Privacy Policy

This policy applies to everyone whose personal data we process, including:

• Parents and guardians who create an account and enrol one or more children;
• Students (children) enrolled in our cohorts, including self-managed student accounts;
• Undergraduate learners who apply for and enrol in undergraduate tracks;
• Teachers and tutors engaged to deliver classes;
• Website visitors and prospective customers.

Depending on how you use the Platform, we may collect:

• Account & identity data — name, email address, phone number, city, password (stored only as a secure hash), profile photo, and role (parent, student, teacher, undergraduate).
• Child data — a child’s first and last name, grade level (e.g. JSS1–SS3), target outcome/learning goal, enrolments, attendance, assignment and assessment results, certificates, and progress notes written by teachers.
• Enrolment & learning data — cohorts and courses selected, class attendance (live and replay views), assignment submissions, assessment scores, and completion/certificate status.
• Payment data — records of invoices, amounts, currency (NGN), payment status and part-payments. Card and bank details are processed directly by our payment processors (see Section 6); we do not store full card numbers.
• Teacher data — subjects, credentials/qualifications, background-check status, ratings, and bank/payout details.
• Live-class data — because classes are delivered on Google Meet, we and Google process class recordings, attendance and, where you participate, your audio, video and chat contributions. Recordings are made available as in-app replays.
• Communications — messages you send us, and our WhatsApp, SMS and email correspondence (including the weekly parent digest).
• Technical & usage data — IP address, device and browser information, log data, and analytics about how you use the Platform (see our Cookie Policy).

Under the NDPA we must have a lawful basis for each use of personal data. We rely on the bases below:

• Performance of a contract — to create and manage accounts, enrol students, schedule and deliver classes, track attendance, grade assessments, issue certificates, and provide the parent dashboard.
• Consent — for optional communications and non-essential analytics cookies, and (via a parent or guardian) for the processing of a child’s data. Consent may be withdrawn at any time (see Section 9).
• Legal obligation — to meet tax, accounting, safeguarding and regulatory requirements.
• Legitimate interests — to secure the Platform, prevent fraud and abuse, improve our services, and communicate service updates, provided these interests are not overridden by your rights. For children, we apply this basis only where clearly in the child’s interest.
• Vital interests — in rare cases, to protect the safety of a child or other person.

During a cohort we send parents a weekly digest and related notifications by WhatsApp, SMS and email summarising their child’s attendance, assessment performance and teacher notes. These are part of the service we provide to enrolled families. You can adjust notification preferences in your settings or by contacting us; note that some messages (for example, security, billing and safeguarding notices) are essential and cannot be switched off while you hold an account.

We do not sell personal data. We share it only as necessary with:

• Teachers assigned to a child’s cohort — limited to what they need to teach, mark attendance and assess.
• The relevant parent/guardian — a parent can see the data of the children on their account.
• Service providers (data processors) acting on our instructions — see Section 6.
• Regulators, law enforcement or courts — where required by law or to protect our rights or the safety of a child.
• A successor entity — in connection with a merger, acquisition or reorganisation, subject to this policy.

We use trusted third parties to run the Platform. Each acts as our processor under a data processing agreement and may process data outside Nigeria (see Section 7):

• Google (Workspace / Meet / Calendar / Drive) — live classes, scheduling and recordings.
• Paystack and Flutterwave — payment processing.
• Resend — transactional and digest email.
• [SMS/WhatsApp provider, e.g. Termii / WhatsApp Business] — SMS and WhatsApp messages.
• Cloudinary — storage and delivery of uploaded files and images.
• [Hosting/database provider — Neon / cloud host] — application hosting and our PostgreSQL database.
• [Analytics provider, e.g. PostHog] — product analytics (where enabled).

[Confirm the final list of providers and their locations with the legal/engineering team before publication.]

Some of our service providers store or process data on servers located outside Nigeria (for example, in the United States or Europe). Where we transfer personal data outside Nigeria, we do so in accordance with the NDPA — relying on an adequacy decision by the NDPC, appropriate safeguards (such as contractual data-protection clauses), or another lawful transfer mechanism — and we take steps to ensure your data remains protected. You may contact us for more information about the safeguards in place.

Protecting children is central to what we do. Under the NDPA a “child” is a person under 18 years of age, and a child under 13 cannot give valid consent to the processing of their personal data.

• Parental consent. A child is enrolled by a parent or legal guardian, who provides consent for us to process the child’s data for the purpose of delivering education and the associated services. Where a student manages their own account, we require confirmation that a parent or guardian has consented.
• Education purpose. We process children’s data primarily to provide education under the responsibility of professional teachers who owe a duty of confidentiality, as contemplated by the NDPA.
• Data minimisation & segregation. We collect only the child data we need, keep it segregated, and apply heightened safeguards comparable to those for sensitive data.
• Age & consent verification. We take reasonable steps, appropriate to available technology, to verify that the person providing consent is the child’s parent or guardian. [Confirm the verification method used at enrolment.]
• Parental controls. Parents can access, review and request correction or deletion of their child’s data, and can withdraw consent by contacting us or closing the account.

Subject to the conditions in the NDPA, you have the right to:

• be informed about how your data is used;
• access the personal data we hold about you;
• request correction of inaccurate or incomplete data (rectification);
• request erasure of your data (“right to be forgotten”);
• restrict or object to certain processing;
• data portability — receive your data in a portable format;
• withdraw consent at any time, without affecting prior lawful processing;
• not be subject to a decision based solely on automated processing that significantly affects you; and
• lodge a complaint with the NDPC (see Section 13).

To exercise any right, contact us using the details in Section 13. We will respond within the timeframe required by the NDPA. Where the error or issue was caused by us, correction is made at no cost to you.

We keep personal data only for as long as necessary for the purposes described in this policy, including to provide the service, maintain academic records and certificates, meet legal and tax obligations, and resolve disputes. When data is no longer needed, we delete or anonymise it. [Confirm specific retention periods per data category with the legal team — e.g. academic/certificate records, financial records, and account data after closure.]

We use technical and organisational measures appropriate to the risk, including encryption in transit, hashed passwords, access controls limiting staff and teacher access to what they need, and vendor agreements with our processors. No system is perfectly secure, but we work to protect your data and to detect and respond to incidents.

If a personal-data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the NDPC within 72 hours of becoming aware of it, where required, and will inform affected individuals without undue delay where the NDPA requires it.

For any privacy question, to exercise your rights, or to reach our Data Protection Officer:

• Data Protection Officer: [DPO NAME], [dpo@wedelclassroom.com]
• Post: [LEGAL ENTITY NAME], [REGISTERED ADDRESS], Nigeria
• General support: [support@wedelclassroom.com]

If you believe we have not handled your data properly, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

We may update this policy from time to time. We will post the updated version here and change the “Last updated” date above; where changes are significant, we will notify you through the Platform or by email.