SchoogleSchoogle
Legal

NDPR Compliance

Last updated: 1 May 2026

Schoogle is committed to full compliance with the Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act (NDPA) 2023. This page summarises our compliance posture, obligations, and the rights available to you as a data subject.

Our data protection principles

Lawfulness & transparency

We process personal data only on lawful grounds and always tell users what data we collect and why, in plain language.

Purpose limitation

Data collected for one purpose is not reused for another incompatible purpose without your consent.

Data minimisation

We collect only the data necessary to provide the Service — nothing more.

Rights of data subjects

We honour requests to access, correct, delete, or port personal data within the timeframes required by the NDPR.

Data controller information

Controller: Consulaw Tech Services Ltd

DPO: Data Protection Officer, Consulaw Tech Services Ltd

Address: 12, Onikoyi Street, Aguda, Surulere, Lagos

Email: privacy@schoogleng.com

Categories of personal data processed

Identity dataFull name, email address, profile photo
Account dataRole type (student, teacher, etc.), school affiliation, class level
Learning dataLessons completed, test scores, AI tutor query history, streak data
Transaction dataSubscription tier, payment history (no card details stored)
Technical dataIP address, browser type, device type, session logs
Communication dataSupport emails, feedback forms, notifications

Lawful bases for processing

  • Contractual necessity — to deliver the subscription service you signed up for
  • Legitimate interest — platform security, fraud prevention, and service improvement
  • Consent — marketing communications (withdrawable at any time)
  • Legal obligation — tax records, regulatory reporting

Cross-border data transfers

We use third-party services (including Supabase, Vercel, and Paystack) that may process data outside Nigeria. Where data is transferred internationally, we ensure adequate safeguards are in place — including Data Processing Agreements — that provide a level of protection equivalent to the NDPR.

Special categories of data

We do not intentionally collect sensitive personal data (health data, biometric data, religious or political views). Where a user voluntarily provides such information (e.g., in a note or support message), it is processed only for the stated purpose and is not shared with third parties.

Children's data

Schoogle serves secondary school students, including minors. We process minors' data only within the school institution framework, where the school takes on the role of data controller for enrolled students and is responsible for obtaining appropriate parental consent in accordance with the NDPR and NDPA.

We do not use children's data for advertising, profiling, or any purpose other than delivering the educational service.

Your rights under the NDPR / NDPA

Right of access: Request a copy of the personal data we hold about you
Right to rectification: Correct inaccurate or incomplete personal data
Right to erasure: Request deletion of your personal data where there is no legitimate reason to retain it
Right to restriction: Ask us to limit how we use your data while a dispute is resolved
Right to data portability: Receive your data in a machine-readable format
Right to object: Object to processing based on legitimate interests
Right to withdraw consent: Withdraw consent for optional processing at any time

Submit requests to privacy@schoogleng.com. We will respond within 30 days. You may also lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

Data breach response

In the event of a personal data breach, we will notify the NDPC within 72 hours of becoming aware of the breach, as required by the NDPA. Affected data subjects will be notified without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

NDPR audit

We conduct an annual data protection impact assessment (DPIA) and retain a licensed Data Protection Compliance Organisation (DPCO) to audit our practices. Audit certificates are available upon written request.