Sera ya Faragha

• 1. Who We Are
• 2. Information We Collect
• 3. How We Collect Your Information
• 4. How We Use Your Information
• 5. Legal Basis for Processing
• 6. Children's Privacy
• 7. Who We Share Your Information With
• 8. International Data Transfers
• 9. How Long We Keep Your Information
• 10. Your Data Protection Rights
• 11. Cookies
• 12. Security of Your Information
• 13. Changes to This Privacy Policy
• 14. How to Contact Us

This privacy policy is issued by Eagle Beacon Global ("Company", "we", "us", or "our"), the data controller responsible for your personal data. We are registered in Nigeria at Lagos Island, Lagos State. We operate the website at https://www.supergb.com/cbt/ and the mobile application Green Bridge CBT (collectively, the "Services").

For data protection enquiries, you may contact our Data Protection Officer (Lola) at: feedback@eagle-beacon.com

We collect the following categories of personal data:

• Identity data: first name, last name, date of birth.
• Contact data: email address, phone number, country.
• Account data: username (email), encrypted password, user role, preferred language, account status.
• Device data: device identifiers, browser fingerprint, operating system, and app version.
• Location data: approximate country derived from your IP address using an offline lookup on our own servers. We do not collect GPS or precise location data.
• Usage data: login timestamps, feature usage, learning activity, and assessment results.
• Education data: qualification and exam-board preferences, exam scores, study plans, timetables, assessment submissions, and grading records.
• Payment data: payment references, transaction amounts, subscription status. We do not store full card numbers; payment processing is handled by third-party providers (Paystack, Stripe, Google Play Billing).
• Content data: product reviews, feedback, and any content you submit through the Services.
• Scholarship data: if you apply for a scholarship, we may collect additional information including gender, address, school enrolment, and financial information relevant to your application.
• School data: if you use the school administration features, we may process class rosters, student enrolment, and school-related records.

We collect information in the following ways:

• Directly from you: when you create an account, complete your profile, submit assessments, apply for scholarships, or contact us.
• Automatically: when you use our Services, we collect device information, usage data, and session information through cookies and similar technologies.
• From third parties: payment confirmation from payment processors, and app usage data from app store platforms.

We use your personal data for the following purposes:

• To create and manage your account and provide the Services you have requested.
• To deliver educational content, process assessments, track learning progress, and generate performance reports.
• To provide AI-assisted study tools, automated grading, and content generation features.
• To send you service-related communications, including account verification, password resets, and important updates about the Services.
• To process payments and manage subscriptions.
• To support school administration features, including class management, student progress tracking, and report generation.
• To evaluate scholarship applications and communicate with applicants.
• To maintain the security and integrity of our Services, detect fraud, and enforce our terms.
• To analyse usage patterns and improve our Services.
• To comply with legal obligations and respond to lawful requests from authorities.

We process your personal data on the following legal grounds:

• Performance of a contract: processing necessary to provide the Services you have signed up for, including account creation, educational features, and payment processing.
• Consent: where you have given explicit consent, such as for marketing communications or the processing of scholarship application data. You may withdraw consent at any time by contacting us.
• Legitimate interests: processing necessary for our legitimate interests, such as improving the Services, ensuring security, and preventing fraud, provided these interests do not override your rights.
• Legal obligation: processing necessary to comply with applicable laws, such as tax record-keeping and responding to regulatory requests.

Our Services may be used by children, subject to the age requirements and parental consent rules described in our Terms and Conditions. In Nigeria, users aged 14 to 17 may register with parental or guardian consent. In the European Economic Area and the United Kingdom, minimum age thresholds range from 13 to 16 depending on the country. We collect date of birth at registration to verify age eligibility and do not knowingly collect data from children below the applicable minimum age without appropriate consent.

If you are a parent or guardian and believe your child has provided personal data without your consent, please contact us at feedback@eagle-beacon.com and we will take steps to delete that information.

We may share your personal data with the following categories of recipients:

• Payment processors: Paystack (Nigeria), Stripe (international), and Google Play Billing, to process your payments securely.
• Cloud storage: Scaleway (France, EU) for file and report storage.
• Email service providers: to deliver transactional and service-related emails.
• AI service providers: OpenAI and Microsoft Azure OpenAI, to provide AI-assisted study and grading features. We take steps to minimise personal data in AI prompts.
• Google reCAPTCHA: to protect against automated abuse during registration.
• Schools: if you are enrolled in a school that uses our school administration features, your academic data may be shared with authorised school administrators.

We do not sell your personal data to third parties. We require all service providers to process your data only on our instructions and in accordance with applicable data protection laws.

Our Services are operated from Nigeria. Your personal data may be transferred to and processed in:

• Nigeria: where our primary operations are based.
• European Union (France): where our cloud storage provider (Scaleway) operates.
• United States: where some of our AI and payment service providers operate.

Where we transfer personal data outside the European Economic Area or the United Kingdom, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, or rely on adequacy decisions where available.

We retain your personal data for up to 20 years from your last account activity, or as required by law. Educational records are retained for this period because students may need their exam history for university applications, career references, or personal records long after leaving the platform. Financial transaction records are retained for 7 years as required by tax and accounting regulations.

When your account is deleted, we erase or anonymise your personal data. School assessment results are anonymised (not deleted) to preserve the school's academic records. Financial records are retained with PII stripped for the statutory period. Authentication tokens expire automatically after a short period.

Depending on your location, you may have the following rights under applicable data protection laws (including the GDPR, UK GDPR, and NDPA):

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of inaccurate or incomplete data. You can update most profile information directly in your account settings. For corrections to your email address or other data, contact our Data Protection Officer at feedback@eagle-beacon.com.
• Right to erasure: request deletion of your personal data, subject to legal retention requirements.
• Right to restriction: request that we restrict processing of your data in certain circumstances.
• Right to data portability: receive your data in a structured, commonly used, machine-readable format.
• Right to object: object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.

To exercise your rights, please contact us at feedback@eagle-beacon.com. We will respond within the time frames required by applicable law (generally within one month under GDPR). We may need to verify your identity before processing your request.

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority. In Nigeria, this is the Nigeria Data Protection Commission (NDPC). In the EU/UK, this is your national supervisory authority.

We use cookies and similar technologies to operate our Services. For detailed information about the cookies we use and how you can control them, please see our Cookie Policy: https://supergb.com/cbt/users/legal/cookie-policy.

We implement appropriate technical and organisational measures to protect your personal data, including encryption of data in transit (TLS/SSL), secure password storage (BCrypt hashing), access controls, and regular security reviews. However, no method of transmission over the Internet is completely secure, and we cannot guarantee absolute security.

We may update this privacy policy from time to time. We will notify you of material changes by updating the "Last updated" date at the top of this policy. We encourage you to review this policy periodically. Your continued use of the Services after changes are posted constitutes your acceptance of the updated policy.

If you have questions about this privacy policy or wish to exercise your data protection rights, please contact us at:

Eagle Beacon Global
Kisiwa cha Lagos
Lagos
Nigeria
admin@eagle-beacon.com

For data protection enquiries, contact our Data Protection Officer (Lola) at feedback@eagle-beacon.com.