Data Protection Statement

• Centre onboarding — contact, corporate and tax data. Basis: contract.
• Invoice submission and verification — candidate counts, attendance evidence, invoice documents. Basis: contract.
• Payment execution — bank account details shared with the payout provider. Basis: contract and legal obligation.
• Security and audit — staff identity, action logs, request metadata. Basis: legitimate interest and legal obligation.

Only fields required to onboard, verify and pay a centre are collected. Bank account numbers are shown in full only to finance and administrator roles; webhook payloads received from the payout provider are redacted of account details and other identifiers before storage.

• Payment provider webhook payloads — content stripped at 90 days, rows deleted at 12 months.
• Email delivery logs — recipient and subject redacted at 180 days.
• Rate-limit counters — cleared after 48 hours.
• Invoices, payments and audit trail — retained for the statutory financial period.

The schedule is enforced by an automated retention sweep, not by manual clean-up.

• Cloud hosting, database and object storage provider.
• Transactional email provider (delivery of notices and receipts).
• uLesson Payout Engine (execution of bank transfers).
• Google (staff identity/sign-in only).

Some processing takes place outside Nigeria; transfers are made under the provider's contractual data protection commitments.

• Managed work-account sign-in restricted to approved domains, with optional app-based multi-factor authentication.
• Role-based permissions with an editable access matrix and full audit logging.
• Row-level database security on every table; private document storage with signed links.
• Signed, replay-protected and rate-limited webhook endpoints; payout ceilings and amount-variance checks.

Suspected breaches are triaged immediately, contained, and — where the incident is likely to result in a risk to data subjects — reported to the Nigeria Data Protection Commission within 72 hours of becoming aware, with affected individuals notified without undue delay. Every incident is followed by a documented post-incident review.

Requests for access, rectification, erasure, restriction, objection or portability should be sent to dpo@miva.university. We verify the identity of the requester, log the request in our audit trail, and respond within 30 days.