Privacy Policy

1. Introduction

Noorut-Tawheed Generic Academy ("the Academy", "we", "us", or "our") is committed to protecting the personal data of prospective and current students, parents, and guardians. This Privacy Policy explains how we collect, use, store, and protect personal information submitted through our website and admissions system, in accordance with the Nigeria Data Protection Act (NDPA) 2023.

2. Data We Collect

When you submit an admissions application, we collect the following categories of personal data:

• Student information: full name, date of birth, gender, nationality, state of origin, local government area, religion, Quran memorisation level, and academic history
• Parent/Guardian information: full name, relationship, phone number, email address, occupation, employer, and home address
• Emergency contact information: name, relationship, and phone numbers
• Medical information: blood group, known allergies, medical conditions, current medications, and family doctor details
• Declaration information: referral source, additional notes, and consent records
• Technical data: IP address hash (anonymised) for security and fraud prevention

When you submit a contact enquiry, we collect your name, email address, phone number (optional), subject, and message.

3. How We Use Your Data

We use the personal data we collect for the following purposes:

• Processing and evaluating your child's admissions application
• Communicating with you about your application status, assessments, and enrolment
• Maintaining accurate student and family records
• Ensuring the safety and welfare of students (emergency contact and medical data)
• Complying with applicable laws and regulations
• Preventing fraud and ensuring the security of our systems

4. Data Retention

Application data for unsuccessful applicants is retained for the duration of the admissions cycle plus three (3) years, after which it is securely deleted. For enrolled students, data is retained for the duration of their enrolment and for seven (7) years thereafter, in line with legal obligations. Contact enquiry data is retained for twelve (12) months.

5. Third-Party Services

To operate our admissions system, we use the following third-party services, each bound by their own privacy policies and data processing agreements:

• Resend — transactional email delivery (application confirmation and officer notification emails)
• Upstash Redis — rate limiting to prevent abuse of our submission systems
• hCaptcha — bot protection on our forms

We do not sell, rent, or share your personal data with any third party for marketing purposes.

6. Your Rights Under the NDPA 2023

Under the Nigeria Data Protection Act 2023, you have the following rights with respect to your personal data:

• Right of access: to request a copy of the personal data we hold about you
• Right to rectification: to request correction of inaccurate or incomplete data
• Right to erasure: to request deletion of your data where there is no lawful basis for continued processing
• Right to restrict processing: to request that we limit how we use your data
• Right to object: to object to our processing of your data in certain circumstances
• Right to data portability: to receive your data in a structured, machine-readable format

7. Contact for Data Requests

To exercise any of the rights above, or if you have any questions about how we handle your personal data, please contact us in writing at:

We will respond to verified data requests within 30 days of receipt.

8. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Continued use of our website following any changes constitutes acceptance of the revised policy.