Privacy Notice

SkillearnIQ Hub — Privacy Notice Effective date: 25 September 2026 1. Who is responsible for your information? SkillearnIQ Hub LTD operates SkillearnIQ Hub at https://skillearniqhub.com and is responsible for the personal information described in this notice. Postal correspondence: Suite 24, Adonai Plaza, Egbeda, Lagos, Nigeria. Contact our privacy lead through info@skillearniqhub.com, using “Privacy request” in the subject, or use https://skillearniqhub.com/contact and ask for the privacy team. This notice covers visitors, learners, parents and guardians, tutor applicants, approved tutors and people who contact us. If a school arranges a separate service, we will explain the school’s and SkillearnIQ’s respective roles rather than assume that every school arrangement works in the same way. 2. Information we collect - Account and access information: name, email address, date of birth, account type, password hash, verification status, sign-in/session records and acknowledged notice versions. - Learning information: selected examination and subjects; lesson activity and completion; answers, attempts, marks and released feedback; saved resources; submitted assignments; and class enrolment, joining or attendance records where these features are available. - Family and tutor information: requested and confirmed relationships, authority-review records, tutor biography, subjects, experience, credentials and application decisions. - Transaction information: purchaser and order references, plan, amount, currency, transaction status, access period, receipts, cancellations and refund or dispute records. Payment-card authentication takes place with the payment provider when checkout is enabled; do not send card details to support. - Enquiries and cases: your contact details, messages, case references and relevant evidence supplied through approved channels. A safeguarding report may contain sensitive information; share only what is needed to explain the concern. - Technical information: information needed to operate and protect the website, including IP addresses in relevant server/security records, browser information, request timestamps, session identifiers and preferences. - Optional usage information: with your analytics choice, limited discovery and interaction events, such as a registration or selected call to action and permitted campaign labels. We receive information from you, a person authorised to act for you, tutors providing your learning service, and providers confirming a relevant transaction or delivery. Tell us if information about you is inaccurate. 3. How we use information We use account information to establish access, verify contact details and deliver requested services. Learning records support lessons, assessment, feedback and progress views. Confirmed family links allow the permitted progress information to reach the right adult. Application information supports tutor review and assignment. We use order records to confirm payment, manage access and resolve billing issues. We use support and safeguarding information to investigate concerns and take appropriate action. Technical and audit records help prevent misuse, diagnose failures and account for privileged changes. Backups support recovery from loss or disruption. Optional analytics help us understand how people discover and use the public site. Optional communications are managed separately from necessary verification, recovery, billing and security messages. We do not sell personal information or use learner records for behavioural advertising. 4. Legal grounds and your choices Depending on the purpose, processing may be necessary for a contract or requested pre-contract steps, compliance with a legal obligation, our assessed legitimate interests, protection of vital interests, or your consent. We document the applicable ground; accepting a notice is not blanket consent to every use of information. Sensitive information requires an additional applicable condition. Optional marketing and analytics depend on your separate choice. You may withdraw that choice without losing ordinary learning access. Withdrawal does not undo processing already carried out lawfully. We assess an objection to other processing against its purpose and your circumstances. 5. Children, parents and guardians We explain services in language appropriate to learners. Our account policy requires a confirmed parent or guardian for learners under 18. Where we rely on consent for a child, we obtain appropriate parent/guardian consent and verify age and authority proportionately. We do not rely on an educational exception to avoid that review. A family link permits defined progress and participation information, not unrestricted access to every private conversation, safeguarding report or another person’s data. We review disputed authority and potentially unsafe disclosure requests. Information may need to be withheld from a particular adult where disclosure would put a learner at risk or breach another person’s rights. An adult learner’s family access remains subject to a confirmed relationship and applicable permissions. Contact us to review a link or correct your age or relationship details. 6. Who receives information? Access within SkillearnIQ is limited by role and task. Relevant tutors may see assigned learning work; confirmed parents or guardians may see permitted information about the linked learner. Safeguarding case access is restricted to authorised personnel and the appropriate reporter view. We use service providers for hosting and, when the corresponding service is activated, transactional email, payment processing, private video delivery, document processing and recovery storage. The selected providers for this deployment are: Website hosting: Namecheap (namecheap.com), for website hosting on a server in the United States of America. Transactional email: Zoho ZeptoMail, for the recipient address and necessary message content when production delivery is enabled. Payments: Paystack, for checkout and transaction verification when an approved paid offer is enabled. Its own notice explains processing for its independent payment obligations. Lesson video: Cloudflare Stream, for approved media and playback-related information when production media is enabled. Document processing: Cloudmersive scanning and Microsoft Azure Document Intelligence, for authorised uploaded files when the approved import service is enabled. These are not an unrestricted route for safeguarding evidence. Recovery: Backblaze B2, for encrypted recovery copies when the production backup service is activated. This list distinguishes selected services from active processing: local tests do not mean all services are active for production users. We will keep the published list and actual processing aligned. Providers must receive only information needed for their assigned purpose and appropriate contractual safeguards. We may share relevant information with competent authorities where required or otherwise lawfully justified, including protection from serious harm. We assess the request, authority and scope. We do not make learner accounts or private progress publicly searchable. 7. Processing outside Nigeria The website is hosted by Namecheap on a server in the United States of America. Information submitted to the hosted application is therefore processed outside Nigeria. Namecheap publishes a Data Processing Addendum covering its processing role, confidentiality, security and international transfers: https://www.namecheap.com/legal/universal/data-processing-addendum/. We assess international processing against applicable Nigerian requirements; a provider's standard contract is not, by itself, a guarantee of compliance. Additional services listed above remain subject to review of their production destinations, contractual protections and access arrangements before activation. You may request information about the protections relevant to your information through our privacy contact. 8. Cookies and optional analytics Essential cookies support sessions, sign-in, security and saved choices. Blocking these may prevent account functions from working. Optional first-party analytics run only after you choose to allow them. Use Analytics preferences in the website footer to allow, decline or withdraw that choice. The current public site does not load advertising trackers. Account communication settings control supported optional messages. Essential account or security messages may still be needed to provide the service. The outgoing address noreply@skillearniqhub.com is not the privacy contact. 9. How long we keep information Retention depends on the purpose, account activity, applicable obligations and documented disputes or safety holds. We review information for deletion or anonymisation when it is no longer needed. Account closure does not instantly erase every learning, financial or safeguarding record. Our retention schedule uses the following availability periods and review points: - Personal-data exports: generated downloads are available for 24 hours. Expiry of the download does not erase the underlying account records. - Routine technical and delivery logs: reviewed at 90 days from creation for deletion or anonymisation, unless a documented incident or legal need requires continued retention. - Security audit records: reviewed after 12 months from the recorded event. Any continued retention needs a documented security, accountability or legal reason and a further review point. - Ordinary support records: reviewed after 12 months from case closure. Unresolved cases remain subject to review while the concern is being addressed. - Inactive account and learning records: reviewed after 24 months of inactivity. We give 30 days' notice before closing an inactive account and deleting or anonymising eligible records, subject to applicable legal or safety restrictions. - Financial and safeguarding records: retained only for documented legal, dispute-resolution or safety needs. The responsible reviewer records the reason, scope and next review point; these records are not kept indefinitely without review. Review points do not promise immediate deletion on a fixed date. At review, information that is no longer needed is identified for controlled deletion or anonymisation; continuing retention requires a recorded justification. We will explain a continuing retention reason when handling an erasure request. Protected backups may retain an older copy until lawful rotation. Recovery copies are kept only for the recovery need and any applicable protection period, with their continued retention reviewed when that period ends. They are restricted to recovery use. Restored data must have subsequent approved erasures and access revocations reapplied. Retention holds require a recorded reason and review; they are not permission to retain everything indefinitely. 10. Security and incident handling We use measures appropriate to the information and service, including HTTPS, hashed passwords, role-based access, private file storage and recorded administrative actions. Security controls reduce risk but cannot guarantee that every incident is prevented. Tell us promptly about suspected account compromise. Do not include passwords, verification codes or API keys in a report. We assess security incidents, take containment and recovery steps, and notify affected people and the relevant regulator where required. 11. Your rights and how to ask Subject to applicable conditions, you may request access, correction, erasure, restriction or portability, object to processing, withdraw consent and seek review of relevant automated decisions. You can also complain to the Nigeria Data Protection Commission at https://ndpc.gov.ng. Use account privacy tools where available, or contact the privacy team even if you cannot sign in. Tell us what you need and which account is involved. We verify identity and representative authority proportionately, explain any additional information needed, and respond within the applicable period. If we cannot fulfil a request in full, we explain the reason and review route. An account export may omit another person’s information or restricted records. Ask for officer review if you need additional disclosable information; the export’s scope is not the full extent of your legal rights. Grades and progress are learning feedback, and are not official admissions decisions. You may ask us to review a disputed record or access decision. 12. Updates We identify the current version and effective date. Material changes will be made available and, where appropriate, drawn to your attention. Re-acknowledging this notice does not silently change your separate marketing or analytics choices.