Privacy and Data Protection Policy

Introduction

ARFET Global Consultancy Services Ltd (“ARFET”) is committed to protecting personal information handled through its website, learning platforms, applications, consulting engagements, recruitment activities and business operations.

This Policy is intended to operate consistently with the Nigeria Data Protection Act 2023, applicable implementing rules and other data-protection laws that apply to the relevant processing.

Who is responsible?

The entity responsible for a particular processing activity must be identified in the relevant service or privacy notice.

For services operated directly by ARFET, the contact is:

Privacy contact: info@arfet-global.com.ng

Safeguarding contact: info@arfet-global.com.ng

ARFET shall designate and publish the contact details of its Data Protection Officer or other responsible privacy contact where required.

If ARFET College or another affiliated entity independently determines how personal information is used, its respective role must be explained accurately.

Information we may collect

Depending on the service, ARFET may collect:

• Identity and contact information, including names, email addresses, telephone numbers and addresses;
• Parent, guardian and emergency-contact information;
• Student enrolment details, dates of birth, academic records, attendance, assessments and progress;
• Application documents, qualifications, references and eligibility information;
• Payment confirmations, invoices and transaction references;
• Customer enquiries, complaints and communications;
• Employment, recruitment, staffing and professional qualification information;
• Project, procurement, school administration and IT service records;
• Device, browser, login, security and website usage information; and
• Other information reasonably necessary for a stated service or legal obligation.

Sensitive personal data shall be handled only where necessary and under a valid legal basis with appropriate safeguards.

ARFET should not collect identity documents, medical information, financial account credentials or other sensitive information merely because it might be useful.

Purposes and lawful bases

ARFET may process personal information for the following purposes, where a lawful basis applies:

Service delivery and contracts: Enrolment, teaching, tutoring, applications, consulting, procurement, project implementation and customer support.

Legal obligations: Accounting, regulatory compliance, lawful reporting and responding to valid legal requests.

Legitimate interests: Protecting systems, preventing fraud, maintaining business records and improving service quality, where permitted and balanced against individuals' rights.

Consent: Optional marketing, non-essential cookies and other processing for which consent is required.

Protection of vital interests or other lawful grounds: Only where the applicable legal conditions are met.

Where consent is the lawful basis, it must be informed, specific, freely given and capable of withdrawal without unlawful penalty.

Children's personal information

ARFET recognises that children require additional privacy protection.

Where required, consent or authorisation must be obtained from a parent or legal guardian before collecting or processing a child's personal information.

ARFET shall provide age-appropriate explanations, restrict access to student records, minimise collection of children's information and avoid using children's information for unrelated marketing.

Children's photographs, recordings, academic results and personal stories must not be used for public promotion unless the required lawful basis and any necessary parent or guardian authorisation have been obtained.

Consent to educational participation must not automatically be treated as consent to promotional photography, advertising or unrelated data sharing.

How information is used

ARFET may use information to:

• Assess eligibility and administer enrolment;
• Deliver classes, training, consultations and agreed services;
• Communicate schedules, assessments, progress and service updates;
• Process payments and maintain financial records;
• Support authorised applications and project delivery;
• Respond to enquiries and complaints;
• Maintain platform security and investigate misuse;
• Meet legal obligations; and
• Conduct optional communications or promotional activities where lawfully authorised.

Personal information shall not be used for materially incompatible purposes without an appropriate legal basis.

Sharing information

Information may be shared, where necessary and lawful, with:

• Authorised ARFET employees and contractors;
• Parents or guardians where authorised and appropriate;
• Schools, universities and examination bodies involved in a requested service;
• Payment processors and financial service providers;
• Hosting providers, learning platforms, IT support providers and other processors;
• Professional advisers, auditors and competent public authorities where legally justified; and
• Other parties where the individual has given valid consent or another lawful basis applies.

ARFET shall use appropriate contractual, confidentiality and security safeguards when engaging processors or sharing personal information.

ARFET does not authorise the sale of customer or student personal information as a commercial data product.

International transfers

Some educational, cloud-hosting, university application or technology services may involve processing outside Nigeria.

Before an international transfer, ARFET shall assess the applicable legal requirements and implement the necessary safeguards, contractual protections, authorisations or other lawful transfer mechanisms.

Where required, individuals will be informed about relevant recipients, destinations and safeguards.

Data retention

Personal information shall be retained only for as long as reasonably necessary for its stated purpose, contractual obligations, legal requirements, dispute resolution or other lawful needs.

Retention periods should be documented by record category, including student records, financial records, recruitment files, application documents, recordings and support communications.

Information no longer required shall be securely deleted, anonymised or otherwise disposed of in accordance with applicable law and legitimate recordkeeping requirements.

Security and incidents

ARFET shall implement security measures appropriate to the information and risks involved. These may include access controls, secure authentication, staff confidentiality obligations, backups, encryption where appropriate, system updates and incident-response procedures.

Suspected loss, unauthorised access, disclosure or misuse of personal information must be reported internally without undue delay.

ARFET shall assess and notify the appropriate regulator and affected individuals when notification is required by applicable law.

Individual rights

Subject to applicable legal conditions and exceptions, individuals may have the right to:

• Be informed about the use of their personal information;
• Request access to their personal information;
• Request correction of inaccurate or incomplete information;
• Request erasure or restriction of processing where legally available;
• Object to certain processing activities;
• Withdraw consent where processing is based on consent;
• Request data portability where applicable; and
• Lodge a complaint with the relevant data-protection authority.

Requests may be submitted to info@arfet-global.com.ng. ARFET may reasonably verify identity and will respond within the applicable legal timeframe.

Direct marketing

ARFET shall provide an appropriate lawful basis for direct marketing and obtain consent where required.

Marketing messages must include a reasonable way to opt out. An opt-out request shall be respected within the applicable timeframe.

Essential service communications may continue where independently justified and lawful.

Third-party websites

ARFET is not responsible for the privacy practices of independent external websites. Users should review the privacy notices of those providers before submitting information to them.

Policy updates

ARFET may update this Policy to reflect changes in law, services or data practices. Material changes will be communicated through appropriate channels.

Contact and complaints

Privacy enquiries and requests: info@arfet-global.com.ng

Individuals may also contact the Nigeria Data Protection Commission or another competent authority where legally appropriate.