Privacy notice
How This institution collects, uses and protects your personal data, and the rights you have under the Nigeria Data Protection Act 2023.
Who is responsible for your data
This institution ("we") is the data controller for the personal data described in this notice. We decide why and how it is processed, and we are accountable for it under the Nigeria Data Protection Act 2023.
Our student records system is operated for us by Xdosdev Digital, which acts as our data processor. It processes your data only on our documented instructions and may not use it for its own purposes.
Data Protection Officer
We have not yet published a named Data Protection Officer for this institution. Until we do, please send data protection enquiries to our general contact and mark them "Data Protection".
What we collect
The categories of personal data we hold depend on your relationship with the institution. They may include:
- Identity and contact details — name, date of birth, gender, photograph, matriculation or staff number, email address, phone number, postal address
- Academic records — programme and course registration, attendance, assessment and examination scores, grades, GPA and CGPA, transcripts, academic standing and graduation records
- Admissions data — application details, qualifications, supporting documents and admission decisions
- Financial records — fees assessed and paid, payment references, receipts, scholarships and instalment arrangements
- Employment records, where you are a member of staff — role, payroll, leave, performance reviews and workload
- Campus services data — library loans, hostel allocation, health records where you use the campus clinic, disciplinary records and club membership
- Technical data — sign-in times, IP address and device information captured in our security and audit logs
Why we use it, and our lawful basis
We process your data for the following purposes. Each is tied to a lawful basis under section 25 of the Act:
- To admit, register and teach you, and to award your qualification — performance of our contract with you, and the performance of a task carried out in the public interest
- To assess you and maintain your academic record — contract and public interest
- To bill and collect fees and process payments — contract, and compliance with a legal obligation
- To meet reporting duties to regulators and accreditation bodies — legal obligation
- To keep our systems and your account secure, including audit logging and detecting misuse — our legitimate interest in protecting the institution and its members
- To send you notices about your studies, classes and results — contract
- To handle complaints, disciplinary matters and grievances — public interest and legal obligation
- Health data from the campus clinic is sensitive personal data, and is processed only for your care, with your consent or where the Act otherwise permits
Who we share it with
We do not sell your personal data, and we do not share it for advertising. We share it only where we need to:
- Xdosdev Digital, which operates this system for us as our processor
- Our hosting provider, which runs the servers and managed database this system uses
- Payment providers — Paystack, and Flutterwave where used — when you make a payment. They receive only what is needed to take the payment
- Our email delivery provider, when we send you a notification
- Our error-monitoring provider, when a fault occurs, so we can diagnose and fix it. Reports are stripped of identifying details before they are sent — no names, email addresses, record numbers or form contents
- Our video conferencing service, when you join a live class
- Regulators, accreditation bodies and government agencies, where we are required by law to report
- Professional advisers, auditors and law enforcement, where we are legally obliged or permitted to disclose
Where your data is stored
This system's servers and its primary database are hosted in London, United Kingdom. Backups and uploaded files are held with a cloud storage provider that may also store them outside Nigeria.
Our error-monitoring provider processes fault reports in the United States. Those reports are stripped of identifying details before they leave this system.
This means your personal data is transferred outside Nigeria. Where that happens we rely on the safeguards permitted by section 43 of the Act, including contractual protections with our providers requiring them to protect your data to a standard adequate under Nigerian law.
You may ask our Data Protection Officer for details of the safeguards that apply.
How long we keep it
We keep your data for as long as we need it for the purposes above, and then for as long as the law requires us to.
- Academic records, transcripts and graduation records are retained permanently — a degree must remain verifiable for the rest of your life
- Admissions records for applicants who are not admitted are kept for a limited period and then removed
- Financial records are kept for the period required by tax and audit law
- Security and audit logs are kept so that access to your record can be investigated after the fact
- Uploaded documents and photographs are removed when the record they support is removed
Your rights
Under the Nigeria Data Protection Act 2023 you have the right to:
- Ask what personal data we hold about you, and receive a copy of it
- Have inaccurate data about you corrected
- Ask us to delete your data, where we are not required to keep it
- Ask us to restrict how we use your data while a dispute about it is resolved
- Receive the data you gave us in a portable form, and ask us to transfer it where technically feasible
- Object to processing we carry out on the basis of our legitimate interests
- Withdraw your consent at any time, where we relied on consent — this does not affect processing carried out before you withdrew it
- Not be subject to a decision based solely on automated processing that significantly affects you. We do not make such decisions
How to exercise your rights
To exercise any of the rights above, write to us, describing what you want and enough detail for us to find your record.
We will respond within the timeframe set by the Act. We may need to confirm your identity first, so that we do not disclose your record to someone else. There is no charge for a first request.
If you are not satisfied
If you are unhappy with how we have handled your data or your request, please tell us first so we can try to put it right.
You also have the right to complain directly to the Nigeria Data Protection Commission (NDPC), which regulates data protection in Nigeria. You can reach the Commission at https://ndpc.gov.ng or info@ndpc.gov.ng. Complaining to us first is not a precondition.