Data Protection Policy

This Data Protection Policy describes the principles, controls and practices adopted by Slate Nigeria Limited ("Slate", "we", "us" or "our") in relation to the processing of personal data on the Slate Tutors platform ("Platform"). We are based in Abuja, Nigeria and are committed to protecting the privacy, dignity and rights of all individuals whose information we handle, including parents, guardians, students, tutors and prospective tutors.

This Policy sits alongside our Privacy Policy, Cookie Policy and Terms & Conditions. Whereas the Privacy Policy focuses on how we collect and use personal data, this Policy sets out the overarching data protection framework that guides our decisions, processes and internal governance.

1. Data Protection Principles

We strive to process personal data in accordance with widely recognised data protection principles, which include:

• Lawfulness, fairness and transparency: We process personal data on appropriate legal bases and in ways that are fair and transparent to the individuals concerned.
• Purpose limitation: We collect data for specific, explicit and legitimate purposes and do not process it in ways that are incompatible with those purposes.
• Data minimisation: We only collect data that is relevant and limited to what is necessary in relation to the purposes for which it is processed.
• Accuracy: We take reasonable steps to keep personal data accurate and up to date and encourage individuals to inform us of any changes.
• Storage limitation: We retain personal data only for as long as necessary for the purposes for which it was collected or as required by law.
• Integrity and confidentiality: We use appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage.

2. Roles and Responsibilities

Slate acts as a data controller in relation to the personal data it collects and uses to operate the Platform. This means that we determine the purposes and means of processing that data. Certain third-party service providers may act as data processors on our behalf, processing data in accordance with our instructions and subject to contractual safeguards.

All employees, contractors and partners who handle personal data for Slate are required to respect confidentiality obligations and to follow this Policy and related internal procedures. We provide appropriate guidance and training so that they understand their responsibilities and the importance of data protection.

3. Data Collection and Categories

As described in our Privacy Policy, we may collect identification and contact details, profile information, tutor vetting information, usage and technical data, and communication records. We seek to avoid collecting sensitive personal data unless it is strictly necessary and appropriate safeguards are in place.

4. Legal Bases and Documentation

Before commencing any new processing activity, we consider the legal basis for that processing, such as consent, contractual necessity, legal obligation or legitimate interests. We may document our reasoning in internal records, which help us demonstrate compliance with applicable law and this Policy.

5. Access Control and Security Measures

Access to personal data within Slate is limited to individuals who need that information to perform their duties. We implement logical access controls, such as role-based permissions, authentication and logging, as well as physical security measures, where relevant, to prevent unauthorised access.

We also use a combination of technical measures — including secure hosting environments, encryption in transit where appropriate, and multistep review of changes to core systems — to enhance the resilience and confidentiality of the Platform. We regularly review these controls and update them in line with evolving best practices.

6. Data Sharing and Processors

When we engage third-party service providers to process personal data on our behalf, we carefully select partners who can demonstrate a robust approach to security and data protection. We put in place contracts that require these providers to act only on our instructions, to implement appropriate safeguards, and to assist us in meeting our own obligations where needed.

Where personal data is shared with other controllers — for example where a tutor and a family directly exchange information in the course of arranging lessons — we make reasonable efforts to ensure that each party understands their respective responsibilities.

7. International Data Transfers

Some personal data may be stored or processed outside Nigeria, particularly where our cloud infrastructure or service providers are located in other jurisdictions. In such cases, we seek to ensure that appropriate safeguards are in place, such as contractual protections and assessments of the provider's data protection standards, with a view to maintaining an adequate level of protection.

8. Data Subject Rights

We recognise that individuals whose personal data we process have important rights, which may include access, rectification, erasure, restriction, objection and portability, as outlined in our Privacy Policy. We maintain procedures for receiving, verifying and responding to such requests in a timely and respectful manner, while balancing them against our own legal obligations and the rights of others.

9. Data Breaches and Incident Response

Despite our efforts to maintain strong security, incidents may occur. We maintain an internal incident response approach designed to ensure that potential breaches are identified, contained, investigated and, where required, notified to affected individuals and/or competent authorities in a timely way.

If we become aware of an incident that materially affects your personal data, we will take reasonable steps to inform you of the nature of the breach, the data affected (where known), the likely consequences and the measures we have taken or propose to take to address it.

10. Training and Awareness

We recognise that effective data protection is not only a matter of technology but also of culture. We promote awareness of privacy and data protection principles within Slate through onboarding materials, guidance and, where appropriate, targeted training. Our aim is to ensure that everyone who handles personal data understands the importance of doing so carefully and respectfully.

11. Policy Review and Governance

We periodically review this Data Protection Policy to ensure that it remains aligned with legal requirements, best practices and the evolution of our services. Material updates will be communicated through the Platform or by other reasonable means. The "Last updated" date at the top of this page reflects the most recent revision.

12. Contact Us

Questions or concerns about this Data Protection Policy or our data practices can be directed to:

Email: contact@myslate.app
Location: Abuja, Nigeria