Privacy Policy | SMS Naija

This Privacy Policy explains how Belad Creative Hub Ltd., operating SMS Naija ("we", "us"), collects, uses, and protects personal data. We process data in line with the Nigeria Data Protection Act (NDPA) 2023 and the regulations of the Nigeria Data Protection Commission (NDPC).

1. Two roles: controller and processor

This matters because SMS Naija serves institutions across several categories, not just individuals:

For an institution's students, applicants, parents, and staff — data the institution uploads or its staff enter (academic records, admissions data, attendance, fee status, GPA/CGPA, contact details) — the institution is the data controller and SMS Naija acts as a data processor, processing it only to provide the platform to that institution. This applies equally to Primary/Secondary schools, Tertiary institutions, Vocational and Tech schools, and Virtual Schools. Requests to access, correct, or delete a student's or parent's data should generally start with the institution; we support institutions in fulfilling those requests.
For account data collected directly by us — Institution Owner registration, Event Organizer registration, Independent Student registration for paid ICT Club/Past Questions access, Superadmin/marketer accounts, blog subscribers, and platform usage data — SMS Naija is the data controller.
For a Virtual School's own Digital Services and ICT Club Creator API curricula, and for anyone who buys one, the Virtual School is the data controller for the curriculum/listing content it creates, and SMS Naija is the data controller for the buyer's purchase, payment, and enrollment records needed to grant and track access.

2. What we collect

Account data: name, email, phone number, password (stored as a salted hash, never in plain text) or Google account identifier if you sign in with Google.
Institution registration data: CAC number, institution name and category (Primary/Secondary, Tertiary, Vocational, Tech, Virtual), ownership type, address, state/LGA, owner name, uploaded CAC document and, where applicable, an owner identification document.
Event Organizer registration data: organization/brand name, owner name and contact details, state/city, and — for verification — either a CAC document or, for an individual planner, a government ID and proof of address.
Independent Student registration data: name, email, phone, date of birth, and gender, collected only when you register as an Independent Student to pay for ICT Club or Past Questions access.
Digital Services / ICT Club Creator API data: for a Virtual School, the services and curricula it lists (title, description, price, images); for a buyer, purchase and payment records and, for a Creator API purchase, the resulting course enrollment and certificate records.
Primary/Secondary academic data: student records, attendance, grades, admissions applications — entered or bulk-uploaded by school staff.
Tertiary academic data: biodata, admission information, matric number, faculty/department/programme, course registration, grades, GPA/CGPA, session/level/semester, and Student ID card data (including the QR-verifiable ID code).
Vocational/Tech academic data: programme/course/cohort enrollment, assessment scores and notes, and certificate records.
Virtual School data: programme/week/lesson enrollment, lesson-completion and quiz-attempt records, progress toward certificate issuance, and certificate records.
Payment data: we do not store card numbers. Application fees, institution fees, event tickets, Digital Service and ICT Club Creator API purchases, other fees an institution or Event Organizer configures, and Independent Student annual access payments are processed by Paystack; we retain transaction references and amounts, and — for institutions and Event Organizers — settlement bank account details needed to pay out collected fees, minus SMS Naija's commission.
Communications: support tickets, WhatsApp/email messages you send us, and messages sent through the in-platform Communication Hub.
Usage data: pages visited, device/browser information, and similar analytics needed to operate and secure the platform.

3. How we use it

To create and secure accounts, including 2FA verification codes for accounts with two-factor authentication enabled.
To operate core features: admissions, fee tracking and payment collection, attendance, gradebook, GPA/CGPA computation, Vocational/Tech and Virtual School enrollment/progress/certificates, ICT Club enrollment and certificates, and the Communication Hub.
To send transactional communications — admission letters, fee reminders, password resets, notification broadcasts an institution or Superadmin sends to relevant users.
To generate and publicly verify certificates and Student ID cards (only the non-sensitive display fields needed for verification — name, institution, certificate/ID number, issue date — are exposed on a public verification page; no other academic or contact data is shown).
To calculate and pay Royal Marketer commissions.
To detect fraud (e.g. falsified CAC numbers, referral abuse) and secure the platform.

4. Children's data

Many students on SMS Naija — across Primary, Secondary, and some Vocational/Tech and Virtual School programmes — are minors. Student records are uploaded by their institution, which is responsible for having the appropriate authority (typically parental/guardian consent obtained through the institution's own enrollment process) to do so. We do not knowingly market directly to children, and student accounts are used solely to deliver institution-related functionality (e.g. viewing grades or progress, ICT Club access where eligible).

5. Who we share data with

We share data only as needed to run the platform, with these categories of third parties:

Paystack — payment processing for application, institution, and other platform-configured fees.
Termii — SMS delivery for parent/admissions notifications (institution-initiated, drawn from the institution's SMS balance).
Resend — transactional and broadcast email delivery.
YouTube — Virtual School lessons embed institution-linked YouTube video content. We do not send Virtual School learner data to YouTube beyond what a standard embedded video player requires to play the video.
Law enforcement or regulators, where required by Nigerian law.

We do not sell personal data to third parties.

6. International transfers

Some of the providers above may process data on servers outside Nigeria. Where this happens, we rely on those providers' own data-protection safeguards and, where required by the NDPA, appropriate transfer mechanisms.

7. Data security

Passwords are hashed, not stored in plain text. Superadmin accounts require two-factor authentication. Access to an institution's data is restricted to that institution's own staff accounts and platform administrators with a legitimate operational need. No system is perfectly secure, and we encourage strong, unique passwords and enabling 2FA where available.

8. Data retention

We retain account and academic data for as long as the account or institution remains active on the platform, and for a reasonable period after closure to meet legal, tax, and dispute-resolution obligations. This applies to Primary/Secondary, Tertiary, Vocational/Tech, and Virtual School records alike — an institution owner or Superadmin can request deletion of a closed institution's data, subject to any records we are legally required to retain.

Independent Student accounts are handled differently and automatically: if every ICT Club/Past Questions subscription on an Independent Student account has lapsed without renewal, we automatically delete that account — profile, practice history, and certificates — as described in the Terms & Conditions. You'll receive an in-app notice before a subscription lapses so renewal is never a surprise. An account that never subscribed is not affected by this automatic deletion.

9. Your rights under the NDPA

You may request to:

Access the personal data we (or, for student/parent/applicant data, your institution) hold about you.
Correct inaccurate data.
Request deletion, subject to legal retention requirements.
Object to certain processing, such as marketing broadcasts (you can also unsubscribe directly from marketing emails).
Request a copy of your data in a portable format.

To exercise any of these rights, contact info@smsnaija.com. If your request concerns student, parent, or applicant data held on behalf of a specific institution, we may direct you to that institution first, as they are the data controller for that data.

10. Cookies

We use essential cookies/local storage to keep you signed in and to remember in-progress forms (for example, institution-onboarding details while you complete Google sign-in). We do not use third-party advertising trackers.

11. Changes to this policy

We may update this Privacy Policy as the platform evolves; the "Last updated" date above reflects the latest revision. Material changes affecting how institution data is processed will be communicated to institution owners.

12. Contact

Data protection queries: info@smsnaija.com or our support page.