At SEP Platform we take your privacy seriously. This policy explains exactly what data we collect, why we collect it, how we use it, and your rights over it.
SEP Platform ("we", "us", "our") is the data controller responsible for your personal information collected through the Platform at https://smarteduplus.com.
We are registered and operate under the laws of the Federal Republic of Nigeria. Our Data Protection Officer (DPO) can be reached at info@smarteduplus.com.
This Privacy Policy applies to all users of the Platform, including students, organisation account holders, and visitors.
| Data Type | Examples | When Collected |
|---|---|---|
| Identity | First name, last name, username | Registration |
| Contact | Email address, phone number | Registration, checkout |
| Account credentials | Hashed password | Registration |
| Organisation details | Company name, industry, contact person | Org registration |
| Payment data | Transaction reference (not card numbers) | Purchase |
| Profile content | Profile photo (optional) | Account settings |
| Communications | Support emails, feedback submissions | When you contact us |
| Data Type | Examples |
|---|---|
| Usage data | Pages visited, courses viewed, time spent per lesson, quiz attempts |
| Device & browser | IP address, browser type & version, operating system, screen resolution |
| Log data | Access timestamps, error logs, HTTP request data |
| Cookies | Session tokens, preference cookies (see §7) |
| Location | Country/region inferred from IP (not GPS) |
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Create and manage your account | Identity, contact, credentials | Contract |
| Process course enrolments and payments | Identity, contact, payment refs | Contract |
| Deliver course content and track progress | Usage, identity | Contract |
| Issue and verify certificates | Identity, completion data | Contract |
| Provide AI tutoring features | Session inputs (anonymised before API call) | Legitimate interest |
| Send transactional emails (receipts, verifications, password reset) | Contact, identity | Contract |
| Send product updates and learning recommendations | Contact, usage | Consent (opt-out available) |
| Improve Platform performance and content | Usage, device data | Legitimate interest |
| Fraud prevention and security | IP, device, logs | Legitimate interest / legal obligation |
| Comply with legal obligations | Any relevant data | Legal obligation |
| Respond to support enquiries | Communications, identity | Contract / legitimate interest |
We process your personal data under the following legal bases as defined by the Nigeria Data Protection Act 2023 (NDPA) and, where applicable, the GDPR:
We do not sell, rent, or trade your personal data. We share data only in the following circumstances:
We share data with vetted third-party processors who help us operate the Platform. All processors are contractually bound to handle data securely and only for the purpose we specify:
| Provider | Purpose | Data Shared |
|---|---|---|
| Paystack | Payment processing | Email, transaction amount |
| AWS / hosting provider | Server infrastructure | All data stored on servers |
| Google (Gemini API) | AI tutoring responses | Anonymised session prompts only |
| Groq API | AI tutoring fallback | Anonymised session prompts only |
| Email delivery service | Transactional emails | Email address, name |
If you access the Platform through an Organisation seat package, your enrolment status, progress, and certificate data will be visible to your Organisation's account administrator.
We may disclose data when required by law, court order, or regulatory authority, or to protect the rights, property, or safety of SEP Platform, our users, or the public.
In the event of a merger, acquisition, or sale of substantially all our assets, your data may be transferred to the successor entity, subject to the same privacy protections. You will be notified via email before the transfer takes effect.
When you interact with ARIA (AI Tutor), the AI Course Builder, or AI-generated assessments:
We use the following types of cookies:
| Type | Purpose | Duration | Can You Opt Out? |
|---|---|---|---|
| Strictly necessary | Session management, CSRF security tokens, login state | Session | No — required for the Platform to function |
| Functional | Language preference, currency selection, remember-me | 30 days | Yes (affects experience) |
| Analytics | Page visit counts, feature usage (anonymised) | 12 months | Yes — via cookie banner |
| Marketing | None currently in use | — | N/A |
You can manage cookie preferences via your browser settings or the cookie consent banner displayed on your first visit. Withdrawing consent for functional or analytics cookies will not affect your ability to use core Platform features.
| Data Category | Retention Period | Reason |
|---|---|---|
| Account & profile data | Duration of account + 2 years | Contractual obligation |
| Course progress & completion records | 5 years after last activity | Certificate verification |
| Payment transaction references | 7 years | Nigerian financial regulation (FIRS) |
| AI conversation logs | 90 days | Session continuity & quality |
| Server & security logs | 12 months | Security & fraud detection |
| Email communication records | 3 years | Dispute resolution |
| Deleted account data | 30 days post-deletion request | Accidental deletion recovery |
After the applicable retention period, data is securely deleted or irreversibly anonymised.
We implement industry-standard technical and organisational security measures including:
In the event of a data breach that is likely to result in high risk to your rights, we will notify you and the relevant supervisory authority within 72 hours of becoming aware, as required by the NDPA and GDPR.
As a Nigerian-based platform using cloud infrastructure and AI APIs hosted internationally (including in the USA and EU), your data may be transferred to and processed in countries outside Nigeria.
Where such transfers occur, we ensure appropriate safeguards are in place:
By using the Platform, you acknowledge and consent to these international transfers subject to the safeguards described above.
The Platform is not directed at children under 13 years of age. We do not knowingly collect personal data from children under 13. If we become aware that we have inadvertently collected data from a child under 13, we will delete it promptly.
Users aged 13–17 must have verifiable parental or guardian consent before registering. If you are a parent or guardian and believe your child has registered without consent, please contact us immediately at info@smarteduplus.com.
Schools and educational institutions accessing the Platform for learners under 18 must ensure appropriate data processing agreements and parental consent mechanisms are in place under their own applicable regulations.
You have the following rights over your personal data. To exercise any right, email us at info@smarteduplus.com with the subject line "Privacy Rights Request". We will respond within 30 days.
| Right | What it means |
|---|---|
| Access | Request a copy of the personal data we hold about you |
| Rectification | Ask us to correct inaccurate or incomplete data |
| Erasure ("Right to be Forgotten") | Request deletion of your data where there is no compelling legal reason to retain it |
| Restriction | Ask us to restrict processing while a dispute or complaint is resolved |
| Portability | Receive your data in a structured, machine-readable format (JSON/CSV) |
| Objection | Object to processing based on legitimate interests, including direct marketing (always honoured for marketing) |
| Withdraw consent | Withdraw consent at any time for consent-based processing (e.g. marketing emails) without affecting prior processing |
| Complaint | Lodge a complaint with the Nigeria Data Protection Commission (NDPC) or your local supervisory authority |
Under the Nigeria Data Protection Act 2023 and the implementing regulations of the Nigeria Data Protection Commission (NDPC), Nigerian residents have specific rights including:
We are committed to full compliance with the NDPA 2023 and will cooperate fully with the NDPC in the event of any investigation or inquiry.
If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the CPRA grants you additional rights:
To exercise your California rights, contact us at info@smarteduplus.com with "CCPA Request" in the subject line. We will respond within 45 days.
The Platform may contain links to third-party websites, social media platforms, or embedded content (e.g. YouTube videos). This Privacy Policy does not apply to those third-party services. We are not responsible for the privacy practices of external sites and recommend reviewing their privacy policies before providing any personal data.
Third-party payment processors (Paystack) have their own privacy policies. By using their payment interfaces you also agree to their terms.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes we will:
Your continued use of the Platform after the effective date of the updated Policy constitutes your acceptance of the changes. If you do not agree to the changes, you may delete your account at any time.
For all privacy-related queries, data subject requests, or to reach our Data Protection Officer:
Subject line: "DPO — Privacy Request"
Nigeria Data Protection Commission
ndpc.gov.ng