NDPR Data Protection Notice

PrepMaster processes personal data in line with the Nigeria Data Protection Act and the Nigeria Data Protection Regulation (NDPR). This notice explains what we collect, why we collect it, and the choices available to you.

• Account data such as your name, email address and role.
• School data such as the school name, address, administrator details and subscription information.
• Student records a school uploads, including names, class, department, guardian contact details and portal login details.
• Assessment data such as questions served, answers submitted, scores and completion times.
• Technical data such as device type, browser and basic usage records needed to keep the service secure.

• To provide the assessment, class meeting and school administration services a school subscribes to.
• To authenticate users and protect student and school accounts.
• To calculate results, produce reports and show performance trends to the school.
• To process subscription payments and provide support.
• To meet legal, regulatory and audit obligations.

Where a school enters student and staff records, the school is the data controller and PrepMaster acts as its data processor. Schools are responsible for having a lawful basis to share that data, and for keeping it accurate and up to date.

Where PrepMaster creates an account for an individual user, PrepMaster acts as the data controller for that account.

• Performance of a contract — delivering the service a school has subscribed to.
• Consent — where you ask us to send optional communications or where a guardian provides contact details.
• Legitimate interest — keeping the platform secure, preventing fraud and abuse, and improving reliability.
• Legal obligation — retaining records where the law or a regulator requires it.

Student and school records are isolated per school. Only authorised staff of your own school and, where required to operate the service, designated PrepMaster administrators can access them. We share data with service providers only as far as needed to operate the platform, and never sell personal data.

Records are kept for as long as the school's account is active and for a reasonable period afterwards to satisfy audit, dispute and legal requirements. A school may ask us to delete records it no longer needs, subject to those obligations.

• Be informed about how your data is used.
• Request access to the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion or restriction of processing where the law allows it.
• Object to processing based on legitimate interest.
• Request a portable copy of data you provided.
• Withdraw consent at any time, without affecting processing already carried out.

Access is role-based and protected by authentication. Data in transit is encrypted, and administrative actions on school records are logged so they can be reviewed. No system is perfectly secure, so please keep portal credentials private and report anything suspicious.

PrepMaster is used in schools and processes the data of students, many of whom are minors. Student records are supplied by the school or guardian, are visible only within that school, and are used strictly for assessment, record-keeping and communication with the school.

Send a request to the PrepMaster support team through the Support page, or ask your school administrator, who can raise it with us. We aim to respond within 30 days. If you are not satisfied with our response, you may complain to the Nigeria Data Protection Commission.

If this notice changes materially, we will update the date above and, where appropriate, notify schools directly.