Terms, and includes its authorised Users.
4. 1.4. “User” means any natural person authorised by a College to access the Platform, including a proprietor, provost, deputy provost, registrar, dean, head of department, admission officer, academic officer or secretary, bursar or accountant, exam officer, ICT officer, librarian, transport officer, lecturer, student, or applicant.
5. 1.5. “Super-Admin” means the platform-owner administrator role controlled by Mahhfaz.
6. 1.6. “College Data” means all data that a College or its Users submit to, upload to, or generate within the Platform, including data relating to students, applicants, guardians/sponsors and next-of-kin, and staff.
7. 1.7. “Personal Data”, “Data Subject”, “Data Controller”, “Data Processor”, and “Sensitive Personal Data” have the meanings given to them in the Nigeria Data Protection Act 2023 (“NDPA”) and the General Application and Implementation Directive 2025 (“GAID”) issued by the Nigeria Data Protection Commission (“NDPC”).
8. 1.8. “Sub-processor” means a third party engaged by Mahhfaz to process College Data in connection with the Service, as listed in the Privacy Policy and the Data Processing Agreement.
9. 1.9. “Commission” means the amount earned by Mahhfaz on school-fee and application-fee collections, as described in Clause 4. There is no separate subscription or maintenance fee. “Fees”, where used, means any other amounts (if any) agreed to be payable by the College.
10. 1.10. “Paystack” means Paystack Payments Limited, the third-party payment processor integrated into the Platform.
11. 1.11. “Data Protection Laws” means the NDPA, the GAID, any regulation, directive, or guidance issued by the NDPC, and, to the extent applicable to a Data Subject, the EU/UK General Data Protection Regulation (“GDPR”).
12. 1.12. “Privacy Policy” and “DPA” mean, respectively, the Mahhfaz Privacy Policy and the Mahhfaz Data Processing Agreement, each as amended from time to time and incorporated into these Terms by reference.

2. Agreement and Acceptance

1. 2.1. These Terms form a binding agreement between Mahhfaz and the College. By subscribing to, accessing, or using the Platform, the College accepts these Terms, the Privacy Policy, and the DPA.
2. 2.2. Acceptance is by electronic (click-through) acceptance during onboarding and first use, together with execution of the DPA by the College. The person accepting on behalf of a College warrants that they are authorised to bind that College.
3. 2.3. Where a College issues access credentials to its Users, the College is responsible for ensuring those Users comply with these Terms and any applicable acceptable-use rules. Each User is required to accept these Terms and the Privacy Policy before accessing the Platform.

3. Description of the Service

1. 3.1. The Platform is a multi-tenant college-management system that enables a subscribing College to administer, among other functions: student admissions and applicant management; student records and registration; department, programme, and course administration; attendance; examinations, scoring, and results; library administration; transport administration; staff records, payroll, leave, and attendance; messaging to guardians, sponsors, staff, and students; and online collection of school fees and application fees.
2. 3.2. Each College operates within its own logically separated tenant. Mahhfaz maintains technical and organisational measures intended to prevent one College from accessing another College’s data.
3. 3.3. Mahhfaz may add, modify, or discontinue features of the Platform. Where a change materially reduces core functionality, Mahhfaz will give the College not less than 30 days’ prior notice by email or in-Platform notice.
4. 3.4. The Platform is provided as software-as-a-service. Mahhfaz does not provide legal, accounting, tax, medical, or educational-compliance advice, and the College remains responsible for its own regulatory obligations.

4. No Subscription Fee; the Commission Model

1. 4.1. No subscription or maintenance fee. The Platform is provided to the College with no upfront, subscription, or maintenance fee. The College’s access continues on an ongoing basis until terminated by either party under Clause 14. Mahhfaz’s remuneration is the Commission.
2. 4.2. Commission. Mahhfaz earns a Commission on school-fee and application-fee payments processed through the Platform. The Commission is added to the amount payable by the payer at checkout, so that the payer (and not the College) bears the Commission. The applicable Commission rate is that agreed with the College during onboarding and recorded in the College’s account.
3. 4.3. Split settlement. Fee payments made by guardians, sponsors, applicants, or students are collected through Paystack and settled by split settlement, with the College’s portion routed to the College’s designated bank subaccount and Mahhfaz’s Commission routed to Mahhfaz. The College is responsible for providing and maintaining accurate subaccount and settlement details.
4. 4.4. Paystack charges. Paystack’s transaction charges are borne by the payer and added to the amount payable at checkout.
5. 4.5. Taxes. All amounts are exclusive of value-added tax and any other applicable taxes or levies. Each party is responsible for the taxes for which it is liable under applicable law.
6. 4.6. Sums owing. Where any sum is properly owing to Mahhfaz and remains unpaid after 14 days’ written notice, Mahhfaz may suspend the Service in accordance with Clause 14.
7. 4.7. Commission non-refundable. Commission already earned on completed transactions is non-refundable, save where a payment is reversed or refunded to the payer, in which case the parties will reconcile amounts in good faith.
8. 4.8. Changes to Commission. Mahhfaz may revise the Commission rate on not less than 30 days’ written notice. A revised rate applies to transactions occurring after the notice period. If the College does not accept the revised rate, its remedy is to terminate under Clause 14.2.

5. Payment Processing and Card Data

1. 5.1. All card and payment-instrument processing is performed by Paystack. Mahhfaz does not collect, store, or have access to full card numbers, card verification values (CVV), or card PINs. Card data is handled entirely within Paystack’s environment.
2. 5.2. The College acknowledges that payment processing is subject to Paystack’s own terms of service and privacy policy, and that Mahhfaz is not liable for acts, omissions, downtime, settlement delays, or decisions of Paystack. See also Clause 11.
3. 5.3. The College authorises Mahhfaz to instruct Paystack to effect split settlement as described in Clause 4.3.

6. Acceptable Use

1. 6.1. The College and its Users must not:
   1. (a) use the Platform for any unlawful purpose or in breach of Data Protection Laws;
   2. (b) upload College Data that the College has no lawful basis to process;
   3. (c) attempt to gain unauthorised access to the Platform, another tenant’s data, or Mahhfaz’s systems;
   4. (d) probe, scan, or test the vulnerability of the Platform, or circumvent any security or authentication measure, except with Mahhfaz’s prior written consent;
   5. (e) introduce malware or any harmful code;
   6. (f) reverse engineer, decompile, or disassemble the Platform except to the extent this restriction is prohibited by applicable law;
   7. (g) resell, sublicense, or provide the Platform to a third party that is not an authorised User, without Mahhfaz’s written consent;
   8. (h) use the Platform to send unlawful, harassing, defamatory, or fraudulent communications; or
   9. (i) upload content that infringes the intellectual-property or privacy rights of any person.
2. 6.2. The College must enforce role-based access appropriately and must not grant a User a role or permission broader than that User’s legitimate function requires.
3. 6.3. Mahhfaz may investigate suspected breaches of this Clause 6 and may suspend access under Clause 14 where necessary to protect the Platform, other Colleges, or Data Subjects.

7. Intellectual Property

1. 7.1. Mahhfaz IP. Mahhfaz and its licensors own all intellectual-property rights in and to the Platform, including its software, source code, object code, design, structure, user interfaces, documentation, and all improvements and derivative works. Nothing in these Terms transfers any such right to the College.
2. 7.2. Licence to the College. Subject to these Terms, Mahhfaz grants the College a non-exclusive, non-transferable, non-sublicensable, revocable licence to access and use the Platform during the term for the College’s internal administrative purposes.
3. 7.3. College Data. As between the parties, the College owns all College Data. The College grants Mahhfaz a licence to host, process, transmit, and display College Data solely to provide, secure, support, and improve the Service, and as instructed by the College, in accordance with these Terms, the Privacy Policy, the DPA, and Data Protection Laws.
4. 7.4. Feedback. If the College provides suggestions or feedback, Mahhfaz may use them without restriction or obligation.
5. 7.5. Aggregated/anonymised data. Mahhfaz may generate and use aggregated and de-identified statistics that do not identify any College or Data Subject, for product improvement and analytics. Such data is irreversibly anonymised before use and is not treated as Personal Data.

8. Data Protection — Roles and Processing

1. 8.1. Controller and Processor roles. With respect to College Data (data about students, applicants, guardians/sponsors and next-of-kin, and staff): (a) the College is the Data Controller; and (b) Mahhfaz is the Data Processor, processing College Data only on the documented instructions of the College and as described in the Privacy Policy and the DPA.
2. 8.2. Mahhfaz as Controller. With respect to the College’s own account, settlement, and marketing data, and to Platform audit and security logs generated for Mahhfaz’s own compliance and security purposes, Mahhfaz acts as a Data Controller.
3. 8.3. Compliance status. Mahhfaz is a data controller/processor of major importance under the NDPA and GAID and is registered (or in the course of registration) with the NDPC accordingly, has appointed a Data Protection Officer, and maintains the records and audit returns required of such an entity.
4. 8.4. Consent for minors. The College, as Controller, is responsible for obtaining and maintaining any consent required under the NDPA for the processing of the Personal Data of any Data Subject who is a minor, and for establishing the lawful basis for all College Data. Mahhfaz provides tools to assist but does not determine lawful basis on the College’s behalf.
5. 8.5. DPA prevails. The DPA sets out the full processing terms and, in case of conflict on the subject matter of data processing, prevails over this Clause 8.

9. Service Levels and Availability

1. 9.1. Mahhfaz will use commercially reasonable efforts to keep the Platform available and to maintain reasonable security and backup practices.
2. 9.2. The Service is provided on a reasonable-efforts basis. Mahhfaz does not commit to a formal service-level agreement or guaranteed uptime figure at this time.
3. 9.3. Availability excludes: scheduled maintenance (for which Mahhfaz will give reasonable notice where practicable); emergency maintenance; failures of third-party services (including Paystack, SMS, email, hosting, and connectivity providers); and events of Force Majeure under Clause 15.

10. Warranties and “AS IS” Disclaimer

1. 10.1. Mahhfaz warrants that it will provide the Service with reasonable skill and care.
2. 10.2. Except as expressly stated in these Terms, and to the fullest extent permitted by applicable Nigerian law, the Platform is provided “AS IS” and “AS AVAILABLE”, and Mahhfaz disclaims all other warranties, conditions, and representations, whether express, implied, statutory, or otherwise, including any implied warranties of merchantability, fitness for a particular purpose, accuracy, and non-infringement.
3. 10.3. Mahhfaz does not warrant that the Platform will be uninterrupted, error-free, or free from harmful components, or that all defects will be corrected.
4. 10.4. The College is responsible for the accuracy, quality, and legality of College Data and for the manner in which its Users use the Platform.

11. Limitation and Exclusion of Liability

1. 11.1. Nothing in these Terms limits either party’s liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any liability that cannot lawfully be limited under Nigerian law, including any statutory liability under the NDPA that cannot be excluded.
2. 11.2. Subject to Clause 11.1, Mahhfaz is not liable for indirect, incidental, special, consequential, or punitive damages, or for loss of profits, revenue, goodwill, or anticipated savings, or for loss or corruption of data to the extent caused by factors outside Mahhfaz’s reasonable control.
3. 11.3. Subject to Clauses 11.1 and 11.2, and to the extent permitted by law, each party’s total aggregate liability arising out of or in connection with these Terms in any 12-month period is limited to the total Commission earned by Mahhfaz on that College’s transactions in that period.
4. 11.4. Mahhfaz is not liable for the acts or omissions of Paystack or of any other third-party service or Sub-processor, save to the extent required by Data Protection Laws in respect of Sub-processors engaged by Mahhfaz.

12. Indemnity

1. 12.1. The College will indemnify Mahhfaz against claims, losses, and reasonable costs arising from the College’s breach of these Terms, its unlawful processing of College Data, or its infringement of a third party’s rights through its use of the Platform, save to the extent caused by Mahhfaz’s own breach or negligence.

13. Confidentiality of Credentials and Security

1. 13.1. The College and each User must keep access credentials confidential, must change any temporary password on first login, and must not share accounts. The College is responsible for activity carried out under its Users’ credentials.
2. 13.2. The College must notify Mahhfaz without undue delay if it suspects any unauthorised access to its tenant.

14. Suspension and Termination

1. 14.1. Suspension. Mahhfaz may suspend access where necessary to protect the Platform, other Colleges, or Data Subjects, or where sums are owing under Clause 4.6, giving notice where practicable.
2. 14.2. Termination for convenience. Either party may terminate on not less than 30 days’ written notice.
3. 14.3. Termination for cause. Either party may terminate immediately on written notice if the other commits a material breach that is not remedied within 14 days of notice.
4. 14.4. Effect of termination. On termination, the College’s licence ends. Offboarding, including the download of examination results and transcripts before deletion, and the return or deletion of College Data, is handled in accordance with the DPA and the retention schedule in the Privacy Policy.

15. Force Majeure

1. 15.1. Neither party is liable for failure or delay in performing its obligations (other than payment obligations) caused by events beyond its reasonable control, including acts of God, flood, fire, epidemic or pandemic, war, civil unrest, terrorism, governmental action, changes in law, failure of national power grids, telecommunications or internet failure, or failure of a third-party service or Sub-processor.
2. 15.2. The affected party will notify the other and use reasonable efforts to mitigate. If the event continues for more than 30 days, either party may terminate the affected Service on written notice.

16. When Things Go Wrong — Incident Handling, Remedies, and Disputes

1. 16.1. Incident handling. If a security incident or personal-data breach affecting College Data occurs, Mahhfaz will handle it in accordance with the breach-notification provisions of the Privacy Policy and the DPA, including notifying the College without undue delay so the College (as Controller) can meet its own obligations to the NDPC and to Data Subjects.
2. 16.2. Remedies. The College’s remedies for defects or failures are, at Mahhfaz’s option and to the extent applicable, correction of the defect or re-performance of the affected Service, subject always to Clauses 11 and 12.
3. 16.3. Complaints and good-faith resolution. Before commencing formal proceedings, a party with a complaint will raise it in writing to the other party’s designated contact, and the parties will attempt in good faith to resolve it within 30 days.
4. 16.4. Arbitration. Any dispute not resolved under Clause 16.3 will be referred to and finally resolved by arbitration under the Arbitration and Mediation Act 2023 of Nigeria. The seat of arbitration is the State in which the College is located or, where appropriate arbitration facilities are not available there, the nearest State with such facilities. The arbitration will be conducted in English before a sole arbitrator appointed in accordance with that Act (ad hoc).
5. 16.5. Governing law. These Terms and any dispute arising out of them are governed by the laws of the Federal Republic of Nigeria.
6. 16.6. Jurisdiction for excluded matters. Matters not subject to arbitration (for example, urgent injunctive relief, or the enforcement of an award) are subject to the exclusive jurisdiction of the courts of Nigeria.

17. Changes to These Terms

1. 17.1. Mahhfaz may amend these Terms from time to time. Mahhfaz will give notice of material changes by email or in-Platform notice not less than 30 days before they take effect. Continued use of the Platform after the effective date constitutes acceptance of the amended Terms. Where a User’s renewed acceptance is required, the Platform will prompt for it at next login. If the College does not accept a material change, its remedy is to terminate under Clause 14.2.

18. General

1. 18.1. Confidentiality. Each party will keep the other’s confidential information confidential and use it only for purposes of these Terms.
2. 18.2. Assignment. The College may not assign these Terms without Mahhfaz’s written consent. Mahhfaz may assign to an affiliate or in connection with a merger or sale of assets, on notice.
3. 18.3. Notices. Notices must be in writing and sent to the contact details on the account or to Mahhfaz at admin@mahhfaz.com.ng.
4. 18.4. Entire agreement. These Terms, the Privacy Policy, and the DPA constitute the entire agreement between the parties and supersede prior agreements on their subject matter. The order of precedence is: (1) the DPA; (2) the Privacy Policy; (3) these Terms.
5. 18.5. Severability. If any provision is held unenforceable, the remaining provisions continue in effect.
6. 18.6. No waiver. A failure to enforce a provision is not a waiver of it.
7. 18.7. No partnership. Nothing in these Terms creates a partnership, agency, or employment relationship between the parties.
8. 18.8. Language. These Terms are in the English language.

19. Contact

Mahhfaz Group
Registered office: No. 17, Kasuwan Yelwa Street, Palace Way, Jalingo, Taraba State, Nigeria
Company registration number: 9612441
General enquiries: info@mahhfaz.com.ng
Legal notices: admin@mahhfaz.com.ng
Data Protection Officer: Anas Muhammad Yahaya — dpo@mahhfaz.com.ng