Privacy Policy

1. Introduction and Scope

This Privacy Policy explains how Skillnaija (which operates the website skillnaija.org) collects, uses, shares and protects your personal data when you use our free reskilling and ed-tech Progressive Web App and related services (together, the “service”).

Skillnaija is a Nigerian education platform. Our mission is to teach Nigerians (and some international learners) in-demand digital and vocational skills through structured courses, hands-on projects, merit-based certificates, and connections to jobs, employers and apprenticeships. We are based in and operated from Nigeria.

We take your privacy seriously. We try to collect only the data we genuinely need, to be clear about why we use it, and to give you real control over it. Please read this policy carefully. If you do not agree with it, please do not use the service.

Who this policy applies to. This policy applies to all users of Skillnaija — learners, mentors and apprentices, employers, partners and contributors, and visitors to our website. It covers the personal data we process through the Skillnaija app and website and through the emails we send and receive. It does not cover other websites or services that we link to but do not control (see Section 15).

This policy should be read together with our Cookie Policy and our Terms of Service.

2. Definitions

To keep this policy clear, here is what some key terms mean:

• Personal data — any information that relates to an identified or identifiable person (a “data subject”), such as your name, email address, location, or anything that can be linked back to you.
• Sensitive personal data — special categories of personal data that the NDPA gives extra protection, such as data revealing your health, religion, ethnic origin, or biometric data. We do not ask you for this kind of data, but a project submission could contain it if you choose to include it (see Section 4).
• Processing — anything we do with personal data, including collecting, recording, storing, using, sharing, organising, or deleting it.
• Data subject — the living individual whom the personal data is about (for example, you).
• Data controller — the person or organisation that decides why and how personal data is processed. For the service, the controller is Skillnaija.
• Data processor — a third party that processes personal data on the controller’s behalf and on its instructions (for example, our hosting and email providers). Sometimes called a “sub-processor”.
• NDPA — the Nigeria Data Protection Act 2023, the main law that governs how personal data is handled in Nigeria. We also follow the Nigeria Data Protection Regulation (NDPR) where it applies.
• NDPC — the Nigeria Data Protection Commission, the regulator that supervises data protection in Nigeria.
• GDPR — the EU/UK General Data Protection Regulation, which may give additional rights to users located in the European Union or United Kingdom.

3. Who We Are and Who Is Responsible for Your Data

Skillnaija is the data controller for the personal data described in this policy. This means we decide what personal data is collected and how it is used.

Our details are:

• Name: Skill Naija LTD (trading as “Skillnaija”)
• Website: https://skillnaija.org
• Registered office: [registered office address]
• Company/registration number: [RC number, if applicable]

For any privacy or data-protection question, request, or complaint — and to contact our data-protection point of contact — please email hello@skillnaija.org. This is the single email address to use for all privacy matters.

If different parts of the service involve different controllers. Where an employer or partner organisation independently decides how to use personal data they receive through the service (for example, an employer deciding how to handle a job application you send them), that organisation is a separate controller for that use, and its own privacy practices apply. We are not responsible for how independent third parties use data once you choose to share it with them (see Sections 8 and 15).

4. The Personal Data We Collect and How We Collect It

We collect personal data in three main ways:

• Directly from you — when you create an account, fill in a form, submit a project, contribute content, post a job, or email us.
• Automatically — when you use the app, through technical and usage data (see (j) below).
• From third parties — for example, our authentication provider confirms your sign-in; an employer or partner organisation may give us a contact person’s details when they sign up or post a listing; and a mentor or referrer may pass on details in the course of using the service. Where we receive your data from someone else, this policy explains how we then use it.

The categories of personal data we collect are set out below. We only collect what is relevant to the part of the service you use.

(a) Account and authentication data

Your email address, your password (this is handled by our authentication provider and stored in hashed form — we never see or store your actual password), and sign-in timestamps.

(b) Learner profile data

Your city/location, your learning goal, and your language preference.

(c) Learning activity data

The courses you enrol in, lessons you complete, your progress percentage, your last-active time, and your “skill compass” self-assessment answers.

(d) Project submission data

A URL or free text that you submit to be graded. This may contain whatever personal information you choose to include, so please be careful not to include sensitive or private details you do not want assessed or stored. We do not ask you to include sensitive personal data, and we recommend you do not. We also store the resulting AI grade, score, feedback, and grading metrics.

(e) Certificates

The certificates you have earned by completing a course and passing its project, including the course, the date, and a verifiable record of the achievement.

(f) Mentor and apprentice data

Full name, email address, phone number, city, experience details, and the courses a mentor mentors.

(g) Employer accounts and job listings

Organisation name and website, and the roles employers post — including company, job title, location, salary range, application link or email, and the job description. Job listings are intended to be business information, but a contact email or application address may identify an individual.

(h) Partner and contribution enquiry data

Organisation name and type, contact name, role, email, phone, website, and your message; plus any learning resources or course content you contribute.

(i) Communications

The emails we send you and the replies you send us, and any other messages you send us.

(j) Technical and usage data (collected automatically)

Your IP address, device and browser type, approximate location (derived from your IP address, not precise GPS), and the actions you take in the app. This is stored in our server logs and, for project submissions, in internal security alerts that have restricted access.

(k) On-device storage

App state and progress, your language preference, cached lesson media, and authentication tokens are stored locally in your browser. These are not advertising cookies and are not used for cross-site tracking. See Section 5 for more.

5. Cookies and Local / On-Device Storage

Skillnaija does not use third-party advertising cookies or cross-site tracking. To make the app work, we store certain information directly in your browser (on your device), including:

• your app state and learning progress, so you can pick up where you left off;
• your language preference;
• cached lesson media, so lessons load faster and can work offline; and
• authentication tokens, so you stay signed in securely.

This on-device storage is essential to providing the service you asked for. You can clear it at any time through your browser settings, although doing so may sign you out and reset locally stored progress.

For full details of what we store and why, please see our separate Cookie Policy.

6. How and Why We Use Your Data (and Our Lawful Basis)

Under the NDPA we must have a valid lawful basis for each way we use your personal data. The main lawful bases are: consent, performance of a contract, compliance with a legal obligation, legitimate interests, vital interests, and public interest. Below we explain what we do with your data and the basis we rely on for each.

To create and manage your account and deliver the service

We use your account, profile and learning-activity data to register you, sign you in, save your progress, deliver courses and lessons, grade your projects, and issue certificates. Lawful basis: performance of a contract (providing you the service you signed up for).

To assess your project submissions and award certificates

We use your project submissions to grade them (see Section 7) and, on a passing grade, to issue a certificate. Lawful basis: performance of a contract.

To enable mentoring, apprenticeships, employer listings and partner contributions

We use mentor/apprentice, employer/job and partner/contribution data to operate these features and connect people appropriately. Lawful basis: performance of a contract (where you have signed up for that feature) and/or legitimate interests in running and improving the platform.

To send you service and learning communications

We email you about your account, your courses and your learning. Lawful basis: performance of a contract and/or legitimate interests.

To send partnership, material-contribution and sponsorship outreach to organisations

We may email organisations about partnering with, contributing to, or sponsoring Skillnaija. Lawful basis: legitimate interests (growing the platform and its learning resources). You can opt out at any time (see Section 13).

To keep the platform safe and secure

We use technical and usage data, server logs and internal security alerts to detect, prevent and investigate fraud, abuse, and security threats. Lawful basis: legitimate interests (protecting our users and our service) and, where applicable, legal obligation.

To improve and develop the service

We analyse how the service is used (in an aggregated or anonymised way where we can) to fix problems and improve courses and features. Lawful basis: legitimate interests.

To comply with the law

We process data where we must do so to meet legal, regulatory or safety obligations, or to respond to lawful requests. Lawful basis: legal obligation.

To establish, exercise or defend legal claims

We may keep and use limited data where necessary to handle a dispute or protect our legal rights. Lawful basis: legitimate interests and, where applicable, legal obligation.

To protect people in an emergency

In rare cases we may use data to protect someone’s life or physical safety. Lawful basis: vital interests.

Where we rely on consent (for example, for any future optional feature that asks for it, or for a 13–17 year old’s use of the service through a parent or guardian), you can withdraw that consent at any time without affecting processing already carried out. Where we rely on legitimate interests, we first carry out a balancing exercise to make sure our interests do not override your rights and freedoms, and you have the right to object (see Section 12). You can ask us for more information about that balancing exercise at any time.

7. Automated Decision-Making and Artificial Intelligence (AI)

Skillnaija uses AI in two ways:

• Grading project submissions. When you submit a project, it is assessed by an AI model (Google Gemini), which produces a grade, score, feedback and grading metrics.
• Drafting communications internally. We use AI to help draft some of the emails and outreach we send. These drafts are reviewed by a human before anything is sent.

Human review and your safeguards. Projects for safety-critical courses (such as electrical work, solar installation, and data-centre technician), and any other project flagged for review, are additionally reviewed by a human before any certificate is issued. Certificates are only ever issued on a passing grade.

You have the right not to be subject to a decision based solely on automated processing that produces a legal effect or a similarly significant effect on you. We do not make such solely-automated significant decisions about you: a project grade is educational feedback within a learning service, you may always request human review, and for safety-critical and flagged projects a human is always involved before a certificate is issued.

How to request human review or contest a grade. If you believe an AI grade is wrong or unfair, you can ask a person to review it. Email hello@skillnaija.org with your account email and the project concerned, and a member of our team will look into it, explain the outcome, and correct it where appropriate. You can also express your point of view and ask us to reconsider.

8. When and With Whom We Share Your Data

We do not sell your personal data, and we do not use third-party advertising or cross-site tracking. We only share personal data in the limited situations below:

• Service providers (processors). We share data with the trusted providers that run our infrastructure, listed in Section 9. They act on our documented instructions, are bound by contract, and may only use the data to provide services to us.
• Employers, when you apply for a job. If you choose to apply to a job listing, your application is shared with that employer. We do not share your data with employers unless you take that step yourself. Once shared, the employer becomes a separate controller of that information.
• Legal, regulatory and safety disclosures. We may disclose data where we are legally required to, to comply with a lawful request from a court or regulator, to enforce our terms, or to protect the rights, property or safety of our users, the public, or Skillnaija.
• Business transfer. If Skillnaija is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction. We will require the recipient to respect this policy, and we will tell you if this materially changes how your data is handled.

We do not otherwise share, rent, or sell your personal data to anyone.

9. Third-Party Processors and International Data Transfers

We use the following carefully selected sub-processors to run the service. Because these providers are cloud-based, your personal data may be processed and stored outside Nigeria, including in the United States and/or the European Union.

• Supabase — database, authentication, file storage, and serverless functions.
• Vercel — website hosting and content delivery.
• Google (Gemini API) — AI assessment of project submissions and AI drafting.
• Resend — sending our transactional and outreach emails.

Our source code is hosted on GitHub, which does not process your personal data.

Cross-border transfers and the safeguards we rely on

When we transfer personal data outside Nigeria, we do so in line with the NDPA’s rules on cross-border transfers. We rely on one or more of the following: the recipient being in a country or under a mechanism that provides an adequate level of protection; appropriate contractual safeguards (such as data-processing agreements and standard contractual clauses) with each provider; or, where relevant, your consent or the transfer being necessary to perform our contract with you. We only use providers that we are satisfied offer an adequate level of protection. If you would like more information about the specific safeguards we use, contact hello@skillnaija.org.

10. How Long We Keep Your Data (Retention)

We keep personal data only for as long as we need it for the purposes set out in this policy, and then we delete it or anonymise it. How long that is depends on the type of data:

• Account, profile and learning data — kept for as long as your account is active, and typically deleted or anonymised within a reasonable period (for example, within around 90 days) after you delete your account, unless we must keep it longer for a reason below.
• Project submissions, grades and certificates — kept while your account is active, so your achievements and certificates remain valid and verifiable; certificate records may be retained in a minimal, verifiable form after deletion so issued certificates can still be confirmed.
• Mentor/apprentice, employer/job and partner/contribution data — kept while the relevant relationship or listing is active, and for a reasonable period afterwards (for example, to handle follow-up enquiries), then deleted or anonymised.
• Communications — kept for as long as needed to handle your enquiry and for our records, typically up to around 24 months unless a longer period is required.
• Technical, usage and security-log data — kept for a limited period (typically up to around 12 months) for security, troubleshooting and abuse-prevention, then deleted or aggregated.

The main criteria we use to decide retention periods are: how long we need the data to provide the service; whether we have a legal or regulatory obligation to keep it; and whether we need it to defend legal claims or keep the platform safe. The indicative periods above are guides and may vary where one of these criteria requires it.

What happens when you delete your account

When you ask us to delete your account, we will delete or anonymise your personal data, except where we are required to keep certain information to meet a legal obligation, resolve disputes, prevent fraud or abuse, support already-issued certificate verification, or where it has been irreversibly anonymised. To request deletion, email hello@skillnaija.org.

11. How We Keep Your Data Secure

We use appropriate technical and organisational measures to protect your personal data, including:

• Encryption in transit and at rest, so data is protected as it moves between you and us and while it is stored;
• Row-level access controls in our database, so users can only access the data they are permitted to;
• Least-privilege and service-role restrictions, so powerful access is limited and tightly controlled;
• Restricted access to personally identifiable information (PII) and to sensitive internal records such as security alerts; and
• hashed passwords handled by our authentication provider, which means we never see your password.

No system can be guaranteed to be 100% secure, but we work continually to protect your data and to limit the impact of any incident. You also play a part: please keep your password confidential and use the service responsibly.

Personal data breaches

We keep an internal record of personal data breaches. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission (NDPC) within the timeframe the NDPA expects (generally within 72 hours of becoming aware of it). Where the breach is likely to result in a high risk to you, we will also notify you without undue delay, and tell you what happened, what data was involved, and what steps you can take to protect yourself.

12. Your Data-Protection Rights

Under the NDPA (and, for users in other regions, comparable laws such as the GDPR), you have the following rights over your personal data:

• The right to be informed — to know how we use your data, which this policy is designed to explain.
• The right of access — to get a copy of the personal data we hold about you and information about how we use it.
• The right to rectification — to have inaccurate or incomplete data corrected.
• The right to erasure (“right to be forgotten”) — to have your data deleted in certain circumstances.
• The right to restriction — to ask us to limit how we use your data in certain circumstances, for example while we check the accuracy of data you have challenged.
• The right to object — to object to processing based on legitimate interests, and to object to outreach/marketing at any time.
• The right to data portability — to receive the personal data you provided to us, where we process it by automated means based on your consent or our contract, in a structured, commonly used, machine-readable format, and to have it transferred to another controller where technically feasible.
• The right to withdraw consent — where we rely on your consent, you can withdraw it at any time (this does not affect processing already done).
• The right not to be subject to solely-automated decisions with a legal or similarly significant effect (see Section 7).
• The right to lodge a complaint with the NDPC (see Section 18).

How to exercise your rights

To exercise any of these rights, email hello@skillnaija.org. We may need to verify your identity before acting (for example, by confirming you control the account email), to make sure we do not give your data to the wrong person.

We will respond without undue delay and normally within 30 days. If your request is unusually complex or you have made several requests, we may need more time, and we will let you know within that period. Exercising your rights is normally free of charge; we may only charge a reasonable fee, or decline to act, if a request is clearly unfounded, repetitive or excessive, and we will explain why if so. You will not suffer any disadvantage in your use of the service for exercising your rights.

13. Marketing and Communications

We send a few different types of emails:

• Account and learning emails to learners (for example, about your account, security, or your courses); and
• Partnership, material-contribution and sponsorship outreach to organisations.

You can opt out of outreach/marketing emails at any time by replying “unsubscribe” to the email, or by emailing hello@skillnaija.org. We will stop sending you those communications. Please note we may still need to send you essential service messages (for example, security or account notices) for as long as you have an account, as these are part of providing the service and are not marketing.

14. Children’s Privacy and Age Limits

The minimum age to hold a Skillnaija account independently is 18.

Users aged 13 to 17 may use the service only with the verifiable consent and supervision of a parent or legal guardian, who is responsible for that use. The service is not directed to children under 13, and we do not knowingly collect personal data from anyone under 13.

If you are a parent or guardian and believe a child under 13 has given us personal data, or that a 13–17 year old is using the service without the required consent, please contact hello@skillnaija.org and we will take appropriate steps, including deleting the data where required.

15. Third-Party Links and Services

The service contains links to and content from third parties that we do not control, including job listings posted by third-party employers and partner organisations’ websites.

We review job listings but cannot guarantee them; Skillnaija is not the employer and is not party to any employment relationship. You should never pay to get a job, and you apply at your own risk. When you follow a link to another website or apply to an external employer, this Privacy Policy no longer applies — that third party’s own privacy practices govern your data. We are not responsible for the content or privacy practices of third-party sites, and we encourage you to read their policies before sharing your information.

16. International Users and Cross-Border Note

Skillnaija is operated from Nigeria and is primarily intended for users in Nigeria, although some international learners use it. Wherever you are located, your personal data will be processed in Nigeria and in the other locations described in Section 9 (including the United States and/or the European Union), under the safeguards set out there.

If you are in a jurisdiction with its own data-protection laws (such as the GDPR for users in the European Union or United Kingdom), you may have additional or equivalent rights, and we will respect those rights where they apply to you. We do not over-claim compliance beyond what applies to us, but we aim to handle everyone’s data to a high standard.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time — for example, if we add new features or change how we use data, or to reflect changes in the law. When we make changes, we will update the date shown at the top of this page. If the changes are significant, we will take reasonable steps to let you know, such as by notice in the app or by email. Your continued use of the service after an update means you accept the revised policy. We encourage you to review this page periodically.

18. How to Contact Us and How to Complain

If you have any questions about this policy, want to exercise your rights, or wish to make a complaint about how we handle your data, please contact us first so we can try to put things right:

• Email (general and privacy/data-protection contact): hello@skillnaija.org
• Website: https://skillnaija.org

You also have the right to lodge a complaint with the data-protection regulator. In Nigeria, this is the Nigeria Data Protection Commission (NDPC), which you can contact through its official website. If you are in another country, you may also be able to complain to your local data-protection authority. We would, however, appreciate the chance to address your concerns before you approach a regulator, so please do reach out to us first.