Privacy Policy
Last updated: October 17, 2026 · Version 2.0 · Operated by EDUVIXA NIGERIA LTD
1. Who is responsible for your data
EDUVIXA NIGERIA LTD (“EduVixa”, “we”) is the data controller for personal data processed through the EduVixa Platform. We are registered in Nigeria (registration number RC 9486988); our registered office is 8 Arogundade Street, Lagos, Nigeria.
Our data protection contact (who acts as, or on behalf of, our Data Protection Officer) can be reached at privacy@eduvixa.com.
This policy applies to everyone who uses the Platform — learners, parents and guardians, tutors, and visitors — and is written to meet the Nigeria Data Protection Act 2023 (NDPA) and the guidance issued under it by the Nigeria Data Protection Commission (NDPC). Where you are in another country, we also respect the data protection rights that apply to you there, where reasonably practical.
2. What personal data we collect
We collect only what we need to run the marketplace safely. The table shows the categories, where they come from, and what they include.
| Category | What it includes | Where it comes from |
|---|---|---|
| Account data | Name, email address, password (stored hashed, never in readable form), account type, language and theme settings, profile photo, country and time zone. | You, or Google if you choose “Continue with Google”. |
| Tutor application & verification data | Education and work history, certificates, subjects, hourly price, profile video or photo, government-issued ID and related verification details, and your agreement to our Tutor Code of Conduct and Safeguarding Policy. | The tutor. |
| Payout data (tutors) | Payout method and account details (for example bank, mobile-money or PayPal details), payout history and tax-related information we need to keep. | The tutor. |
| Learner profile data (children) | A preferred name or nickname and an age range (5–8, 9–12 or 13–17), the guardian’s consent record, and which lessons the profile attended. We ask guardians not to add school, address, phone or health information. | The parent or guardian. |
| Booking & payment data | Lessons booked, schedules, subscription status, promo and referral credits, amounts, currency, payment status and transaction references. Card and wallet details are handled by our payment providers; we do not store full card numbers. | You, and our payment providers. |
| Lesson & communication data | Messages you send through EduVixa, lesson attendance and timing, reviews, and — only where recording is enabled and used — lesson recordings (audio and video). | You, your tutor or learner, and our video provider. |
| Support & safety data | Support tickets, reports about a user, dispute evidence you upload, and records of what we did in response. | You, the other party, and our team. |
| Technical & usage data | IP address, device and browser type, pages visited, approximate location derived from IP, error logs and security logs; if you accept analytics cookies, usage statistics. See the Cookie Policy. | Your device, automatically. |
| Marketing preferences | Whether you want product updates or promotions. | You. |
Sensitive data. We do not ask for sensitive personal data such as health, religion, ethnicity, political views or biometric data, and we ask you not to share it in messages or profiles. An ID document may show a facial image; we use it only to verify identity and prevent fraud.
If you give us other people’s data (for example a guardian adding a child, or a tutor listing a referee), you confirm you have the right to do so.
3. Why we use your data, and our lawful bases
The NDPA requires us to have a lawful basis for each use of personal data. These are ours:
| What we do | Lawful basis under the NDPA |
|---|---|
| Create and secure your account; match learners with tutors; schedule, host and support lessons; send booking and account notices | Performance of a contract with you (or steps you ask for before one). |
| Take payments, pay tutors, issue refunds and credits; keep financial records; handle chargebacks | Contract; legal obligation (tax and accounting records). |
| Review tutor applications and verify identity and qualifications; prevent fraud and impersonation | Legitimate interests in a safe, trustworthy marketplace; legal obligation where it applies. |
| Safeguard learners — handle reports, investigate, restrict or remove users, and share information with authorities where needed | Legitimate interests and vital interests (protecting life or a child’s safety); legal obligation. |
| Learner profiles for children | Consent of the parent or guardian, which they may withdraw at any time (see section 4). |
| Keep the Platform secure; detect abuse; fix errors; measure and improve essential performance | Legitimate interests. |
| Analytics cookies and similar technologies that are not strictly necessary | Consent (your choice in our cookie banner). |
| Product updates and promotions | Consent, or, for existing customers, our legitimate interest in similar offers, always with an easy opt-out. We do not send marketing to children. |
| Respond to legal requests, enforce our terms, and defend legal claims | Legal obligation; legitimate interests. |
Where we rely on legitimate interests, we weigh them against your rights and interests, and we give extra weight to the interests of children. You can object to processing based on legitimate interests (section 10).
Tutor application decisions are made by our team. We do not make decisions about you based solely on automated processing that have a legal or similarly significant effect on you.
4. Children’s data
Under the NDPA a child is a person under 18. EduVixa is built so that children do not hold accounts. A parent or legal guardian aged 18 or over creates and manages a limited learner profile and books and attends lessons through their own account.
- Consent. Before adding a learner profile, the guardian confirms they are the child’s parent or legal guardian and consents to us storing the profile and using it to arrange lessons. We record the consent and the version of the policy it relates to. We may ask for further confirmation of the relationship.
- Data minimisation. We collect only a preferred name or nickname and an age range for a child. We do not knowingly collect a child’s address, school, phone number, email, precise location, or health details, and we do not use a child’s data for advertising, profiling or marketing.
- Lessons. Communication about a child’s lessons goes through the guardian’s account. If a lesson is recorded, the recording is visible only to the guardian’s account, the tutor, and authorised EduVixa staff reviewing a report or dispute. Tutors must not make their own recordings or images of a child (see the Tutor Code of Conduct).
- Rights. A guardian can see, correct or delete a child’s profile in the app, withdraw consent, or ask us to act on the child’s behalf (section 10). Deleting a profile does not delete records we must keep for safety, legal or financial reasons (section 8).
- If a child has set up an account. If we learn that someone under 18 has created an account directly, we will restrict it and ask a parent or guardian to take over through a learner profile, and delete data we are not entitled to keep. Please tell us at privacy@eduvixa.com if you think this has happened.
More about how we protect learners is in our Safeguarding Policy.
6. Transfers outside Nigeria
Some of our providers store or process data outside Nigeria, including in the United States and Europe. We transfer personal data abroad only where permitted by the NDPA: where the destination offers adequate protection, or where we have put appropriate safeguards in place — such as contractual clauses requiring equivalent protection — or where a transfer is necessary to perform our contract with you or you have given informed consent. You can ask privacy@eduvixa.com for details of the safeguards we use.
8. How long we keep your data
We keep personal data only as long as needed for the purpose it was collected for, and then delete or anonymise it. Our standard periods are below; longer periods apply if we are legally required to keep data, or while a dispute, investigation or legal claim is open.
| Data | How long we keep it |
|---|---|
| Account and profile data | While your account is active. After you close it or ask us to delete it, we delete or anonymise it within 30 days, except for the records listed below. |
| Payment, payout and invoice records | 6 years from the transaction, to meet tax, accounting and limitation-period requirements. |
| Tutor applications and verification documents | Approved tutors: while the tutor is active and for 12 months after the account closes. Unsuccessful applications: 12 months. Where a verification document is no longer needed once identity is confirmed, we delete it sooner. |
| Learner profiles (children) | Until the guardian deletes the profile or closes the account (then within 30 days). Consent records are kept for 6 years to show we obtained consent. |
| Messages | Currently 365 days from sending, then automatically purged, unless the message is part of a report, dispute or investigation. |
| Lesson recordings (where enabled) | 90 days, unless a report, dispute or investigation requires us to keep them longer. |
| Support tickets and dispute evidence | 3 years after the matter is closed. |
| Safeguarding reports and related records | 7 years after the matter is closed, or longer where the authorities or the law require, because these records protect children and may be needed for future investigations. |
| Security and server logs | Up to 12 months. |
| Cookie-consent choice | Until you change it or clear your browser storage. |
| Marketing preferences | Until you withdraw consent; we then keep only a minimal suppression record so we do not contact you again. |
| Backups | Data deleted from live systems is removed from backups within 90 days, as backups are overwritten. |
9. How we protect your data
We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls limiting staff access to what their role needs, private storage for identity documents, authentication safeguards (including multi-factor authentication for accounts where offered), and regular review of our systems and providers. No online service can guarantee perfect security.
If a breach happens. If a personal data breach is likely to put people’s rights and freedoms at risk, we will notify the NDPC within 72 hours of becoming aware of it, as the NDPA requires, and we will notify affected people without undue delay where the risk to them is high, explaining what happened and what they can do.
10. Your rights and how to use them
Under the NDPA you have the right to:
- be informed about how we use your data (this policy);
- access your personal data and receive a copy;
- correct inaccurate or incomplete data;
- delete your data where we no longer need it or have no lawful basis for keeping it;
- restrict our use of your data in certain situations;
- object to processing based on legitimate interests, and to direct marketing at any time;
- receive your data in a portable format, where processing is based on consent or contract and carried out by automated means;
- withdraw consent at any time, without affecting what we did before; and
- not be subject to a decision based solely on automated processing that has legal or similarly significant effects.
How to exercise them. Use Settings in the app for most changes, or write to privacy@eduvixa.com. We may need to verify your identity first. A parent or guardian can exercise these rights for a child. We aim to respond within 30 days and normally do not charge a fee. If we cannot fully act on a request — for example because we must keep a record for legal or safeguarding reasons — we will explain why.
Complaints. Please tell us first so we can put things right. You also have the right to complain to the Nigeria Data Protection Commission (ndpc.gov.ng) and to seek a remedy in court. If you are outside Nigeria, you may also complain to your local data protection authority.
11. Marketing
We send service messages (bookings, security, receipts, policy changes) as part of providing the service; you cannot opt out of those while you have an account. Product updates and promotions are sent only as described in section 3, and every one carries an unsubscribe link; you can also change this in Settings. We never send marketing to children.
12. Sign in with Google
If you choose “Continue with Google”, Google shares your name, email address and profile picture with EduVixa. We use this information only to create and secure your EduVixa account, to show your name inside the service, and to contact you about your account, lessons and bookings.
We do not receive your Google password, and we do not access your Gmail, contacts, calendar, Drive or any other Google data. We do not sell Google user data, use it for advertising, or share it with third parties except the service providers that run EduVixa for us (for example hosting and email delivery) and only as needed to operate the service.
EduVixa’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can stop using Google sign-in at any time, and you can delete your EduVixa account from Settings. You can also remove EduVixa’s access from your Google Account under Security, then Third-party apps and services.
13. Changes to this policy
If we make material changes to how we handle personal data, we will notify you in the app or by email before they take effect, and we will ask for fresh consent where the law requires it. The date and version at the top show when this policy was last updated.
14. Contact us
Data protection contact: privacy@eduvixa.com
EDUVIXA NIGERIA LTD, 8 Arogundade Street, Lagos, Nigeria
You can also use Support in the app.