Privacy Notice

Draft for owner approval. Not yet an approved policy.

Policy owner: [[LEGAL_ENTITY_AND_ADDRESS]]
Contact: [[SUPPORT_CONTACT]]
Effective date: [[EFFECTIVE_DATE]]

Controller and scope The operator identified above is responsible for explaining how Academy learner data is used. Privacy requests contact: [[PRIVACY_CONTACT]]. This notice covers the Academy; authentication, hosting and payment providers also publish their own notices. ## Data and purposes We receive an authenticated account identifier and email through the site sign-in service. We store enrolments, access entitlements, lesson progress, draft answers, submitted work and uploaded files, attempts, scores, feedback, manual reviews and audit records to provide learning, assess completion and protect accounts. Purchases include order reference, school, price, status, discount and policy snapshots. Selfany and its payment processors handle credentials for new purchases; Selar and Paystack remain relevant to historical purchases; the Academy retains transaction and verification information needed to reconcile purchases, issue receipts and manage refunds. Do not submit payment-card details in assignments or enquiry forms. Certificate records include confirmed name, school, completion date, requirements satisfied, verification token and issuance/correction/revocation history. Organisation enquiries include organisation name, contact details, team size and requested support. We use these to respond to the enquiry, not to promise delivery or enrol the team automatically. ## Lawful grounds and optional uses The operator must document appropriate grounds for each activity: account and learning service delivery, payment fulfilment, required recordkeeping and proportionate security. Optional marketing, testimonials, publicity and unrelated analytics require a separate appropriate basis and notice; submitting work is not marketing consent. Final lawful-basis mapping and any sensitive-data processing: [[LAWFUL_BASIS_REGISTER]]. Avoid confidential employer information and sensitive third-party information in maps, reflections and uploads. Use aliases where possible. ## Sharing and service providers Authorised administrators can review learner records for support, grading and access administration. Hosting/storage and sign-in services process data needed to operate the site; Selfany and its payment processors process new school checkout and payment information; historical Selar and Paystack records are retained. Relatia stores the transaction reference, reported/verified amount and currency, account email, school and administrator decision to verify school access. A sponsoring organisation does not automatically receive individual scores or assignments. Any team reporting must be agreed and explained beforehand. Confirmed processor list, international transfers, locations and safeguards: [[PROCESSORS_AND_TRANSFER_DETAILS]]. We do not claim a particular storage jurisdiction without verification. Lawful disclosures may be required; evaluate requests and limit disclosure appropriately. ## Public certificate verification Anyone with a certificate verification link can see only the certificate name, completed school, completion date, certificate ID, issuer and current status. Email, scores, payments and private learner records are excluded. Learners should understand this sharing before confirming their certificate name. Revoked and superseded records retain their status and history. ## Retention, security and rights Retention and deletion schedule by record type, including accounts, drafts, uploads, financial/audit records, enquiries and certificate history: [[RETENTION_AND_DELETION_SCHEDULE]]. No automatic deletion period is promised until implemented and checked. Legal holds and justified statutory retention may limit deletion. Private records use authenticated, server-enforced access. Uploads are private to their owner and authorised administrators. No service can promise absolute security; submit only necessary information. Report suspected exposure to the privacy contact. Incident escalation and required reporting procedure: [[PRIVACY_INCIDENT_PROCEDURE]]. Contact us to request information, access, correction, deletion, restriction or objection where applicable, or to withdraw consent for an optional use. We may verify identity proportionately. Explain any legal reason a request cannot be fully met. Response process and applicable deadlines: [[DATA_RIGHTS_PROCESS]]. Learners may raise relevant data-protection concerns with the Nigeria Data Protection Commission. ## Children and changes Intended age range and guardian process, if applicable: [[AGE_AND_ELIGIBILITY_POLICY]]. Do not claim parental consent or age checks exist until established. Record revisions and effective dates, and notify learners of material changes. See the separate browser storage notice.