EDU GAMING SERVICE
PRIVACY POLICY
Edu Gaming Service (we, us, our or the Service) is an education support lottery product operated by a licensed Value Added Services provider in partnership with licensed telecommunications operators in Nigeria.
We are committed to protecting your privacy and processing your personal data in a fair, lawful, transparent, secure, and accountable manner in full compliance with the Nigeria Data Protection Act, 2023 (NDPA), guidelines issued by the Nigeria Data Protection Commission (NDPC), and all other relevant Nigerian laws and regulations.
This Privacy Policy explains in detail how we collect, process, use, disclose, store, secure, retain, and transfer your personal data when you subscribe to, access, or participate in the Edu Gaming Service through any approved channel, including but not limited to USSD, SMS, mobile site, application interface, shortcode, or other authorized telecommunications platforms.
By subscribing to, accessing, or participating in the Service, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree, you must immediately cease subscription and participation in the Service.
This Privacy Policy forms an integral part of the Edu Gaming Service and in the event of any inconsistency, the provisions of the NDPA shall prevail.
1. Definitions
In addition to the definitions in the Terms and Conditions, the following terms shall apply:
Personal Data: Any information relating to an identified or identifiable natural person (data subject).
Sensitive Personal Data: Includes data revealing racial or ethnic origin, religious beliefs, health status, biometric data, genetic data, sexual orientation, or any other category classified as sensitive under the NDPA.
Data Controller: Edu Gaming Service, which determines the purposes and means of processing your personal data.
Data Processor: Any third party that processes personal data on our behalf under a written agreement.
Data Processing: Any operation performed on personal data, whether automated or not, such as collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, alignment, combination, restriction, erasure, or destruction.
Consent: Any freely given, specific, informed, and unambiguous indication of your wishes by which you signify agreement to the processing of your personal data.
2. Data Protection Principles
We are fully committed to upholding the fundamental data protection principles enshrined in the NDPA 2023:Lawfulness, Fairness, and Transparency: We process personal data lawfully, fairly, and in a transparent manner, providing clear information about our processing activities.Purpose Limitation: We collect personal data for specified, explicit, and legitimate purposes and do not process it in a manner incompatible with those purposes.Data Minimization: We limit collection to only what is adequate, relevant, and necessary for the stated purposes.Accuracy: We take reasonable steps to ensure personal data is accurate and, where necessary, kept up to date.Storage Limitation: We retain personal data no longer than is necessary for the purposes for which it was collected, subject to legal retention obligations.Integrity and Confidentiality (Security): We process personal data in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing, accidental loss, destruction, or damage.Accountability: We are responsible for, and able to demonstrate compliance with, all the above principles through appropriate policies, procedures, records, audits, and training.We conduct regular reviews and, where appropriate, Data Protection Impact Assessments DPIAs to ensure ongoing adherence, especially for high-risk activities such as large-scale processing of student data or automated draw selections.
3. Information We Collect
We collect various categories of personal data depending on how you interact with the Service. Collection occurs directly from you, from our Telecommunication Partners, from educational institutions (during verification), or through automated systems.
3.1 Subscription and Contact Information Mobile telephone number (MSISDN), device identifiers, IMEI or equivalent where technically accessible and permitted, email address if provided, full name, date of birth, gender, and any information voluntarily submitted during the opt-in or subscription process.
3.2 Eligibility and Verification Information Government issued identification such as National Identity Number (NIN), Voter's Card, Driver's License, International Passport e.t.c. Student identity card or enrollment confirmation, school name, school address, faculty/department, level of study, proof of current enrollment in a recognized Nigerian secondary or tertiary institution, and parent/guardian full name, contact details, and relationship documentation where required for prize claims involving educational disbursements.
3.3 Billing and Transaction Information Airtime deduction records, Entry Fee amounts and timestamps, subscription tier details, recurring billing status, transaction references, successful or failed billing attempts, and any refund-related records.
3.4 Participation and Gaming Activity Information All responses, answers, predictions, or submissions made for Daily Draws, Weekly Draws, or Monthly Draws; time and date of submissions; number of entries per day subject to the five entry daily limit; Ticket IDs generated; participation history; and any user-generated content provided during gameplay or interactions.
3.5 Prize Claim, Verification, and Fulfilment Information School fee invoices, tuition payment notices, or other approved academic expense documentation; declarations, undertakings, indemnities, or consents provided during prize claims and any additional supporting evidence submitted for age, student status, or beneficiary verification.
3.6 Technical, Usage, and Analytics Information IP address where the mobile site or app is used, device type and model, operating system version, browser information, USSD/SMS interaction logs, session durations, error logs, clickstream data, and anonymized or pseudonymized analytics on service usage patterns.
3.7 Communication and Support Information Records of all inbound and outbound communications, including SMS, phone calls, emails, in app messages, customer support tickets, complaints, feedback, and resolution notes.
3.8 Other Information Any additional personal data you voluntarily provide or that is generated as a consequence of your use of the Service, including data collected for responsible gaming monitoring or fraud detection.
We do not intentionally collect Sensitive Personal Data beyond what is strictly necessary for eligibility verification or legal compliance. We also do not knowingly collect or process personal data of children under the age of 18. If we discover such data has been collected, we will promptly delete it and take appropriate remedial action, including suspension of the relevant subscription.4. Sources and Methods of Collection
Personal data is primarily collected:
- Directly from you during subscription/opt-in, participation in draws, prize claims, or when you contact customer support.
- Indirectly from Telecommunication Partners for billing and subscriber validation.
- From educational institutions or authorized verifiers during prize fulfilment processes.
- Through automated technical which means when you interact with our platforms.
5. Purposes and Lawful Bases for Processing Personal Data
5.1 We process personal data only for specific, explicit, and legitimate purposes. These include:
- Processing and managing subscription, recurring Airtime Billing, and generation of valid Ticket IDs for participation.
- Enabling, administering, and recording entries in Daily, Weekly, and Monthly Draws, including winner selection through automated or combined manual/automated mechanics.
- Notifying potential winners, conducting verification and audits, and fulfilling prizes such as directing educational grants or tuition payments directly to verified schools or approved beneficiaries.
- Verifying eligibility to participate through age 18+, Nigerian residency, current student status and preventing ineligible or fraudulent participation.
- Communicating important service information, draw schedules, results, winner announcements, responsible gaming messages, security alerts, and amendments to Terms or this Policy.
- Detecting, preventing, investigating, and mitigating fraud, collusion, money laundering, identity theft, system abuse, or any prohibited conduct outlined in the Terms and Conditions.
- Complying with legal, regulatory, and audit obligations, including requirements from the NDPC, Nigerian Communications Commission (NCC), tax authorities, anti-money laundering agencies, and any other competent bodies.
- Conducting internal audits, draw integrity reviews, service performance analysis, and continuous improvement of the Edu Gaming Service.
- Responding to and resolving complaints, disputes, or legal claims efficiently.
- Performing statistical analysis, research, and service enhancement using anonymized or pseudonymized data where possible.
- Any other purpose for which explicit consent have been given or that is disclosed and consented to at the point of collection.
5.2 Under the Nigeria Data Protection Act, 2023, we can only process your personal data if we have a valid legal reason (called a “lawful basis”). Edu Gaming Service relies on one or more of the following lawful bases, depending on the situation:i. Your Explicit Consent: You give us clear and informed permission to use your data for specific purposes. You can withdraw remove your consent at any time. However, if you withdraw consent, you may no longer be able to continue participating in the Service.ii. Performance of a Contract: We need to process your data to fulfill our agreement with you that is, to manage your subscription, allow you to play the game, generate your Ticket ID, and run the Daily, Weekly, and Monthly Draws.iii. Compliance with Legal or Regulatory Obligations: We process your data when we are required to do so by law, for example, to obey rules from the Nigeria Data Protection Commission (NDPC), the Nigerian Communications Commission (NCC), tax authorities, or anti-money laundering regulations.Legitimate Interests: We process your data when it is necessary for our legitimate business interests or those of third parties, such as preventing fraud, protecting the security of the Service, detecting cheating, or improving how the Service works.We always make sure these interests do not override your rights and freedoms. When we rely on this basis, we carry out a Legitimate Interests Assessment (LIA) to ensure fairness.We will only use your personal data for the purposes we told you about. If we ever need to use it for a new or different purpose that is not compatible with the original reason, we will ask for your express consent or rely on another valid lawful basis permitted by law.
8. International Transfers of Personal Data
Personal data is primarily stored and processed within Nigeria. However, where it becomes necessary to transfer data outside Nigeria to international cloud service providers or technical support vendors, we ensure that adequate safeguards are in place. These shall include:
- NDPC-approved contractual clauses.
- Binding corporate rules where applicable.
- Reliance on any adequacy decisions or other mechanisms recognized under the NDPA.
9. Data Security Measures
We implement and maintain robust, multi layered technical, organizational, and administrative security measures designed to protect your personal data against unauthorized or unlawful processing, accidental loss, destruction, damage, or disclosure. These measures include, but are not limited to:
- Encryption of sensitive data both in transit and at rest.
- Strict role based access controls and multi factor authentication for internal systems.
- Regular security audits, vulnerability assessments, and penetration testing.
- Secure data centers with physical and environmental controls.
- Comprehensive staff training on data protection, confidentiality, and incident response.
- Incident detection, response, and breach notification procedures in line with NDPA requirements.
- Backup and disaster recovery protocols.
10. Data Retention Periods
We retain your personal data only for as long as is necessary to fulfill the purposes for which it was collected, to comply with legal or regulatory obligations, or to resolve disputes. Indicative retention periods include:Active subscription, billing, and participation records: For the duration of your subscription plus 5 years thereafter for audit, tax, and regulatory compliance purposes.Draw participation and winner selection records: For the duration of the relevant draw cycle plus at least 12–24 months for dispute resolution and integrity audits.Prize claim, verification, and fulfilment documentation: For the period required by financial, tax, or educational regulatory obligations shall be 5 years.Technical and security logs: For a period of 12 - 36 months for fraud prevention, security investigations, and system integrity purposes.Communication and complaint records: For 5 years after the duration of the subscription or as required for legal defense.Once the applicable retention period expires, we will securely delete, destroy, or irreversibly anonymize the data in accordance with industry standards and NDPA requirements. You may request information about specific retention periods applicable to your data by contacting us.
11. Your Rights as a Data Subject
Under the NDPA 2023, you have the following important rights in relation to your personal data subject to applicable legal exceptions and verification of your identity:
- Right to be informed about the collection and processing of your personal data.
- Right of access: To request confirmation whether we process your data and, if so, to obtain a copy of it.
- Right to rectification: To request correction of inaccurate or incomplete personal data.
- Right to erasure (“right to be forgotten”): To request deletion of your personal data where it is no longer necessary or where you withdraw consent subject to exceptions.
- Right to restriction of processing: To request that we limit processing in certain circumstances.
- Right to object to processing: Particularly where processing is based on legitimate interests or for direct marketing purposes.
- Right to data portability: To receive your data in a structured, commonly used, and machine-readable format and to transmit it to another controller (where technically feasible).
- Right to withdraw consent at any time (where consent is the lawful basis), without affecting the lawfulness of processing based on consent before withdrawal.
- Right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you (with exceptions and safeguards).
- Right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your rights have been infringed.
12. Data Protection Impact Assessment (DPIA) and Accountability Measures
Because the Service involves large scale processing of personal data including student and educational information and certain automated elements in draws and fraud detection, we regularly conduct Data Protection Impact Assessments (DPIAs) for high risk processing activities as required or recommended under the NDPA.We maintain detailed records of processing activities, appoint a Data Protection Officer or equivalent responsible person. We also cooperate with the NDPC and participate in sector specific initiatives aimed at strengthening data protection in the Nigerian gaming and lottery industry.
14. Amendments to this Privacy Policy
We may update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, service features, technological developments, or evolving legal and regulatory requirements.Material changes will be communicated to you through one or more approved channels such as SMS, USSD notification, in-app message, website announcement, or email where available at least seven (7) days before the revised Policy takes effect, where reasonably practicable. Non-material changes may be posted on our official channels without prior notice.Your continued subscription to or participation in the Service after the effective date of any amended Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the changes, you must unsubscribe and stop using the Service before the new Policy becomes effective.
15. Contact Information and How to Reach Us
For any questions, concerns, requests to exercise your data subject rights, or complaints regarding this Privacy Policy or the processing of your personal data, please contact:We encourage you to contact us first so we can address your concern promptly. If you remain dissatisfied after our internal response, you have the right to lodge a formal complaint with the Nigeria Data Protection Commission (NDPC) through their official channels.
Customer Support Email: [Insert Email Address]
Customer Support Telephone: [Insert Phone Number]
SMS Helpdesk / Shortcode: [Insert Shortcode]
Official Website: [Insert Website URL]
Registered Office Address: [Insert Registered Address]
16. Relationship with Other Documents and Governing Law
This Privacy Policy must be read together with the Edu Gaming Service Terms and Conditions of Use and any other applicable policies or notices. It does not limit any of your statutory rights under the NDPA 2023 or any other law.This Privacy Policy is governed by the laws of the Federal Republic of Nigeria.By subscribing to, accessing, or participating in Edu Gaming Service, you confirm that you have read, understood, and agreed to this extensive Privacy Policy, including the collection, processing, sharing, and other handling of your personal data as described.
