RODUCATE APPLICATION PRIVACY POLICY

1. Introduction

Roducate Limited ("Roducate", "we", "us", or "our") operates the Roducate software-as-a-service platform, accessible via our website (the "Website") and mobile application (the "App"), collectively the "Services".

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our Services. It is designed to comply with the Nigerian Data Protection Act, 2023 (NDPA), its implementing regulations, and other applicable laws.

Where we offer services to minors (e.g., students under 18), we require verifiable consent from a parent or legal guardian before collecting their personal data, as detailed in Section 6. By accessing or using our Services, you agree to the terms of this Privacy Policy. If you do not agree, please do not use our Services.

2. Definitions

For the purpose of this Privacy Policy, the following terms shall have the meanings ascribed to them below:

"Aggregated Data" means data derived from your personal data that does not, directly or indirectly, reveal your identity, such as statistical or demographic data used for analysis.

"Counsellor" means a certified guidance counsellor on the Roducate platform who advises student users and/or parents on academic and career issues.

"Comply with a legal obligation" means processing your personal data where it is necessary for us to comply with a legal obligation to which we are subject.

"Consent" means a freely given, specific, informed, and unambiguous indication of your wishes by which you agree to the processing of your personal data.

"Data Controller" means the entity that determines the purposes and means of the processing of personal data. For most Services, Roducate is the Controller.

"Data Processor" means an entity that processes personal data on behalf of and under the instructions of the Data Controller.

 "External Third Parties" means service providers acting as processors based outside of Nigeria who provide IT, system administration, and other services, such as certain cloud hosting providers or international analytics services.

"Institutions" means schools, universities, or other educational bodies registered on the Roducate platform.

"Internal Third Parties” means other companies within the Roducate corporate group acting as joint controllers or processors, based in Nigeria, who provide IT, system administration, and leadership reporting services.

"Legitimate Interest" means our business interest in conducting and managing our business to enable us to provide you with the best service and secure experience. We consider and balance any potential impact on you and your rights before processing your data for our Legitimate Interests.

"NDPA" means the Nigerian Data Protection Act, 2023, which is the principal legislation governing the processing of personal data in Nigeria. It establishes the legal framework for data protection, creates the Nigeria Data Protection Commission (NDPC), outlines the rights of data subjects, and sets forth the obligations of data controllers and processors, including principles for lawful, fair, and transparent processing.

"Performance of a Contract" means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.

"Personal Data" means any information relating to an identified or identifiable natural person ('data subject').

"Processing" means any operation or set of operations performed on personal data, such as collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, alignment, or erasure.

"Professional Advisers" means Lawyers, bankers, auditors, and insurers based in or outside Nigeria who provide consultancy, banking, legal, insurance, and accounting services.

"Regulators" means authorities, including the Nigeria Data Protection Commission (NDPC), who may require reporting of processing activities in certain circumstances.

"Special Category Data" means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, or data concerning a natural person's sex life or sexual orientation.

"Tutor" means an accredited teacher on the Roducate platform who conducts individual or group lessons.

"You / Your" means the user of our Services, which includes students, parents, guardians, tutors, counsellors, institutional representatives, and other visitors to our Website or App.

3. Who We Are (Data Controller)

Roducate Limited is the primary data controller responsible for your personal data processed through our Services. We have appointed a Data Protection Officer (DPO) who is responsible for overseeing any questions concerning this privacy policy. If you have any questions about this privacy policy, including any requests on how to exercise your legal rights, please contact the DPO using the details set out below:

3.1. Contact Details:

• Data Protection Officer (DPO): You can contact our DPO with any questions about this policy or your privacy rights.

• Email: we@roducate.com 

3.3. Roles and Responsibilities. For the vast majority of our Services, including user account management, the tutoring marketplace, content delivery, and platform analytics, Roducate Limited acts as a Data Controller under the NDPA, determining the purposes and means of processing your personal data.

In limited, specific circumstances where an educational Institution uses our platform's administrative tools to manage its own student roster and direct the educational services provided, Roducate may act as a Data Processor on behalf of that Institution. In such cases, the processing is governed by a separate Data Processing Agreement (DPA) with the Institution, which acts as the Controller. Users whose data is processed under such an arrangement will be notified by their Institution, and rights requests should primarily be directed to that Institution.

4. The Data We Collect About You

We collect different types of personal data to provide and improve our Services, as categorised below:

4.1.Data You Provide Directly

• Identity & Contact Data: Name, email, phone number (including WhatsApp), date of birth, gender, institution/school.

• Account & Profile Data: Username, password, preferences, feedback, survey responses.

• Academic & Professional Data: Educational level, enrolled courses, assignments, exam results, progress data (badges, completion rates), tutor/counsellor qualifications, resume, certifications.

• Financial & Transaction Data: Billing address, payment method (Note: we use third-party processors; we do not store full credit card numbers on our servers).

• User-Generated Content: Messages in chats/live classes, assignment submissions, forum posts, comments, questions, and answers.

4.2 Data Collected Automatically

• Technical & Usage Data: IP address, device type, operating system, browser type, unique device identifiers, app crash reports, features accessed, time spent, browsing actions.

• Location Data: General region (from IP). With your explicit permission, precise geolocation (GPS) for features like finding nearby tutors or events.

• Products & Features Data: Interactions with ads (clicks, views), purchase history, marketplace browsing and search queries, storefronts visited.

4.3 Data from Third Parties

• Institutions: Data from your school (e.g., class lists, enrollment status).

• Service Providers: Analytics (e.g., Google Analytics), advertising networks, payment processors (e.g., Flutterwave, Paystack).

• Other Users: Referee information provided during tutor/counsellor verification.

We do not intentionally collect Special Category Data (e.g., race, health, biometrics) or data on criminal convictions.

5. How We Use Your Data (Purposes & Lawful Bases)

We will only use your data when we have a lawful basis to do so.

5.1. Processing of Academic Data. Academic records and performance data may be considered sensitive. We process this data based on the performance of our educational services contract, your explicit consent, or the legitimate interest of facilitating verified tutoring and certification. We apply heightened technical and organizational safeguards to this data.

5.2. Marketing and Your Choices. We will only send you direct marketing communications if you have opted in. You can opt-out at any time by clicking "unsubscribe" in any marketing email, adjusting your preferences in your account settings, or contacting us. Opting out of marketing does not affect transactional or service-related communications.

5.3. Push Notifications. With your explicit consent provided through your device settings upon App installation or later, we may send push notifications to your mobile device for alerts about lessons, messages, platform updates, or promotional content. You can manage your push notification preferences at any time by adjusting the settings on your mobile device or within the App's notification settings.

6. Data Sharing and Disclosure:

We only share your data in the following circumstances:

• With Your Consent: For purposes you authorize.

• Service Providers: With trusted third parties who process data on our instructions (e.g., hosting, analytics, payment processing, customer support). These parties are bound by strict data protection agreements

• Educational Partners: To facilitate services, we may share necessary data with tutors, counsellors, or institutions you engage with through our platform.

• Legal & Safety Reasons: To comply with law, enforce our terms, or protect the rights and safety of Roducate, our users, or others.

• Business Transfers: In connection with a merger, sale, or transfer of company assets.

1. Third-Party Software Development Kits (SDKs) and Embedded Content. Our App integrates specific third-party SDKs to enable core functionality. These third parties collect data directly from your device as governed by their own privacy policies. We carefully vet these partners for compliance. Key categories include:

• Analytics & Performance: (e.g., Google Firebase) to understand app stability and usage patterns.

• Payment Processing: (e.g., Flutterwave, Paystack SDKs) to facilitate secure transactions.

• Cloud & Infrastructure: (e.g., AWS Amplify) for data hosting and backend services.

• Communications: Services that facilitate in-app chat or notifications.

We encourage you to review the privacy policies of these major providers. We do not sell your personal data to third parties for their independent marketing purposes.

7. International Data Transfers

Your data is primarily processed in Nigeria. If we transfer data outside Nigeria (e.g., to a cloud server or an international service provider), we ensure that an adequate level of protection is in place, as required by the NDPA. This is achieved through mechanisms such as the NDPC's adequacy decisions, approved Standard Contractual Clauses (SCCs), or your explicit consent, where applicable.

8. Data Retention

9. Data Retention Period. We will retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, regulatory, or reporting requirements. To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorized use or disclosure, the purposes for processing, and applicable legal requirements.

2. Illustrative Retention Examples:

• Account Data: Retained for the duration of your account's activity plus a period of 24 months after your last login or upon account closure, to facilitate potential re-activation and for our legitimate business analytics.

• Transaction and Financial Records: Retained for 7 years after the transaction to comply with tax and commercial law obligations.

• Communication Logs (e.g., support tickets): Retained for 3 years after the resolution of your inquiry for quality assurance and dispute resolution.

• Technical and Usage Data for Analytics: Aggregated or anonymized where possible; identifiable data retained for 26 months.

Upon expiry of the applicable retention period, or if you exercise your right to erasure (where applicable), we will securely delete or anonymize your personal data so it can no longer be associated with you.

9. Data Security

We implement appropriate technical and organizational measures (encryption, access controls, secure protocols) to protect your data. However, no internet transmission is 100% secure. You are responsible for keeping your login credentials confidential and using secure networks.

10. Data Protection Impact Assessments (DPIAs)

Where processing operations are likely to result in a high risk to the rights and freedoms of data subjects, particularly when involving the systematic processing of children's data, large-scale use of sensitive data, or systematic monitoring of a publicly accessible area, we will conduct a Data Protection Impact Assessment (DPIA) in accordance with the NDPA. The DPIA will describe the processing, assess its necessity and proportionality, evaluate risks, and outline mitigating measures to protect your data.

11. Data Breach Notification

We have procedures in place to deal with any suspected personal data breach. In the event of a breach that is likely to result in a high risk to your rights and freedoms, we are committed to:

1. Notifying the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of the breach, where legally required.

2. Notifying you, the affected data subject(s), without undue delay if the breach is likely to result in such high risk, in clear and plain language.

3. Documenting all breaches, including the facts, effects, and remedial actions taken.

12. Data Relating to Children/Minor

12.1. Age Eligibility and Parental Control: The Roducate Services are designed for users of all age. In accordance with the NDPA, a valid consent to data processing can only be given by an individual aged 18 years or above. Therefore, the Roducate App is intended to be downloaded and accounts created solely by a parent or legal guardian for use by their ward or child. By downloading the Application, creating an account for a minor, and agreeing to this Privacy Policy, the parent or guardian provides the necessary verifiable parental consent for the collection and processing of the minor's personal data as described herein. For the purposes of this policy and compliance with the NDPA, the consent provided by the parent or guardian is deemed to be the consent of the minor user.

12.2. Our Commitment: We limit the collection of personal data from minors to what is necessary for the educational and service functionality of the platform. We do not knowingly collect personal data directly from children under the age of 13.

12.3. 12.3 Parental Rights: Parents and guardians who create accounts retain the right to:

• Review the personal data collected from their ward.

• Request correction of inaccurate data.

• Refuse further collection or use of their ward's data.

• Request deletion of their ward's account and associated data.

To exercise these rights, the account-holding parent or guardian should contact us using the details provided in Section 3.1.

13. Your Legal Rights (Under the NDPA)

You have the following rights regarding your personal data:

• Access: Request a copy of your data.

• Rectification: Request correction of inaccurate or incomplete data.

• Erasure ("Right to be Forgotten"): Request deletion of your data under certain conditions.

• Restriction: Request we limit the processing of your data.

• Objection: Object to processing based on our legitimate interests.

• Data Portability: Request transfer of your data to another provider.

• Withdraw Consent: Where processing is based on consent, you may withdraw it at any time.

To Exercise Your Rights: Please contact our DPO using the details in Section 3.1. To process your request securely, we require verification of your identity. You may be asked to provide specific information to help us verify your identity. We will respond to all legitimate requests within one (1) month. If your request is complex, we may extend this period by an additional two months and will notify you of the delay.

14. Cookies and Similar Technologies

We use cookies and similar tracking technologies to analyze trends, administer the Website/App, and track user movements. You can control cookies through your browser settings. Disabling cookies may affect the functionality of parts of our Website.

15. Third-Party Links

Our Services may contain links to third-party websites, plug-ins, or applications. Clicking on those links may allow third parties to collect or share data about you. We do not control these third-party sites and are not responsible for their privacy policies or practices. We encourage you to read the privacy policy of every site you visit.

16. Changes to This Privacy Policy

We may update this policy periodically. The updated version will be posted on our Website/App with a new "Last Updated" date. If changes are material, we will notify you via email or an in-app notice. Your continued use after such notice constitutes acceptance of the updated policy.

17. Contact & Complaints

For questions, to exercise your rights, or to lodge a complaint about our data handling, please first contact our DPO at we@roducate.com. We are committed to resolving any concerns. You also have the right to lodge a complaint directly with the Nigeria Data Protection Commission (NDPC) at their official website or offices.

18. Governing Law

This Privacy Policy and any disputes related thereto shall be governed by and construed in accordance with the laws of the Federal Republic of Nigeria.