Data Protection Policy

Evituum ("Evituum", "Company", "we", "our", or "us") is committed to protecting personal information and maintaining the highest standards of privacy, confidentiality, integrity, and security.

This Data Protection Policy establishes the principles, controls, and responsibilities governing the collection, processing, storage, transmission, retention, and disposal of personal data handled through our platforms, applications, services, and supporting infrastructure.

The purpose of this Policy is to:

• Protect personal information entrusted to Evituum.
• Maintain compliance with applicable data protection laws.
• Reduce risks associated with data breaches.
• Promote responsible handling of personal data.
• Strengthen trust among customers and stakeholders.
• Ensure accountability across all business operations.

This Policy applies to:

• Employees and contractors.
• Consultants and temporary staff.
• Third-party service providers.
• Schools and institutions using our platforms.
• All systems, applications, databases, and infrastructure operated by Evituum.

Evituum seeks to comply with applicable data protection and privacy regulations including:

• Nigeria Data Protection Act (NDPA 2023).
• General Data Protection Regulation (GDPR).
• UK GDPR.
• Applicable education-sector privacy regulations.
• Other relevant national and international privacy laws.

Personal data shall be processed in accordance with the following principles:

• Lawfulness, fairness, and transparency.
• Purpose limitation.
• Data minimization.
• Accuracy.
• Storage limitation.
• Integrity and confidentiality.
• Accountability.

The Company may process and protect the following categories of information:

• Personal identification information.
• Contact information.
• Educational records.
• Academic performance data.
• Attendance records.
• Employee information.
• Financial and billing records.
• Authentication and access logs.
• Technical and device information.

Information processed by Evituum may be classified into categories including:

• Public Information.
• Internal Information.
• Confidential Information.
• Restricted or Sensitive Information.

Appropriate security controls shall be applied based on the classification level.

Evituum maintains governance structures designed to ensure responsible processing of personal information.

• Defined roles and responsibilities.
• Access control procedures.
• Data handling standards.
• Security review processes.
• Compliance monitoring activities.

We implement administrative, technical, and organizational safeguards appropriate to the nature and sensitivity of the information processed.

• TLS/HTTPS encryption.
• Encryption of sensitive information.
• Role-based access controls.
• Authentication and authorization controls.
• Multi-factor authentication where applicable.
• Network security monitoring.
• Audit logging.
• Backup and recovery procedures.
• Vulnerability management.
• Periodic security assessments.

Access to personal data is granted strictly on a need-to-know basis and in accordance with assigned responsibilities.

Users are prohibited from accessing information beyond the scope of their authorized role.

Personal information shall be retained only for as long as necessary to fulfill legitimate business, contractual, educational, legal, or regulatory requirements.

When retention periods expire, data may be securely deleted, anonymized, or archived in accordance with applicable laws.

Evituum may engage trusted third-party providers for hosting, payments, analytics, communications, monitoring, and support services.

Such providers are required to maintain appropriate security and privacy safeguards and may process data only for authorized purposes.

Personal information may be transferred to jurisdictions outside the country in which it was originally collected.

Appropriate safeguards shall be implemented where required by law to protect transferred information.

Subject to applicable laws, individuals may have rights to:

• Access their information.
• Correct inaccurate information.
• Request deletion.
• Restrict processing.
• Object to processing.
• Withdraw consent.
• Request data portability.
• File complaints with relevant authorities.

Personnel handling personal data must:

• Follow approved security procedures.
• Protect confidential information.
• Report suspected security incidents.
• Complete applicable security awareness training.
• Use systems only for authorized purposes.

Evituum maintains procedures for detecting, investigating, responding to, and mitigating security incidents.

Where required by law, affected individuals, institutions, customers, and regulators will be notified within applicable statutory timelines.

We may conduct audits, reviews, assessments, monitoring, and compliance activities to ensure adherence to this Policy and applicable regulations.

Violations of this Policy may result in disciplinary action, suspension of access privileges, termination of agreements, legal action, or regulatory reporting where appropriate.

This Policy may be reviewed and updated periodically to reflect changes in technology, regulations, operational requirements, or security practices.

Questions regarding this Data Protection Policy may be directed to: