Privacy Policy

1. Who is responsible for your data

Ado Prudent Limited, trading as SEPAfrica (Social Entrepreneur Programme Africa), is the data controller for the personal information described in this Policy. We are established in Nigeria.

You can reach us about anything in this Policy at privacy@sepafrica.com.

This Policy applies to the SEPAfrica scholarship platform at sepafrica.com and forms part of the Scholarship Programme Policy and Use Agreement.

2. What we collect

We collect only what the Platform actually needs to work.

• Account details: name, email address, password (stored only as a cryptographic hash), role, and language preference.
• Student academic details: country, state, institution, course, academic level, matriculation or student number, admission year and expected graduation year.
• Verification records: which Registrar address a request was sent to, when, and the decision returned.
• Wallet details for Students: bank name, account number and account name, used solely to receive an Award.
• Funder details: organisation name, and the identity and payment information required by our Payment Partners.
• Scholarship activity: Calls published, applications made, decisions taken, Awards paid.
• Registrar contact details supplied by Students, and contact details held in our Institution directory.
• Newsletter subscription details, where you subscribe.
• Technical data: IP address, browser type, and pages requested, recorded in server logs for security and diagnosis.
• We do not knowingly collect information about health, religion, political opinions, ethnicity or sexual orientation, and ask that you do not supply it.

3. Which data protection laws apply

The Platform serves students across Africa and funders worldwide, so more than one data protection regime can apply to the same record at the same time. Rather than pick one, we apply the strongest requirement among those that apply to you.

• As a Nigerian company, we are subject to the Nigeria Data Protection Act 2023 in everything we do, and to the oversight of the Nigeria Data Protection Commission.
• Where you are a Student resident in an African country with its own data protection law — including Kenya's Data Protection Act 2019, South Africa's POPIA, Ghana's Data Protection Act 2012, Egypt's Personal Data Protection Law, Morocco's Law 09-08, and comparable laws elsewhere on the continent — your rights under that law apply to our processing of your information, and you may complain to your own national authority.
• Where you are a Funder in the United Kingdom or the European Economic Area, the UK GDPR or EU GDPR applies to our processing of your information, and you may complain to your own supervisory authority.
• Where you are a Funder resident in California, you have rights under the California Consumer Privacy Act. We do not sell or share personal information as those terms are defined there.
• Where your national law gives you a right this Policy does not mention, that right still stands. Ask us and we will honour it.

4. Why we are allowed to hold it

Whichever regime applies, we must have a lawful basis for each use of your information.

• Performance of a contract: creating and running your account, processing applications, and paying Awards.
• Consent: sending the newsletter, and publishing an awarded Student's name and course on public pages. You may withdraw consent at any time without affecting anything done beforehand.
• Legal obligation: keeping financial records, and meeting anti-money-laundering and know-your-customer requirements imposed on our Payment Partners.
• Legitimate interests: preventing fraud, securing the Platform, and improving how it works. We balance these against your interests and use the least information that achieves the purpose.

5. What we disclose to Registrars

Verifying a studentship necessarily means telling the Institution who is claiming it. We keep that disclosure as narrow as we can.

• The verification email identifies the Student by name and Institution only.
• Course, level, matriculation number and academic dates are shown on a page reachable only through a single-use, time-limited link in that email.
• Where our directory holds an Institution's domain, a Student-supplied Registrar address must be on that domain, so a request cannot be directed to a personal mailbox.
• Verification links expire after 30 days and cannot be reused once answered.

6. What we show Funders

• A Funder reviewing an application sees the Student's course, academic level, Institution, expected graduation year and verification status.
• A Funder also sees the Institution's official Registrar contact details, so that they can confirm a studentship independently.
• A Funder never sees a Student's bank account, Wallet details, home address, or contact details.
• Funders are contractually restricted to using what they see for assessing and administering that application.

7. Who else your information reaches

We do not sell personal information, and we do not share it for advertising. We use the following processors, each under contract and each limited to instructions from us:

• Supabase — database, authentication and file storage.
• Netlify — website and application hosting.
• Resend — sending transactional email.
• Flutterwave — collecting Funder payments and settling Awards to Students.
• Wise — settling Awards in territories Flutterwave does not serve.
• MyMemory — machine translation of published page copy. Only page text is sent; account details, academic records and payment information are never sent for translation.
• We may also disclose information where the law requires it, to establish or defend a legal claim, or to prevent fraud or serious harm.

8. International transfers

Cross-border transfer is inherent to what the Platform does. A funder in London can pay tuition for a student in Nairobi, verified by a registrar in Kenya, through a payment partner operating in several countries at once. Your information therefore moves between jurisdictions by design, not by accident.

• Student information is transferred to Nigeria, where we are established, and to the countries in which our processors operate.
• Funder information is transferred to Nigeria and to our Payment Partners for identity, sanctions and source-of-funds checks.
• Registrar contact details are used to send verification requests into the student's own country.
• Where information leaves a jurisdiction that restricts transfers, we rely on the recipient being in a country recognised as providing adequate protection, on standard contractual clauses or the equivalent instrument under the applicable law, or on your explicit consent.
• You may ask us which safeguard applies to a particular transfer, and we will tell you.

9. How long we keep it

• Account and academic records: while your account is open, and for 24 months after closure.
• Verification records: 24 months after the decision, so a disputed verification can be examined.
• Wallet bank details: while the Wallet is active, and for 7 years after the last Award, because financial records must be retained.
• Payment and Award records: 7 years, to meet accounting and anti-money-laundering obligations.
• Records of policy acceptance: for as long as the account exists and 7 years after, so we can show what you agreed to and when.
• Newsletter subscription: until you unsubscribe.
• Server logs: 12 months.

10. How we protect it

• All traffic is encrypted in transit; data is encrypted at rest by our hosting providers.
• Passwords are never stored in a readable form.
• Access to records is enforced at the database level by row-level security, not only in the interface, so a Student's Wallet details are unreachable to Funders by design rather than by convention.
• Verification tokens are stored hashed, so nobody — including a Student — can read a token and approve their own studentship.
• Staff access is limited to what a role requires.
• No system is perfectly secure. If a breach occurs that is likely to affect your rights, we will notify you and the relevant regulator as the law requires.

11. Your rights

Subject to the conditions in applicable law, you may exercise the following rights:

• Access — obtain a copy of the information we hold about you.
• Rectification — have inaccurate information corrected. Most of it you can correct yourself from your profile.
• Erasure — have information deleted, where we are not required to keep it.
• Restriction — ask us to pause processing while a dispute is resolved.
• Objection — object to processing based on legitimate interests.
• Portability — receive your information in a structured, machine-readable form.
• Withdraw consent — for the newsletter and for public recognition of an Award, at any time.
• To exercise any of these, write to privacy@sepafrica.com. We respond within 30 days, and we do not charge for a first request.
• If you are not satisfied, you may complain to the Nigeria Data Protection Commission, or to the data protection authority of your own country — for a student in Kenya the Office of the Data Protection Commissioner, in South Africa the Information Regulator, in Ghana the Data Protection Commission, and the equivalent body elsewhere. Funders in the UK or EEA may complain to their national supervisory authority.

12. Children

The Platform is intended for tertiary students. Where a Student is below the age of majority in their country, a parent or legal guardian must accept the Agreement and this Policy on their behalf. If you believe a child has registered without that consent, contact us and we will remove the account.

13. Cookies and similar technologies

• We use a session cookie to keep you signed in, and a preference cookie to remember your chosen language.
• We do not use advertising cookies and we do not track you across other websites.
• Both cookies are necessary for the Platform to function as you have asked it to.

14. Automated decisions

We do not make decisions about you by automated means alone. Awards are decided by Funders and enrollment is confirmed by Registrars; both are human decisions. Automated checks are used only to screen for fraud and to route payments, and you may ask for a person to review any outcome that affects you.

15. Changes to this Policy

We will update this Policy when our practices change. Each version carries a version identifier and an effective date. Where a change materially affects you, we will notify you by email and on your dashboard, and ask you to accept the new version before continuing.

16. Contact

Write to us at privacy@sepafrica.com, or scholarships@sepafrica.com for anything else. We aim to answer within 30 days.