Privacy & Data Governance
This notice explains how Studomia LTD collects, uses, shares, protects, and retains personal data across its public website, communications, learning experiences, and institutional work.
It also explains the difference between ordinary website and relationship data, contextual learning signals, governed evidence, and institutional authority.
At a glance
These commitments apply across the public website and carry into more specific learning, pilot, and institutional agreements.
Purpose before collection
We collect personal data only for a defined and understandable purpose.
No sale or advertising profiling
We do not sell personal data or build behavioural advertising profiles.
No automatic authority
Website activity, enquiries, subscriptions, and declared interests do not create eligibility, readiness, priority, evidence, or institutional status.
Context-bound use
Learning-related data is interpreted only within the authorised experience or institutional context in which it was generated.
Human review and accountable decisions
AI-assisted tools may support reflection or synthesis, but they do not independently certify, rank, authorise, or declare competency.
01 · Scope
The same privacy principles apply across Studomia, but the exact data, purpose, lawful basis, and responsibility may differ by context.
Website delivery, security, privacy choices, technical diagnostics, and any optional analytics enabled in accordance with this notice.
Institutional, pilot, partnership, sponsorship, and general enquiries submitted through the shared Contact system.
Consent-managed email communications and the topic preferences selected by subscribers.
Governed participation, reflection, artifacts, contextual signals, institutional records, and any evidence formed under an authorised experience or pilot.
Institutional agreements may assign Studomia and an institution different controller or processor responsibilities. Those agreements do not replace the need for a lawful basis; they define the authorised purpose, roles, safeguards, and operational responsibilities for that engagement.
02 · Data processing
We collect only the information reasonably necessary for the stated purpose. Please do not submit sensitive personal data through a public form unless Studomia has specifically requested and authorised it.
Information you must provide
Required form fields are marked. Without the necessary contact information, enquiry context, or communication consent, we may be unable to route an enquiry, respond, or activate a subscription.
Information received from others
We may receive limited professional contact details from an institution, authorised partner, referral, or public professional source. Where required, we will explain the source and relevant processing when we first contact you.
03 · Learning data
Studomia keeps these categories separate so that ordinary activity, declared interest, participation, and institutional decisions do not collapse into one hidden data process.
Enquiries, subscriptions, source information, and public-site activity support routing, consent-managed follow-up, security, and service improvement. They do not create readiness, eligibility, priority, evidence, or adoption status.
Reflections, artifacts, participation records, and other observations may help make learning visible inside an authorised experience. They remain contextual and must not be treated as conclusions on their own.
Evidence is formed only through authorised, purpose-bound synthesis and review. The applicable experience or institutional agreement defines who may interpret it, for what purpose, and with what safeguards.
Decisions about certification, competency, continuation, access, adoption, or institutional status remain with the authorised human and institutional actors. Studomia technology does not create that authority.
04 · Recipients and transfers
We use service providers only for defined operational purposes and require appropriate confidentiality, security, and data-protection responsibilities.
Some service providers or authorised collaborators may process information outside Nigeria or your country. Where required, Studomia uses recognised transfer mechanisms, contractual protections, risk assessment, access controls, and other appropriate safeguards.
You may request more information about the relevant recipient categories and transfer safeguards through the privacy contact below.
Studomia does not sell personal data, provide it to data brokers, or disclose it for behavioural advertising.
05 · Website technologies
Our public website should remain an orientation surface, not a surveillance surface.
We may use essential cookies, local storage, server logs, or equivalent technologies where necessary for security, network delivery, forms, privacy preferences, accessibility, and core website functionality.
Optional public-site analytics are not active at the effective date of this notice. Before enabling them, Studomia will implement a privacy-preference control and limit collection to route-level and aggregated information needed to understand whether the website is helping visitors orient themselves.
We will not send names, email addresses, organisations, message content, submission identifiers, consent answers, or free-text responses to analytics.
We do not use advertising pixels, cross-site tracking, behavioural advertising profiles, or third-party marketing surveillance.
06 · Retention
When the purpose ends, we delete, anonymise, or reduce the information to the minimum necessary record, unless law, safeguarding, an active dispute, or another documented lawful purpose requires longer retention.
Relationship enquiry content
Active conversation plus up to 6 months after closure
Delete, anonymise, or reduce to the minimum necessary compliance record.
Minimal enquiry audit record
Up to 24 months after closure
Retain only limited metadata needed for consent, governance, claims, or legal accountability.
Active communication subscription
Until unsubscribe or withdrawal
Stop active communications and remove the active subscription within the operational deletion period.
Suppression or consent record
Up to 24 months after withdrawal
Retain only what is necessary to respect the unsubscribe request and demonstrate compliance.
Website and security logs
Normally no more than 30 days
Delete automatically unless required for an active incident, legal duty, or claim.
Institutional or pilot records
As defined by the agreement and applicable law
Review at closure and delete, anonymise, archive, or reduce according to the authorised purpose.
Irreversibly anonymised outputs
May be retained for longer-term research or institutional learning
Retain only where the information is no longer personal data and re-identification is not reasonably possible.
07 · Safeguarded participation
The open public Contact and Invitations & Updates routes are not designed to collect children’s learning records or sensitive personal data.
Where a child or young person participates in a Studomia experience, participation must occur through an authorised and safeguarded context. Age-appropriate information, institutional responsibility, consent or authorisation, and applicable child-protection measures are established before processing begins.
Children’s data is not used for advertising, hidden profiling, unrelated ranking, or automatic eligibility decisions. Higher-risk processing, new technology, sensitive data, or large-scale monitoring is subject to additional assessment, including a data privacy impact assessment where required.
08 · AI and automated decisions
Studomia does not use website enquiries, communication preferences, declared interests, or public-site activity to make solely automated decisions about participation, eligibility, readiness, priority, institutional status, pilot access, competency, or progression.
Inside a defined learning or institutional context, AI-assisted processing may support authorised reflection, organisation, synthesis, or analysis. It remains subject to documented purpose, applicable consent, data minimisation, human review, and institutional governance.
AI-assisted outputs do not independently certify, rank, evaluate, or declare competency, and they do not replace the responsibility of authorised human or institutional decision-makers.
09 · Security and incidents
We investigate suspected personal-data incidents and notify the Nigeria Data Protection Commission, affected individuals, institutions, or other authorities where applicable law requires notification.
No security measure can guarantee absolute protection, but safeguards are reviewed as the website and institutional activity evolve.
10 · Your rights
Rights vary by jurisdiction and may be limited where another legal duty or the rights of another person applies.
Ask whether we process your personal data and request access to it.
Request correction of inaccurate or incomplete personal data.
Request deletion where the data is no longer required or another legal ground applies.
Request restriction of processing in applicable circumstances.
Object to processing based on legitimate interests or to direct communication.
Withdraw consent at any time where consent is the lawful basis.
Request data portability where the right applies.
Ask for information about relevant international-transfer safeguards.
Lodge a complaint with the Nigeria Data Protection Commission or another competent supervisory authority.
Not be subject to a solely automated decision that produces legal or similarly significant effects, except where lawfully permitted and appropriately safeguarded.
How to make a request
Email privacy@studomia.com and describe the request. We may ask for proportionate information to verify identity and protect the rights of other people.
Complaints
You may lodge a complaint with the Nigeria Data Protection Commission or, where applicable, the supervisory authority in the country where you live or work.
Nigeria Data Protection CommissionPrivacy contact
Studomia LTD, Lagos, Nigeria. Requests are reviewed under documented governance procedures and applicable data-protection law.