Data Protection and Privacy Notice

1. Introduction

SPECIAL MATHS ACADEMY LTD (hereinafter referred to as “the Company”) is a company incorporated under the laws of the Federal Republic of Nigeria and engages in the provision of educational services, particularly in mathematics, including the organization of periodic mathematics competitions, assessments, training programmes and related educational activities.

The Company operates an online platform through which applicants may create accounts, submit applications, provide personal information, undergo verification and, where successful, participate in competitions and other educational programmes organized by the Company.

We recognize the importance of privacy and are committed to processing personal data lawfully, fairly, transparently and securely in accordance with:

1. The Nigeria Data Protection Act 2023;
2. Regulations, directives, codes and guidance issued by the Nigeria Data Protection Commission;
3. The General Data Protection Regulation (EU) 2016/679 (“GDPR”), where applicable;
4. Applicable data-protection laws of the countries in which our applicants and participants reside; and
5. Other applicable Nigerian laws.

This Notice explains how we collect, use, store, disclose, transfer and protect personal data relating to applicants, participants, parents, guardians, teachers, schools, website users and other persons who interact with our platform.

2. Identity of the Data Controller

For the purposes of applicable data-protection laws, the data controller is:

Company: Special Math’s Academy Limited

Office: Suit 303B APC Plaza Gwani Street, Wuse Zone 4, FCT Abuja

Websites: specialmaths.ng · specialmathscontest.com

Email: contact@specialmaths.ng

Telephone: +234 816 644 4005

The Company determines the purposes and means by which personal data submitted through its platform is processed.

3. Scope of this Notice

This Notice applies to personal data collected through:

1. The Company’s website, mobile application or online registration portal;
2. Paper or electronic application forms;
3. Emails, telephone calls and other correspondence;
4. Schools, teachers, competition coordinators and authorized representatives;
5. Examinations, assessments, competitions and training programmes;
6. Photographs, audio or video recordings made during Company events;
7. Cookies and similar technologies used on our platform; and
8. Any other lawful interaction with the Company.

4. Personal Data We May Collect

Depending on the nature of the application or programme, we may collect the following categories of personal data:

4.1 Identification and contact information

This may include:

• Full name;
• Residential or mailing address;
• Email address;
• Telephone number;
• Date of birth and age;
• Gender, where genuinely necessary;
• Nationality and country of residence;
• Passport photograph or other profile photograph;
• Signature; and
• Government-issued identification information, where reasonably required for identity verification.

4.2 Educational information

This may include:

• Name and address of school or educational institution;
• Class, year or grade;
• Student identification number;
• Educational qualifications;
• Previous competition records;
• Assessment and examination results;
• Mathematical ability and performance information;
• Teacher, school or examination centre information; and
• Information required to determine eligibility for a competition or programme.

4.3 Parent or guardian information

Where an applicant or participant is a child or otherwise lacks legal capacity to provide valid consent, we may collect:

• The name of the parent or legal guardian;
• Contact details of the parent or legal guardian;
• Evidence of the relationship or authority of the parent or guardian;
• Consent and authorisation records; and
• Information reasonably required to verify identity and authority of the person granting consent.

4.4 Payment and transaction information

Where an application, programme or competition requires payment, we may collect:

• Payment status;
• Transaction reference;
• Billing address;
• Payment method; and
• Other transaction information.

Payment-card details may be processed directly by an authorised third-party payment service provider and may not be stored by the Company.

4.5 Technical and online information

When a person accesses our platform, we may automatically collect:

• Internet Protocol address;
• Device type and device identifier;
• Browser type and version;
• Operating system;
• Login information;
• Date, time and duration of access;
• Pages visited and actions performed;
• Approximate location derived from an IP address;
• Cookies and similar identifiers; and
• Security and system logs.

4.6 Competition and event information

This may include:

• Application and verification records;
• Competition registration number;
• Attendance records;
• Answers, scripts, scores and rankings;
• Information concerning suspected examination or competition malpractice;
• Prizes and awards received;
• Photographs, audio recordings or videos taken during an event; and
• Testimonials or interviews, where separately authorised.

4.7 Special or sensitive personal data

Where strictly necessary, we may collect information concerning a participant’s health, disability, accessibility requirements or other sensitive circumstances to provide reasonable accommodation, protect the participant’s vital interests or satisfy legal obligations.

We will not collect sensitive personal data merely because it may be useful. Such data will be processed only where there is a valid legal basis and appropriate safeguards have been adopted.

5. How We Obtain Personal Data

We may obtain personal data:

1. Directly from an applicant or participant;
2. From a parent or legal guardian;
3. From a school, teacher, competition coordinator or authorised representative;
4. From payment service providers;
5. Automatically through the use of our platform;
6. From service providers engaged to support application processing, identity verification, assessment or competition administration; and
7. From public sources where the law permits.

Where a school, teacher or other representative submits personal data on behalf of a student, that person represents that he or she has lawful authority to provide the information and has given the student and, where necessary, the student’s parent or guardian access to this Notice.

6. Purposes of Processing

We may process personal data for the following purposes:

1. Receiving and reviewing applications;
2. Creating and administering user accounts;
3. Confirming identity, age, educational level and eligibility;
4. Verifying information submitted by applicants;
5. Selecting and registering participants;
6. Organising, administering and supervising competitions, examinations, training and educational programmes;
7. Communicating application outcomes, schedules, instructions, results and other programme information;
8. Marking assessments and determining scores, rankings, prizes and awards;
9. Preventing impersonation, fraud, cheating, examination malpractice and other misconduct;
10. Processing payments and maintaining transaction records;
11. Issuing certificates, awards and evidence of participation;
12. Responding to enquiries, complaints and requests;
13. Protecting the health, safety and welfare of participants;
14. Providing reasonable accommodation to participants with disabilities or special needs;
15. Maintaining the security and functionality of our platform;
16. Improving our educational services and competition processes;
17. Generating anonymised or aggregated statistical and research information;
18. Complying with legal, regulatory, accounting, taxation and reporting obligations;
19. Establishing, exercising or defending legal claims;
20. Protecting the rights, property and legitimate interests of the Company, participants and third parties; and
21. Sending promotional or marketing communications where the recipient has consented or where otherwise permitted by law.

We will not use personal data for a purpose materially incompatible with the purpose for which it was collected unless permitted by law or after giving the affected person appropriate notice and, where required, obtaining fresh consent.

7. Legal Bases for Processing

Depending on the circumstances, the Company may rely on one or more of the following legal bases:

1. Consent: where the applicant, participant, parent or guardian has freely given specific, informed and unambiguous consent;
2. Contractual necessity: where processing is required to process an application or perform a contract relating to participation in a competition or educational programme;
3. Legal obligation: where processing is necessary for compliance with an obligation imposed by law;
4. Legitimate interests: where processing is reasonably necessary for the Company’s legitimate educational, administrative, security or commercial interests, provided those interests are not overridden by the rights and freedoms of the data subject;
5. Vital interests: where processing is necessary to protect the life, health or safety of a participant or another person;
6. Public interest: where processing is necessary for a task carried out in the public interest and is supported by applicable law; and
7. Any other lawful basis recognised under applicable data-protection legislation.

Where we rely on consent, the person concerned may withdraw that consent at any time.

Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn. Withdrawal may, however, affect the Company’s ability to provide a service where the relevant data is necessary for that service.

8. Children and Parental or Guardian Consent

Our competitions and educational programmes may be open to children. We recognise that children’s personal data requires enhanced protection.

Where an applicant or participant is a child under applicable law, the Company will obtain the consent or authorisation of the child’s parent or legal guardian before collecting or processing the child’s personal data where such consent is legally required.

We may take reasonable steps to verify:

1. The age of the applicant;
2. The identity of the parent or guardian;
3. The relationship between the child and the person granting consent; and
4. The authority of that person to act on behalf of the child.

A parent or guardian who supplies personal data on behalf of a child represents that:

1. The information supplied is accurate and complete;
2. He or she has lawful parental responsibility or guardianship authority;
3. He or she has reviewed this Notice; and
4. He or she consents to the processing necessary for the child’s application and participation.

Consent to essential processing must be distinguished from optional consent for publicity, marketing, testimonials, photographs or videos. Refusal to grant optional publicity or marketing consent will not, by itself, disqualify an otherwise eligible applicant.

Where a child attains the legally relevant age of consent, the Company may seek fresh consent directly from that individual where required.

9. Photographs, Recordings and Publication of Results

The Company may take photographs or make audio or video recordings during competitions, award ceremonies and related events.

Where required by law, identifiable photographs, recordings, interviews or testimonials will be used for publicity, promotional or media purposes only after obtaining separate consent from the participant or, in the case of a child, the participant’s parent or legal guardian.

Notwithstanding the foregoing, the Company may publish limited competition information such as a participant’s name, school, country, score, ranking, prize or award where this is reasonably necessary to announce and authenticate official competition results, provided that an appropriate legal basis exists and the information disclosed is limited to what is necessary.

10. Automated Assessment and Decision-Making

The Company may use electronic systems to mark objective questions, calculate scores, verify eligibility or rank participants.

Where a decision producing legal or similarly significant effects is based solely on automated processing, the Company will comply with applicable legal requirements and, where required, provide the affected person with the right to:

1. Obtain meaningful information about the logic involved;
2. Request human intervention;
3. Express his or her point of view; and
4. Challenge or request a review of the decision.

Routine automated marking or ranking does not prevent the Company from conducting manual reviews where an error, irregularity or complaint is reported.

11. Disclosure of Personal Data

We may disclose personal data, only to the extent reasonably necessary, to:

1. Authorised employees, officers and competition officials;
2. Examiners, assessors, invigilators and programme coordinators;
3. Schools, teachers and authorised educational representatives;
4. Website-hosting, cloud-storage and information-technology providers;
5. Identity-verification, cybersecurity and fraud-prevention providers;
6. Payment processors and financial institutions;
7. Logistics, communication and certificate-production providers;
8. Professional advisers, including lawyers, accountants, auditors and insurers;
9. Governmental, judicial, law-enforcement or regulatory authorities where required by law or a valid legal process;
10. A purchaser, investor or successor entity in connection with a lawful corporate restructuring, merger or transfer of business; and
11. Any other person authorised by the data subject or permitted by law.

We do not sell personal data. Service providers processing personal data on our behalf will be required to process it only on documented instructions, maintain confidentiality and implement appropriate security safeguards.

12. International Transfer of Personal Data

Given the fact that our programmes may involve participants and service providers from different jurisdictions, personal data may be accessed, stored or processed outside Nigeria or outside the country in which the data subject resides.

Where personal data is transferred internationally, the Company will ensure that the transfer is supported by a lawful mechanism and appropriate safeguards. These may include:

1. A determination that the receiving country provides an adequate level of protection;
2. Contractual clauses imposing appropriate data-protection obligations;
3. Binding corporate rules, where applicable;
4. Explicit informed consent in circumstances permitted by law;
5. Necessity for the performance of a contract or implementation of pre-contractual measures;
6. Necessity for important reasons of public interest;
7. Necessity for the establishment, exercise or defence of legal claims; or
8. Another transfer mechanism permitted by applicable law.

Where the GDPR applies, transfers outside the European Economic Area will be carried out in accordance with Chapter V of the GDPR.

13. Data Retention

We will retain personal data only for as long as reasonably necessary to fulfill the purposes for which it was collected, satisfy legal, regulatory, accounting or reporting obligations, resolve disputes and enforce agreements.

The applicable retention period may depend on:

1. The nature and sensitivity of the information;
2. The duration of the competition or educational programme;
3. Applicable limitation periods;
4. Safeguarding and child-protection requirements;
5. Taxation, audit and regulatory requirements;
6. The existence of a dispute, investigation or legal claim; and
7. Whether continued retention is necessary to maintain an accurate historical record of results, awards or qualifications.

When personal data is no longer required, it will be securely deleted, destroyed or irreversibly anonymised.

14. Data Security

The Company will maintain reasonable and appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access and other forms of unlawful processing.

These measures may include:

• Access controls and role-based permissions;
• Passwords and authentication controls;
• Encryption where appropriate;
• Secure backups;
• Staff confidentiality obligations and training;
• System monitoring and security testing;
• Incident-response procedures; and
• Contractual safeguards for service providers.

However, no electronic transmission or storage system is entirely immune from risk. While we will take legally required and commercially reasonable precautions, the Company cannot guarantee absolute security against every unauthorised act occurring beyond its reasonable control. This statement does not exclude or limit any responsibility that cannot lawfully be excluded.

15. Personal Data Breaches

Where a personal-data breach occurs, the Company will investigate the incident and take appropriate remedial action.

Where required by applicable law, the Company will notify the Nigeria Data Protection Commission or another competent supervisory authority and will communicate the breach to affected data subjects where the breach is likely to result in a high risk to their rights and freedoms.

16. Rights of Data Subjects

Subject to applicable law and any lawful exemptions, a data subject may have the right to:

1. Obtain confirmation as to whether we process his or her personal data;
2. Request access to and a copy of the personal data;
3. Request correction of inaccurate or incomplete personal data;
4. Request deletion or erasure of personal data;
5. Request restriction of processing;
6. Object to processing based on legitimate interests or for direct marketing;
7. Withdraw consent at any time where processing is based on consent;
8. Request the transfer of personal data in a structured, commonly used and machine-readable format;
9. Object to a decision based solely on automated processing and request human review;
10. Receive information about safeguards used for international transfers;
11. Lodge a complaint with the Nigeria Data Protection Commission or another competent supervisory authority; and
12. Seek judicial or other remedies available under applicable law.

These rights are not absolute. A request may be declined or restricted where continued processing is required by law, necessary for the performance of a contract, required to protect another person’s rights, or necessary for the establishment, exercise or defence of legal claims.

Requests should be submitted through the contact details provided in section 24. We may request reasonable proof of identity and authority before responding.

17. Accuracy of Information

Applicants, participants, parents, guardians and representatives are responsible for ensuring that information supplied to the Company is accurate, complete and current.

The Company may reject or cancel an application, participation, result, prize or award where material information is false, misleading, fraudulent or submitted without lawful authority, subject to the applicable competition rules and the requirements of fairness and due process.

Applicants and participants should promptly notify the Company of any material change to their information.

18. Cookies and Similar Technologies

Our platform may use essential cookies and similar technologies to:

1. Operate and secure user accounts;
2. Maintain sessions and user preferences;
3. Detect fraud or unauthorised activity;
4. Understand how the platform is used; and
5. Improve performance and user experience.

Non-essential analytics, advertising or tracking cookies will be used only with consent where applicable. Further information should be provided in the Company’s Cookie Notice and cookie-preference tool.

19. Marketing Communication

The Company will send electronic marketing or promotional communications only where it has a lawful basis to do so.

Recipients may withdraw consent or unsubscribe at any time by:

• Selecting the unsubscribe link in the communication;
• Adjusting their account preferences; or
• Contacting the Company through the details provided below.

Administrative messages relating to an application, competition, payment, account security or programme participation are not marketing messages and may continue where reasonably necessary.

20. Third-Party Websites and Platforms

Our platform may contain links to websites, applications or services operated by third parties. The Company is not responsible for the privacy practices, content or security of an independent third-party service.

Users should review the privacy notice of the relevant third party before submitting personal data to it. Nothing in this section excludes responsibility for a third party that processes personal data on the Company’s behalf.

21. Competition Disclaimer

Submission of an application does not guarantee verification, selection, qualification, participation, any particular score, ranking, prize, scholarship or other benefits.

Selection and participation remain subject to:

1. Satisfaction of the applicable eligibility criteria;
2. Successful verification of submitted information;
3. Compliance with the official competition rules;
4. Availability of places and resources;
5. Payment of applicable fees, where any; and
6. The Company’s lawful decisions concerning the integrity and administration of the competition.

The Company may verify submitted information and investigate suspected fraud, impersonation, cheating or misconduct. Any disqualification, cancellation or withholding of a result will be carried out in accordance with the competition rules and applicable law.

Nothing in this Notice excludes liability arising from fraud, willful misconduct, gross negligence, breach of statutory duty or any liability that cannot lawfully be excluded.

22. Changes to this Notice

The Company may amend this Notice to reflect changes in law, regulatory guidance, technology or its processing activities.

The revised Notice will be published on the platform with an updated effective date. Where a change materially affects the rights of data subjects or the purposes for which their information is used, we will provide additional notice and obtain fresh consent where legally required.

23. Governing Law

This Notice shall be governed principally by the laws of the Federal Republic of Nigeria.

Where the GDPR or another foreign data-protection law applies to a particular processing activity, the data subject will retain the mandatory rights and protections conferred by that law.

24. Contact and Complaints

Questions, requests or complaints concerning this Notice or the Company’s processing of personal data should be directed to:

Email: contact@specialmaths.ng

Telephone: +234 816 644 4005

A data subject who is dissatisfied with the Company’s response may lodge a complaint with

the Nigeria Data Protection Commission

Where the GDPR applies, a data subject may also complain to the competent supervisory authority in the EU or EEA Member State of his or her habitual residence, place of work or place of the alleged infringement.