Privacy Policy

Kapaciti Learning Platform ("Kapaciti", "we", "us", or "our") is a learning management and live-training platform operated by Kapaciti Ltd., a company registered in Nigeria. We operate the website at www.kapaciti.com and its subdomains.

Kapaciti is a Data Controller as defined under the Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act 2023 (NDPA), supervised by the Nigeria Data Protection Commission (NDPC).

Contact: privacy@kapaciti.com · Kapaciti Ltd., Lagos, Nigeria.

We collect personal data only where it is necessary to provide and improve our services. The categories of data we collect include:

2.1 Information You Provide Directly

• Account Registration: First name, last name, email address, phone number, country of residence, and password. Your password is stored only as a salted cryptographic hash.
• Profile Information: Profile photo and any other details you choose to add to your profile.
• Organisation Information: If you create or join an organisation workspace, we process the name, description, and settings of that workspace and your role within it.
• Learning & Assessment Data: Course enrolments, lesson progress, exam submissions, assessment scores, and certificates issued.
• Wallet & Transaction Data: Token purchases, payment references, token balances, and transaction history for the purpose of maintaining your token wallet.
• Live Session Content: Chat messages, reactions, raised-hand signals, poll responses, and questions you submit during live sessions, together with session attendance records.
• Contact & Support: Name, email address, subject, and message content submitted via our contact form or support channels.

2.2 Information Collected Automatically

• Technical Data: IP address, browser type and version, operating system, and device identifiers.
• Usage Data: Pages visited, features used, and interactions with the platform, used to operate and secure the service.
• Cookies & Local Storage: As described in Section 7 below.

2.3 Information From Third Parties

• Google OAuth: If you register or sign in with Google, we receive your name and email address from Google, and we only complete sign-in when Google confirms your email address is verified.
• Payment Processor: When you purchase tokens, our payment processor, Paystack, collects the payment details required to process the transaction. We do not store your card details.

We do not use third-party advertising trackers or social media pixels on the platform.

We use the personal data we collect for the following purposes:

• Account Management: Creating, maintaining, and authenticating your account, including sign-in via password, passkeys, or Google.
• Service Delivery: Providing access to courses, exams, resources, certificates, token wallet, and live sessions; tracking learning progress.
• Payment Processing: Processing token purchases through Paystack and recording transaction history in your wallet.
• Communication: Sending transactional emails, such as purchase confirmations, certificate emails, and account notifications. We do not send marketing communications without your consent.
• Platform Security & Fraud Prevention: Detecting and preventing abuse, fraudulent transactions, and security incidents.
• Legal Compliance: Meeting our obligations under Nigerian law and responding to lawful requests from authorities.

In accordance with Section 25 of the NDPA 2023 and the principles of the NDPR 2019, we process your personal data only where we have a lawful basis to do so. The lawful bases we rely on are:

• Consent: Where you have given specific, informed, and freely given consent — for example, where you choose to provide information beyond what is required.
• Performance of a Contract: Processing necessary to perform our agreement with you — for example, creating your account, delivering courses, issuing certificates, and processing token transactions.
• Legal Obligation: Where processing is necessary to comply with applicable Nigerian law, including tax, financial, and regulatory obligations.
• Legitimate Interests: Where processing is necessary for our legitimate interests and does not override your rights and freedoms — for example, platform security, fraud prevention, and service improvement.
• Vital Interests: In rare circumstances where processing is necessary to protect your vital interests or those of another person.

Kapaciti offers live, real-time training sessions between hosts and participants. This section explains how session data is handled.

• No Recording by Default: Live sessions use real-time peer-to-peer audio and video (WebRTC). Kapaciti does not record session audio or video, and does not store session media.
• Session Activity: Chat messages, reactions, poll responses, and questions submitted during a session are stored so that the host can review session engagement. These are visible to the host and, where applicable, other participants of the same session.
• Attendance: We record which users joined a session and when, to support attendance tracking and certification.
• Shared Files: Files shared by a host during a session are stored on our servers and made available to session participants through a restricted link.
• Your Conduct: Please do not record, screenshot, or redistribute a live session or its content without the express permission of the host. Unauthorised recording may violate these terms and applicable law.

We do not sell, rent, or trade your personal data to any third party. We may share your data in the following limited circumstances:

• Service Providers (Data Processors): Trusted companies that process data on our behalf, including our cloud hosting provider, our payment processor Paystack, and our email delivery service. These providers are bound by data processing agreements and may only process your data to provide services to us.
• Organisation Administrators: If you use Kapaciti through an organisation workspace, administrators of that organisation may see your learning activity and participation within their workspace, to the extent required for the organisation to administer your training.
• Legal Authorities: Where required by Nigerian law or a valid court order, or where necessary to protect the rights, property, or safety of Kapaciti, its users, or the public.
• Business Transfers: In the event of a merger, acquisition, or sale of substantially all of our assets, your data may be transferred. We will provide notice before your data is transferred and becomes subject to a materially different privacy policy.
• With Your Consent: Where you have given explicit consent for a specific sharing arrangement.

We use a small number of cookies and browser storage mechanisms to operate the platform securely:

• Authentication Cookie: A strictly necessary cookie that keeps you signed in. It cannot be disabled without signing you out.
• Security Cookies: Cookies used for cross-site request forgery (CSRF) protection and related security controls.
• Local Storage: Small amounts of data stored in your browser to remember UI preferences and session state.

We do not use third-party advertising cookies or cross-site tracking cookies. Because we only use strictly necessary cookies, no cookie-consent banner is required under the NDPR/NDPA. You can clear or block cookies through your browser settings; note that blocking the authentication cookie will sign you out.

We implement technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction:

• Encryption in Transit: All data transmitted to and from the platform is encrypted using TLS 1.2 or higher.
• Password Protection: Passwords are stored as salted cryptographic hashes using ASP.NET Core Identity. We support passkeys (WebAuthn) for passwordless sign-in.
• Access Controls: Access to personal data is restricted on a need-to-know basis. Organisation workspaces use role-based permissions.
• Payment Security: Card payments are handled entirely by our payment processor, Paystack, which is PCI DSS compliant. Your card details never touch our servers.
• Incident Response: We maintain a data breach response procedure. In the event of a personal data breach likely to result in harm to you, we will notify the NDPC and you as required by the NDPA 2023.

Despite our best efforts, no system is completely secure. We cannot guarantee absolute security of data transmitted over the internet.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, or reporting requirements:

• Account Data: Retained for the duration of your account and for a reasonable period after account deletion to comply with legal and regulatory obligations.
• Transaction & Financial Records: Retained in line with Nigerian financial and tax record-keeping requirements.
• Certificate Records: Retained to allow certificate verification. Certificates carry a unique verification code.
• Live Session Activity: Session chat, poll responses, and attendance records are retained while the session workspace is active and for a reasonable period afterwards, after which they are deleted or anonymised.
• Server & Security Logs: Retained for a limited period for security monitoring and fraud prevention.

When data is no longer needed, it is securely deleted or anonymised in accordance with our retention schedule.

Under the NDPA 2023 and NDPR 2019, you have the following rights with respect to your personal data:

• Right of Access: The right to request a copy of the personal data we hold about you, the purposes of processing, and the categories of data involved.
• Right to Rectification: The right to request correction of inaccurate or incomplete personal data.
• Right to Erasure: The right to request deletion of your personal data where it is no longer necessary for the purpose it was collected, where you withdraw consent, or where processing is unlawful. We may need to retain some data for legal compliance.
• Right to Restrict Processing: The right to request that we restrict processing of your data in certain circumstances, such as while we verify the accuracy of data you dispute.
• Right to Data Portability: The right to request a structured, machine-readable copy of your personal data where technically feasible.
• Right to Object: The right to object to processing based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
• Right to Lodge a Complaint: The right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your rights have been violated.

To exercise any of these rights, contact our privacy team at privacy@kapaciti.com. We will respond within 30 days and may need to verify your identity before processing your request.

The Kapaciti platform is intended for individuals aged 13 years and above. We do not knowingly collect personal data from children under the age of 13 without verifiable parental or guardian consent.

For users aged 13 to 17, we recommend that a parent or guardian review this privacy policy. Where institutional access is provided to learners under 18, the contracting organisation assumes responsibility for obtaining appropriate consent from parents or guardians.

If you believe we have inadvertently collected personal data from a child under 13 without appropriate consent, please contact our privacy team immediately at privacy@kapaciti.com and we will take prompt action to delete such data.

Kapaciti is headquartered in Nigeria. Some of our service providers and data processors, including our cloud hosting provider and payment processor, may be located outside Nigeria. Where we transfer personal data outside Nigeria, we ensure appropriate safeguards are in place in accordance with the NDPR and NDPA, including:

• Transferring data only to jurisdictions that provide an adequate level of protection.
• Using Standard Contractual Clauses (SCCs) or equivalent contractual safeguards with processors in jurisdictions without adequate protection.

By using our platform, you acknowledge that your data may be processed in jurisdictions outside Nigeria, subject to the safeguards described above.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform features. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page.
• Send a notification email to registered users where required.
• Display a prominent notice on the platform announcing the updated policy.

Where changes require fresh consent, we will obtain this from you before the changes take effect. We encourage you to review this policy periodically. Your continued use of the platform after any changes constitutes acceptance of the updated policy.