NDPR Compliance Statement

1. Data Controller

The data controller for personal data processed through the Ednaimo platform is:

Email: operations@ednaimo.com

Ednaimo determines the purposes and means of processing personal data collected through the Ednaimo adaptive learning platform for children ages 2-16 in Nigeria.

2. About This Statement

This statement explains how Ednaimo collects, uses, stores, and protects personal data in compliance with the Nigeria Data Protection Regulation (NDPR) 2019, the NDPR Implementation Framework, and the Nigeria Data Protection Act 2023. It applies to all users of the Ednaimo platform, including parents, guardians, and the child profiles they manage.

3. Data We Collect

3.1 Parent/Guardian Data

Parents and guardians create accounts through Firebase Authentication. We collect:

• Full name
• Email address
• Payment information (used solely for consent verification purposes)

3.2 Child Profile Data

Children do not create accounts. Parents and guardians create and manage child profiles on their behalf. For each child profile, we collect:

• First name only (no surname)
• Age
• Grade level
• Learning progress and performance metrics
• Engagement telemetry (how the child interacts with learning content)

3.3 Technical and Session Data

• Session logs (subject to a 30-day time-to-live; automatically deleted after 30 days)
• Child session tokens anonymized using SHA-256 hashing; these tokens cannot be reversed to identify a child

4. Lawful Basis for Processing

We process personal data under the following lawful bases as recognised by the NDPR:

4.1 Consent

Parents and guardians provide explicit, informed consent when creating an account and adding child profiles to the platform. Consent covers:

• Collection and processing of parent/guardian personal data
• Collection and processing of child profile data for adaptive learning purposes
• Use of AI models to generate and personalise educational content

Parents may withdraw consent at any time by deleting child profiles or their account. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

4.2 Legitimate Interest

We rely on legitimate interest for limited processing activities related to platform safety and security, including:

• Fraud prevention and abuse detection
• Ensuring the safety and integrity of the learning environment
• System monitoring to maintain platform availability

In each case, we have assessed that these interests do not override the fundamental rights and freedoms of data subjects, particularly given the additional protections we apply to children's data.

5. How We Use Data

Personal data is processed for the following purposes:

• Adaptive learning delivery: AI-powered content generation and personalisation using Google Gemini models via Vertex AI, tailored to each child's age, grade level, and learning progress
• Account management: Authenticating parent/guardian accounts and managing child profiles
• Learning analytics: Providing parents with insight into their child's progress
• Platform improvement: Aggregated, anonymised analysis to improve educational content and platform performance
• Safety and compliance: Monitoring for misuse and ensuring a safe learning environment

We do not use personal data for behavioural advertising. We do not employ third-party tracking technologies. We do not sell, rent, or share personal data with third parties for marketing purposes.

6. AI-Generated Content

Ednaimo uses Google Gemini large language models, accessed through Google Vertex AI, to generate educational content adapted to each child's learning level. The AI models receive only the minimum data necessary to personalise content: the child's age, grade level, and relevant learning progress indicators. No parent personal data is sent to the AI models. Child data sent to the models does not include surnames or other directly identifying information.

7. Data Storage and Security

7.1 Storage Location

All personal data is stored on Google Cloud Platform (GCP) in the Africa-South 1 region (Johannesburg, South Africa). This means data remains within the African continent.

7.2 Security Measures

We implement appropriate technical and organisational measures to protect personal data, including:

• Encryption of data in transit (TLS) and at rest
• SHA-256 hashing of child session tokens to prevent re-identification
• Role-based access controls limiting internal access to personal data
• Automatic deletion of session logs after 30 days
• Regular security assessments and vulnerability testing
• Firebase Authentication for secure parent/guardian account management

8. Cross-Border Data Transfers

Primary data storage is within the African continent (GCP africa-south1, Johannesburg). However, certain processing activities may involve cross-border data transfers due to the distributed nature of Google Cloud Platform infrastructure. These transfers may occur in the following circumstances:

• AI content generation: Requests to Google Gemini models via Vertex AI may be processed in data centres outside Africa, depending on model availability and routing. Only minimal, non-directly-identifying child data (age, grade level, learning progress) is included in these requests.
• Infrastructure services: Certain GCP support services (such as monitoring, logging, and security tools) may process data outside the africa-south1 region.

For all cross-border transfers, we ensure adequate safeguards are in place in accordance with the NDPR, including:

• Google Cloud's compliance with international data protection standards and certifications
• Contractual protections through Google Cloud's Data Processing Agreement
• Assessment that receiving jurisdictions provide adequate data protection or that appropriate supplementary measures are applied

9. Data Subject Rights

Under the Nigeria Data Protection Regulation and the Nigeria Data Protection Act, parents and guardians have the following rights in relation to their own data and the data of children whose profiles they manage:

• Right of access: Request a copy of the personal data we hold about you or your child's profile
• Right to rectification: Request correction of inaccurate or incomplete personal data
• Right to erasure: Request deletion of personal data, subject to any legal obligations requiring retention
• Right to restrict processing: Request that we limit how we use personal data in certain circumstances
• Right to data portability: Receive personal data in a structured, commonly used, machine-readable format
• Right to object: Object to processing based on legitimate interest
• Right to withdraw consent: Withdraw consent at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at operations@ednaimo.com. We will respond to verified requests within 30 days. We may request proof of identity and confirmation of parental/guardian relationship before processing requests related to child profile data.

10. Data Retention Schedule

The table below outlines our data retention schedule:

Aggregated, anonymised analytics are retained indefinitely (not applicable, as they contain no personal data).

11. Data Protection Impact Assessment (DPIA) Summary

Ednaimo has conducted a Data Protection Impact Assessment in accordance with NDPR requirements, given that the platform processes children's data and uses AI-driven profiling for educational personalisation.

Key findings:

• Nature of processing: The platform processes limited personal data of children (first name, age, grade level, learning progress, engagement telemetry) for the purpose of adaptive education. Children do not create accounts and are not directly identified beyond their first name.
• Risks identified: (a) Potential re-identification of children through learning progress patterns; (b) cross-border data transfer risks during AI processing; (c) risk of inappropriate AI-generated content.
• Mitigations applied: (a) SHA-256 hashing of session tokens and collection of first name only; (b) contractual safeguards with Google Cloud and minimal data transfer to AI models; (c) content safety filtering and age-appropriate content controls in AI prompts; (d) 30-day automatic deletion of session data; (e) no behavioural advertising or third-party tracking.
• Residual risk assessment: Low. The combination of data minimisation, anonymisation techniques, automatic retention limits, and the absence of advertising or tracking reduces residual risk to an acceptable level.

The full DPIA is available upon request from the Data Protection Officer.

12. Data Protection Officer

Ednaimo has designated a Data Protection Officer (DPO) responsible for overseeing compliance with the NDPR and related data protection obligations.

Email: operations@ednaimo.com

The DPO can be contacted for any questions or concerns regarding this statement, the processing of personal data, or the exercise of data subject rights.

13. Breach Notification Procedure

In the event of a personal data breach, Ednaimo will:

1. Investigate and contain the breach as soon as it is detected, taking immediate steps to limit its impact.

2. Notify the National Information Technology Development Agency (NITDA) within 72 hours of becoming aware of the breach, as required by the NDPR. The notification will include:

• A description of the nature of the breach, including the categories and approximate number of data subjects and records affected
• The name and contact details of the Data Protection Officer
• A description of the likely consequences of the breach
• A description of the measures taken or proposed to address the breach and mitigate its effects

3. Notify affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms. Given that the platform processes children's data, notification will be directed to the parent or guardian associated with the affected child profiles.

4. Document the breach internally, including the facts, effects, and remedial actions taken, regardless of whether notification to NITDA was required.

14. Complaints

If you are dissatisfied with how we handle your personal data or respond to your requests, you have the right to lodge a complaint with:

National Information Technology Development Agency (NITDA)

Website: https://nitda.gov.ng

Email: info@nitda.gov.ng

15. Changes to This Statement

We may update this statement from time to time to reflect changes in our practices or applicable law. We will notify registered users of material changes via email. The "Last Updated" date at the top of this document indicates when the most recent changes were made.

16. Contact Us

For questions about this statement or our data protection practices:

Email: operations@ednaimo.com