Privacy Notice

nocap akedmy teaches trading, betting mathematics, and scam protection using virtual money only. This privacy notice explains what personal data we collect, why, who sees it, how long we keep it, and your statutory rights under the Nigeria Data Protection Act 2023 (NDPA) and its General Application and Implementation Directive (GAID 2025).

1. Who we are

nocap akedmy is operated by Grey Dots Innovative Limited, located at No 13 Gindiri Street, Garki 2, Abuja - FCT, Nigeria. We determine the purposes and means of processing your data, which makes us a "data controller" under the NDPA. Our dedicated privacy contact can be reached at hello@greydotsinnovative.com.

2. What we collect

Category	Examples and details
Account	First name, username, password (stored strictly in irreversibly hashed/scrambled form).
Contact details	WhatsApp phone number (required), email address (required).
Payment records	Transaction reference, payment status, amount paid, and subscription timestamps processed via Flutterwave (payment processor). We do not store or process your full card numbers, CVV, or banking PINs.
Age confirmation	Your explicit affirmative statement that you are 18 years of age or older.
Learning records	Modules and lessons completed, quiz and interactive classroom answers, competency scores.
Practice records	Simulated trades, bets, and forex challenge participation, practiced strictly with virtual currency, never real funds, and non-withdrawable.
AI tutor interactions	Questions and prompts submitted to the AI tutor, along with associated tutor responses.
Pilot research	Survey responses (e.g., questions regarding course pricing, pilot feedback, and product value).
Technical records	Essential session cookies, UI theme preferences (light/dark mode), and standard server access logs (which may record IP addresses and user agents).

Anti-Scam Security Notice: We will never ask for your primary bank account details, card numbers, Card Verification Value (CVV), Bank Verification Number (BVN), or passwords to external accounts. Any communication claiming to be from nocap akedmy requesting these sensitive credentials is a fraudulent impersonation and should be reported immediately.

3. Why we use it, and on what legal basis

Purpose	Data used	Legal basis (NDPA s.25)
Running your account and the course	Account profile, learning records, practice data	Contractual necessity: performing the agreement entered into upon sign-up.
Processing fee payments	Contact details, payment transaction references	Contractual necessity: fulfilling enrollment payments and maintaining valid accounting records.
Pilot communication and service updates	WhatsApp number, email address	Consent: given separately at enrollment; withdrawable at any time without detriment.
AI tutor automated instruction	User questions and related curriculum context	Contractual necessity: real-time student question-answering is an integral service component.
Curriculum optimization	Aggregated learning, practice logs, pilot answers	Consent: granted during sign-up for aggregated statistical analysis.
System security and integrity	Technical records, session logs	Legitimate interest: maintaining service availability and defense against abusive access.

We do not sell, rent, or trade your personal data. We never share student data with brokers, betting operators, or advertising networks.

4. Who else handles it

We engage select third-party service providers ("data processors") to deliver our platform:

• Render: Cloud hosting infrastructure provider storing application data on secure servers in Frankfurt, Germany.
• Flutterwave: Licensed payment solutions provider processing tuition payments and billing transactions. Flutterwave securely collects card and bank billing information directly under PCI-DSS compliance standards; nocap akedmy receives transaction tokens and status verifications only.
• Anthropic: Natural language AI engine processing student queries alongside specific lesson context in the United States. Anthropic does not receive your real name, username, WhatsApp number, or email address.
• Legal and Regulatory Authorities: We may disclose data to law enforcement, statutory regulators, or court systems solely where strictly required under applicable Nigerian legislation.

We do not permit any other third party to access or process your personal data.

5. Sending data outside Nigeria

Your primary records are hosted in Germany (Render), and tutor interaction context is processed in the United States (Anthropic). Under NDPA sections 41 to 43, cross-border data transfers require the destination jurisdiction to afford an adequate tier of protection, appropriate contractual safeguards (such as standard contractual clauses), or explicit, informed consent. Wherever personal data is transmitted internationally, we mandate that recipient platforms adhere to safeguards at least as stringent as the provisions of the NDPA.

6. How long we keep it

• Account, learning, and practice logs: Retained for the duration of your active account, plus 12 months following either project conclusion or your last authenticated log-in (whichever occurs later), after which data is purged or pseudonymized.
• Payment audit records: Transaction references and financial reconciliations are maintained for statutory tax and accounting retention periods.
• AI tutor interaction history: Retained for 12 months for quality evaluation, then permanently deleted.
• Server access logs: Kept in accordance with Render's standard secure log retention schedule.

In adherence to the NDPA storage limitation principle, data is held exclusively for as long as a valid, defined operational rationale exists.

7. Your statutory rights

Under the NDPA, you hold the following non-derogable rights:

• Access: Obtain formal confirmation and copies of personal data maintained in our systems.
• Rectification: Request correction of inaccurate, misleading, or outdated personal entries.
• Erasure: Request permanent deletion of personal records held by our platform.
• Portability: Receive your personal data in a structured, commonly used, and machine-readable format.
• Objection and Withdrawal: Object to specific processing modalities or withdraw consent without disadvantage.
• Regulatory Redress: Lodge a complaint with the Nigeria Data Protection Commission (NDPC).

You can exercise these controls directly via the "Your data" dashboard located in your account settings. For inquiries or escalations, contact hello@greydotsinnovative.com; we review and respond within 48 hours. Practice trades and simulator records are tamper-sealed to prevent falsification; upon erasure requests, identifiable names and contact points are decoupled from immutable audit trails.

8. Keeping your data safe

Platform communications are encrypted in transit via modern TLS protocols. Passwords are hashed with salted cryptographic algorithms inaccessible to staff. If a security compromise creates personal risk, we notify the NDPC within 72 hours under NDPA s.40(2), and communicate directly with affected users where required by s.40(3).

9. Age restriction

Our services are restricted to individuals aged 18 and older. If we discover an account maintained by a minor, the account and records will be promptly removed.

10. Notice amendments

Material revisions will be posted directly to the platform and communicated via your registered WhatsApp or email prior to taking effect.

11. Contact details

Grey Dots Innovative Limited, No 13 Gindiri Street, Garki 2, Abuja - FCT, Nigeria. Email: hello@greydotsinnovative.com