This Privacy Policy explains how Oyo State State Universal Basic Education Board (Oyo SUBEB) (“we”, “us”, or “the Board”) collects, uses, stores, shares, and protects personal data in connection with the Oyo State TLM Track and Trace System (the “System”), in line with the Nigeria Data Protection Act, 2023 (NDPA), the Nigeria Data Protection Commission (NDPC) General Application and Implementation Directive (GAID), and related Nigerian data protection requirements.
This notice is provided in a clear and accessible format for users of the System, including Board staff, Local Government Education Authority (LGEA) officers, warehouse officers, school administrators, teachers, and other authorised users.
1. Data controller and contact
For privacy requests, please write “Data Subject Request” in the subject line and include enough information for us to verify your identity and locate your records. Where a Data Protection Officer (DPO) has been designated for the Board, that officer may also be contacted through the Board’s official channels.
2. Personal data we process
Depending on your role and how you use the System, we may process:
- Account and identity data — name, email address, phone number, role/permissions, organisation or school affiliation, and authentication credentials (passwords are stored in hashed form).
- Operational education logistics data — school, LGA, warehouse, shipment, delivery confirmation, inventory, and related programme records linked to authorised users or school contacts.
- Communications data — email or SMS messages sent for password setup, delivery confirmation codes, shipment notices, or similar service messages.
- Technical and security data — login session information, IP address, browser/device metadata, security logs, and cookies or similar technologies needed to operate the System securely.
The System is used for Teaching and Learning Materials tracking. It is not intended to collect special categories of sensitive personal data beyond what is necessary for authorised education logistics and account administration. Please avoid submitting unnecessary sensitive information in free-text fields.
3. Purposes of processing
We process personal data to:
- create and manage authorised user accounts and access controls;
- operate TLM shipment, warehouse, school delivery, confirmation, and reporting workflows;
- send service-related notices (for example password setup, confirmation codes, or delivery alerts);
- secure the System, prevent abuse, investigate incidents, and maintain audit trails;
- meet legal, audit, reporting, and public-sector accountability obligations of the Board; and
- improve reliability and support of the System.
4. Lawful bases for processing
Under NDPA section 25, processing is based on one or more of the following, as applicable:
- Public interest / official authority — performance of the Board’s statutory and official education-supply functions;
- Contract — creating and maintaining your user account and providing System access you requested or were assigned;
- Legal obligation — compliance with applicable Nigerian laws, audit, and regulatory requirements;
- Legitimate interests — securing the System, preventing fraud/misuse, and supporting reliable operations, where those interests are not overridden by your rights; and
- Consent — only where we specifically ask for it (for example optional communications). Consent may be withdrawn without affecting prior lawful processing.
5. Recipients and processors
Personal data may be accessed by:
- authorised Oyo SUBEB and LGEA personnel with role-based access;
- authorised school or warehouse officers for records relevant to their duties;
- Effigenix Insights (https://effigenixinsights.com) as a technology service provider / data processor engaged to host, maintain, or support the System;
- regulated communications providers used to deliver email or SMS service messages; and
- competent public authorities, auditors, or courts where disclosure is required by law or necessary to protect rights and security.
Processors are expected to process personal data only on documented instructions and with appropriate confidentiality and security safeguards.
7. Retention
We keep personal data only for as long as needed for the purposes above, including operational TLM programme records, account administration, security logging, and applicable public-sector retention, audit, or legal requirements. When data is no longer required and no lawful basis remains to keep it, we will delete or anonymise it in line with our retention practices.
8. Security measures
We apply appropriate technical and organisational measures to protect personal data, including access controls, encrypted transport (HTTPS), password hashing, activity monitoring where appropriate, and staff/user role restrictions. No method of transmission or storage is completely secure; users must also keep credentials confidential and report suspected unauthorised access promptly.
9. International transfers
Personal data is primarily processed for the Board’s operations in Nigeria. If any hosting, backup, support, or communications tooling involves transfer outside Nigeria, we will ensure an appropriate lawful basis and safeguards under the NDPA and NDPC guidance before such transfer.
10. Your rights
Subject to the NDPA and applicable exceptions, you may request to:
- be informed about processing of your personal data;
- access your personal data;
- rectify inaccurate or incomplete personal data;
- erase personal data where the NDPA conditions are met;
- restrict or object to certain processing;
- withdraw consent where processing is consent-based;
- not be subject to solely automated decisions with legal or similarly significant effects (see below); and
- lodge a complaint with the Nigeria Data Protection Commission (NDPC).
To exercise these rights, contact us using the details in section 1. We may need to verify your identity before acting on a request.
11. Automated decision-making
The System does not make decisions about individuals based solely on automated processing, including profiling, that produce legal or similarly significant effects. Operational calculations (for example stock or distribution figures) support human-administered education logistics workflows.
12. Children and learners
The System is directed at authorised education officials and school staff. It is not a public social platform for children. Where learner-related information is processed for TLM assignment or distribution, it is handled under the Board’s official education mandate and with role-limited access.
13. Data breach notification
Where a personal data breach occurs that is notifiable under the NDPA and NDPC requirements, we will assess the incident and notify the Commission and affected data subjects as required by law.
14. How to complain
Please contact us first so we can try to resolve your concern. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) via its official channels at https://ndpc.gov.ng.
15. Changes to this policy
We may update this Privacy Policy to reflect legal, technical, or operational changes. The “Last updated” date at the top will change when we do. The current version will remain available at this page and linked from the sign-in screen.