We do not sell personal data, and we do not share it for any third party's independent marketing purposes. Sharing happens only in the specific circumstances below.
11.1 Within the Academy
Access is role-based and, where relevant, scoped to specific records (Section 6.3) — not a shared pool everyone can see. A mentor sees only their assigned beneficiaries; finance staff see only the beneficiary fields needed to attribute spend; only the Founder/Super Admin role has unrestricted access.
11.2 External training platforms
Beneficiaries enroll directly with third-party training platforms (Udemy, Coursera, Udacity, and similar) to take courses; the Academy does not build or host training itself. Any information a beneficiary provides directly to one of those platforms is governed by that platform's own privacy policy, not this one. Where a mentor or the beneficiary tells the Academy about progress (e.g., “completed a certification”), that is recorded as an Outcome — a fact the Academy itself now holds and is responsible for under this policy — without the Academy exchanging bulk personal data with the platform.
11.3 Service providers (data processors)
The Academy uses third-party service providers to run its systems — for example, its hosting provider for the operations platform and, once launched, its website. These providers process personal data only on the Academy's instructions, under a written agreement, and only to the extent needed to provide their service (see Section 20 for due-diligence expectations).
11.4 Legal and regulatory disclosure
We disclose personal data where required by law — for example, to the Nigeria Data Protection Commission in connection with a breach notification or compliance inquiry, to SCUML/EFCC under anti-money-laundering reporting obligations (Section 4.6), to the Corporate Affairs Commission or tax authorities in connection with statutory filings, or in response to a valid court order or law enforcement request. We disclose only what is legally required, and we push back on requests that appear to exceed what the law actually requires.
11.5 With donor or public consent only
Identifying beneficiary, donor, or partner organization information is shared publicly — on the website, in donor communications, or in reports — only within the boundaries of the specific consent obtained under Section 9, and never beyond it.
11.6 In connection with a merger, restructuring, or wind-down
If the Academy were ever to merge with, be acquired by, or transfer its operations to another organization, or to formally wind down, personal data may be transferred as part of that transition, but only under confidentiality obligations at least as protective as this policy, and beneficiaries and donors would be notified of any such transition affecting their data.