Privacy Policy & Data Protection

1. Scope & Legal Framework

This Privacy Policy explains how Blue Gem collects, processes, stores, and protects personal data collected through our virtual learning platform, Computer-Based Testing (CBT) engines, interactive live classrooms, library databases, and payment flows.

We operate in full accordance with the Nigeria Data Protection Act (NDPA 2023), the Nigeria Data Protection Regulation (NDPR), the General Data Protection Regulation (GDPR), and international student data safeguarding standards.

2. Minor Students & Parental/Guardian Consent

Blue Gem prepares students for high-stakes secondary and pre-degree examinations, many of whom are under the age of 18 ("Minors"):

• Parent/Guardian Involvement: Accounts for minor students require verified parental or guardian sponsorship, authorization, and contact details during onboarding.
• Guardian Oversight: Parents and legal guardians have the right to inspect their ward's academic performance records, attendance logs, CBT diagnostic reports, and direct teacher communications via the Parent Portal.
• Consent Revocation: A parent or guardian may request the closure of their ward's account or deletion of non-statutory records at any time by contacting our Data Protection Officer.

3. Information We Collect

We collect information in three categories to deliver personalized, secure educational services:

4. Legal Grounds for Processing

Under the NDPA 2023 and GDPR, we process your personal data under the following lawful bases:

• Contractual Necessity: To provide you with academic instruction, deliver timetables, grant live classroom access, administer CBT exams, and process tuition fees.
• Legitimate Interests: To improve our syllabus, monitor student attendance, prevent exam malpractice, maintain platform cybersecurity, and provide customer support.
• Legal & Regulatory Compliance: To maintain academic records, financial accounting, and comply with applicable tax and educational regulatory reporting.
• Consent: For non-mandatory notifications, marketing updates, or special extracurricular activities.

5. Live Classroom Recordings & Safeguarding

Live interactive classes are recorded to create an on-demand replay library for registered students. To ensure safeguarding and digital privacy:

• Restricted Access: Class recordings are accessible ONLY to authenticated students, parents, and tutors actively enrolled in that specific program track.
• No Public Distribution: Classroom recordings are strictly prohibited from being downloaded, published to social media, or distributed outside the platform.
• Tutor Vetting: All Blue Gem instructors undergo background verification and sign strict child protection and confidentiality codes of conduct.

6. Data Sharing & Third-Party Processors

We do NOT sell, rent, or trade your personal information to third parties. Data is shared only with vetted sub-processors necessary to run the school:

• Payment Gateways: Paystack (PCI-DSS compliant) for secure fee billing and subscription management.
• Database & Cloud Infrastructure: Supabase and Amazon Web Services (AWS) for secure, encrypted data storage and Row Level Security (RLS) enforcement.
• Notification Services: Transactional email and SMS delivery providers (Pingram) for automated schedule reminders, exam notifications, and security alerts.
• Legal Authorities: Only when strictly required by a competent court of law, regulatory body, or law enforcement agency having statutory jurisdiction.

7. Data Security & Encryption

Blue Gem enforces enterprise-grade security controls:

• Encryption in Transit & At Rest: All web traffic is encrypted using TLS 1.3. Database tables and backup snapshots are encrypted using AES-256.
• Row Level Security (RLS): Granular database policies guarantee that students cannot view records belonging to other cohorts, and parents cannot access unassigned students.
• Role-Based Access Control (RBAC): Administrative access is strictly limited to authorized personnel using multi-factor authentication.

8. Your Statutory Data Subject Rights

Under applicable data protection legislation (NDPA, GDPR), you retain the following rights:

To exercise any of these rights, email our Data Protection Officer with your registered account email.

9. Data Retention Policy

We retain personal data only for as long as necessary to fulfill academic instruction, maintain official transcripts, and comply with tax and audit regulations:

• Active student accounts and classroom access: Retained for the duration of enrollment.
• Academic scores and certification transcripts: Retained for up to 7 years for credential verification.
• Financial transactions: Retained for 6 years in accordance with statutory accounting requirements.

10. Contacting Our Data Protection Officer (DPO)

For privacy inquiries, parental consent updates, or data subject access requests: