Privacy Policy

1. Introduction

ConvSpace Platforms Ltd. ("ConvSpace," "we," "our," or "us") respects your privacy and is committed to protecting it through our compliance with this Privacy Policy.

This Privacy Policy describes the types of information we may collect from you or that you may provide when you use our products (collectively, our "Services") and our practices for collecting, using, maintaining, protecting, and disclosing that information.

This policy applies to information we collect:

• Through our Services, including any mobile and desktop applications.
• When you register for, use, or interact with our Services.
• In email, text, and other electronic messages between you and our Services.
• Through customer support and technical assistance interactions.

Please read this policy carefully to understand our policies and practices regarding your information and how we will treat it. If you do not agree with our policies and practices, your choice is not to use our Services. By accessing or using our Services, you agree to this Privacy Policy.

2. Data Controller

ConvSpace Platforms Ltd. is the data controller responsible for the processing of personal data as described in this Privacy Policy.

Our contact details:

ConvSpace Platforms Ltd.
Email: privacy@convspace.com

3. Information We Collect About You and How We Collect It

3.1 Personal Data

We may collect the following types of information from and about users of our Services. Which of these apply to you depends on the products you use, and some relate to products that are not yet available.

• Identity Data: Where you create an account, we may collect your first name, last name, username or similar identifier, title, date of birth and profile picture.
• Contact Data: Your email address. Where relevant to a product you use, we may also collect a billing address, delivery address or telephone number.
• Financial Data: We do not collect or store your payment card details. Payments are handled by our payment provider, which processes card information directly. We may receive a record of the transaction, such as its amount, date, status and reference.
• Transaction Data: Where you purchase from us, we may collect details of those payments; and where you use our accounting products, the transactions you record within them.
• Technical Data: Your internet protocol (IP) address, browser type and version, operating system, device type, language and time zone settings, and approximate location. Where you hold an account, your login data.
• Profile Data: Where you hold an account, we may collect your username and a secure password hash, purchases or orders made by you, your preferences, feedback and survey responses.
• Usage Data: Information about how you use our Services.
• Educational Data: Where you use our learning products, we may collect performance data, scores, progress records and other assessment-related information.
• Communication Data: We may collect your preferences in receiving marketing from us, and your communication preferences.

3.2 Special Categories of Personal Data

We do not collect any Special Categories of Personal Data about you (this includes details about your race, ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offenses.

3.3 How We Collect Your Personal Data

We use different methods to collect data from and about you including through:

Direct Interactions

You may give us your Identity, Contact, Financial, and Profile Data by filling in forms or by corresponding with us by mail, phone, email, or otherwise. This includes personal data you provide when you:

• Register for our Services;
• Subscribe to our services or publications;
• Request marketing to be sent to you;
• Enter a competition, promotion, or survey;
• Report a problem with our Services;
• Contact customer support; or
• Give us feedback.

Automated Technologies or Interactions

As you interact with our Services, we may automatically collect Technical Data about your equipment, browsing actions, and patterns. We collect this personal data by using cookies, server logs, and other similar technologies. Please see our Cookie Policy for further details.

Third Parties or Publicly Available Sources

We may receive personal data about you from various third parties and public sources, such as:

• Technical Data from analytics providers and search information providers;
• Contact, Financial, and Transaction Data from providers of technical, payment, and delivery services;
• Identity and Contact Data from publicly available sources such as government databases.

3.4 Website Analytics

We use privacy-focused analytics to understand how our Services are used. It records the Usage and Technical Data described above, together with the pages visited and how you reached them, and resolves location no further than your country and an approximate region. It does not use cookies, does not follow you across other websites, and is not used to identify you individually.

4. How We Use Your Information

4.1 Purposes for Processing

We have set out below a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Purpose/Activity	Type of Data	Legal Basis for Processing
To register you as a new customer	Identity, Contact	Performance of a contract with you
To provide our accounting and educational testing services	Identity, Contact, Financial, Transaction, Educational	Performance of a contract with you; Necessary for our legitimate interests (to provide functional and effective services)
To process and deliver your order including: (a) Managing payments, fees and charges; (b) Collecting and recovering money owed to us	Identity, Contact, Financial, Transaction, Communication	Performance of a contract with you; Necessary for our legitimate interests (to recover debts due to us)
To manage our relationship with you which will include: (a) Notifying you about changes to our terms or privacy policy; (b) Asking you to leave a review or take a survey	Identity, Contact, Profile, Communication	Performance of a contract with you; Necessary to comply with a legal obligation; Necessary for our legitimate interests (to keep our records updated and to study how customers use our services)
To enable you to participate in a prize draw, competition, or complete a survey	Identity, Contact, Profile, Usage, Communication	Performance of a contract with you; Necessary for our legitimate interests (to study how customers use our services, to develop them and grow our business)
To administer and protect our business and services (including troubleshooting, data analysis, testing, system maintenance, support, reporting, and hosting of data)	Identity, Contact, Technical	Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganization or group restructuring exercise); Necessary to comply with a legal obligation
To deliver relevant website content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you	Identity, Contact, Profile, Usage, Communication, Technical	Necessary for our legitimate interests (to study how customers use our services, to develop them, to grow our business and to inform our marketing strategy)
To use data analytics to improve our services, marketing, customer relationships, and experiences	Technical, Usage	Necessary for our legitimate interests (to define types of customers for our services, to keep our Services updated and relevant, to develop our business and to inform our marketing strategy)
To make suggestions and recommendations to you about goods or services that may be of interest to you	Identity, Contact, Technical, Usage, Profile	Necessary for our legitimate interests (to develop our services and grow our business)

4.2 Change of Purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

4.3 Anonymized Data Use

We may anonymize your personal data (so that it can no longer be associated with you) for research or statistical purposes. We may use anonymized information indefinitely without further notice to you to improve our Services. This anonymized data may be used to:

• Improve the functionality and user experience of our products;
• Develop new features and services;
• Conduct research and statistical analysis to better understand usage patterns;
• Enhance our educational testing algorithms and assessment methodologies;
• Improve the accuracy of our accounting features and financial tools.

5. Disclosures of Your Personal Data

We may share your personal data with the parties set out below for the purposes outlined in section 4:

• Internal Staff: Employees who need access to provide you with our Services.
• Service Providers: Including providers for IT and system administration services, payment processing, customer support, and cloud hosting.
• Professional Advisers: Including lawyers, bankers, auditors, and insurers who provide consultancy, banking, legal, insurance, and accounting services.
• Tax and Regulatory Authorities: Government bodies that require reporting of processing activities in certain circumstances.
• Third Parties: To whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

5.1 No Sale of Personal Data

We do not sell your personal data to third parties. We also do not share your personal data with third parties for their direct marketing purposes without your explicit consent.

6. International Transfers

We operate in multiple countries including Nigeria, other African countries, Canada, the United Kingdom, and the European Union. This may involve transferring your data outside the country where you reside.

Whenever we transfer your personal data out of your region, we ensure a similar degree of protection is afforded to it by implementing safeguards:

• We may transfer data to countries that have been deemed to provide an adequate level of protection for personal data by regulatory authorities.
• Where we use certain service providers, we may use specific contracts approved by regulatory authorities which give personal data the same protection it has in your region.
• For transfers to the US and other countries without adequacy decisions, we implement appropriate technical and organizational measures to ensure the protection of your data.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of your region.

7. Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorized way, altered, or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors, and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Our security measures include:

• Encryption of personal data at rest and in transit;
• Regular security assessments and penetration testing;
• Strict access controls and authentication procedures;
• Employee training on data protection and security;
• Physical security measures for our data centers and offices;
• Regular backups to prevent data loss;
• Incident response plans for addressing potential breaches.

8. Data Retention

We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

By law, we may have to keep basic information about our customers (including Contact, Identity, Financial, and Transaction Data) for tax, legal, and regulatory compliance purposes, typically for a minimum of six years after they cease being customers.

In some circumstances, you can ask us to delete your data. See "Your Legal Rights" below for further information.

In some circumstances, we may anonymize your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

9. Your Legal Rights

Depending on your location, you may have various rights regarding your personal data, which may include:

9.1 General Rights (Available Globally)

• Right to Access: You can request copies of your personal data.
• Right to Rectification: You can request correction of inaccurate personal data.
• Right to Object: You can object to processing of your personal data in certain circumstances.
• Right to Withdraw Consent: Where we rely on consent, you can withdraw this at any time.

9.2 Additional Rights (Varies by Jurisdiction)

Depending on your location, you may have additional rights:

European Union (GDPR) and UK Rights

• Right to Erasure (Right to be Forgotten): You can request deletion of your personal data in certain circumstances.
• Right to Restrict Processing: You can request we restrict the processing of your personal data in certain circumstances.
• Right to Data Portability: You can request transfer of your personal data to you or a third party.
• Right to Object to Automated Decision-Making: You can object to automated decision-making, including profiling.

Canadian Rights (PIPEDA)

• Right to Access: You can request access to your personal information and information about how it is used.
• Right to Correction: You can challenge the accuracy of your personal information and have it amended.
• Right to Withdraw Consent: You can withdraw consent to the collection, use or disclosure of personal information.

Nigerian Rights (NDPA 2023)

• Right to Request Access: You can request access to your personal data.
• Right to Object to Processing: You can object to processing that is causing damage or distress.
• Right to Prevent Processing for Direct Marketing: You can prevent processing for direct marketing.
• Right to Object to Automated Decision-Making: You can object to automated decision-making.
• Right to Rectification, Blocking, and Erasure: You can correct, block, or remove your personal information.
• Right to Data Portability: You can receive your personal data in a structured, commonly used and machine-readable format, and have it transmitted to another data controller.
• Right to Lodge a Complaint: You can complain to the Nigeria Data Protection Commission.

9.3 Exercising Your Rights

If you wish to exercise any of the rights set out above, please contact us at privacy@convspace.com.

9.4 No Fee Usually Required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

9.5 What We May Need From You

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

9.6 Time Limit to Respond

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

10. Cookie Policy

Our website uses cookies and similar technologies. For detailed information, please see our Cookie Policy.

11. Children's Privacy

We do not knowingly process the personal data of a child under the minimum age required to lawfully consent to data processing in their jurisdiction (typically 13) without the consent of a parent or guardian.

Our learning products are intended to be used by a child under the supervision of a parent or guardian. The account is held by that parent or guardian, and by setting up a child's access to it they consent to our processing of that child's information and confirm they are entitled to do so. They can access, correct or delete that information at any time, and may withdraw consent by closing the account or by contacting us.

Where our products are instead provided to an educational institution, we require that institution to obtain appropriate parental or guardian consent before any personal information is collected.

If you are a parent or guardian and believe your child has given us personal information without your consent, please contact us at privacy@convspace.com. If we become aware that we hold a child's personal information without the consent described above, we will delete it.

12. Third-Party Links

Our Services may include links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our Services, we encourage you to read the privacy policy of every website you visit.

13. Updates to This Privacy Policy

We may update this Privacy Policy from time to time in response to changing legal, technical, or business developments. When we do, we will revise the "Last Updated" date at the top of this page and take appropriate measures to inform you, consistent with the significance of the changes we make.

The date the Privacy Policy was last revised is identified at the top of the page. You are responsible for ensuring we have an up-to-date active and deliverable email address for you, and for periodically visiting our website and this Privacy Policy to check for any changes.

14. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact our Data Protection Officer:

Data Protection Officer
ConvSpace Platforms Ltd.
Email: dpo@convspace.com

14.1 Complaints

You have the right to make a complaint at any time to the supervisory authority for data protection issues in your country. We would, however, appreciate the chance to deal with your concerns before you approach the authority, so please contact us in the first instance.