Data Protection Policy

This policy sets out how Edfrica Solutions Limited meets its obligations under the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation (NDPR), and complements our Privacy Policy.

Edfrica Solutions Limited is the data controller for personal data collected through the Edfrica ecosystem, headquartered in Abeokuta, Ogun State, Nigeria.

We process personal data based on consent, contractual necessity, legitimate interest, and legal obligation, consistent with the principles of lawfulness, fairness, purpose limitation, data minimization, accuracy, storage limitation, and accountability set out in the NDPA.

Data subjects in Nigeria have the right to:

• Be informed about how their data is processed
• Access their personal data
• Request correction of inaccurate data
• Request erasure or restriction of processing
• Object to processing based on legitimate interest
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC)

For higher-risk processing activities, including TLab’s processing of children’s data, we conduct data protection impact assessments to identify and mitigate risks before launch and on an ongoing basis.

In the event of a personal data breach likely to result in risk to data subjects, we will notify the Nigeria Data Protection Commission and affected individuals without undue delay, in line with NDPA requirements.

Questions, requests, or complaints regarding data protection can be directed to our Data Protection contact at contact@edfrica.org.

Where personal data is transferred outside Nigeria, for example to international donor or technical partners, we take reasonable steps to ensure recipients provide an adequate level of protection consistent with NDPA requirements.

This policy is reviewed at least annually and updated to reflect changes in law, regulatory guidance, or our data processing activities.