Privacy Notice

Miva Open University is the data controller for personal data processed through this platform. Questions, complaints and data subject requests can be sent to the Data Protection Officer at dpo@miva.university.

• Centre contact data — organisation name, contact first and last name, email, phone and address.
• Corporate and tax data — company name, RC/BN number, year of incorporation and tax identification number.
• Payment data — bank name, account name and account number used to pay for centre services.
• Examination data — candidate counts, attendance sheets, invoices and supporting documents you upload.
• Staff account data — work email, name, role assignments and an audit record of actions taken in the platform.
• Technical data — request metadata such as IP address used for security, rate limiting and fraud prevention.

• Performance of a contract — onboarding centres, receiving invoices, verifying candidate counts and paying for services rendered.
• Legal obligation — tax, accounting and audit record keeping.
• Legitimate interest — securing the platform, preventing payment fraud and maintaining an audit trail of approvals.

We share only what is necessary with: our cloud hosting and database provider; our transactional email provider; and the uLesson Payout Engine, which executes bank transfers on our instruction. We do not sell personal data and we do not use it for advertising.

Invoice, payment and audit records are retained for the statutory financial record period. Raw payment-provider webhook payloads are stripped of content after 90 days and deleted after 12 months. Email delivery logs are redacted after 180 days. Submission links expire per exam cycle.

Access is limited to authorised Miva staff signing in with a managed work account, governed by role-based permissions and row-level database security. Uploaded documents are stored in private buckets and served only through short-lived signed links. Webhook traffic is authenticated with a signed message digest, throttled and replay-protected.

Under the Nigeria Data Protection Act you may request access to your personal data, ask us to correct or erase it, object to or restrict processing, and request portability. Write to dpo@miva.university and we will respond within 30 days. You may also complain to the Nigeria Data Protection Commission.