AcroTechnical EduConsult processes personal data for Nigerian tertiary institutions running career services on our platform. This notice explains what we collect, why we collect it, how long we keep it, and the rights you have under the Nigeria Data Protection Regulation (NDPR) and the Nigeria Data Protection Act 2023.

AcroTechnical acts as a data processor on behalf of your institution (the controller) for student records, counsellor case files, and assessment data. We act as data controller only for our marketing site, our employer partner accounts, and our own staff records.

From students

Name, matric number, faculty, department, level, GPA band, graduation year, institutional email, phone, assessment responses and scores, pathway milestone progress, counselling session notes (on behalf of your institution), SIWES and NYSC placement records.

From counsellors and staff

Name, institutional email, role, caseload, session notes authored, audit-trail events. We capture this to run the counselling workbench and to prove accountability to your institution.

From employers

Company name, role postings, shortlist decisions, named recruiter contact details. Candidate data an employer sees is limited to the profile the student chooses to include in an application.

Processing purposes are determined by your institution, under a Data Processing Agreement. They include:

• Delivering assessments and generating pathway recommendations.
• Running counsellor case queues and session management.
• Matching students to verified employer opportunities.
• Producing faculty rollups and regulator-aligned outcome reporting.
• Grounding the AI assistant strictly on your institution's content — never open-web training or third-party retraining.

AcroTechnical is registered with the Nigeria Data Protection Commission (NDPC) and operates under NDPR and the Nigeria Data Protection Act 2023. We maintain lawful-basis registers per institution. Legitimate interest and contractual necessity are the primary bases for student-facing processing; consent is used where required (for example, for optional psychometric diagnostics and alumni follow-up).

Our Data Protection Officer reviews every product change that affects student records. A current record of processing activities (ROPA) is available to DPOs at our institutional partners on request.

Default retention windows, which institutions may adjust by agreement:

• Active student records — through graduation + NYSC year.
• Assessment responses — 7 years (for validity studies and research).
• Counselling notes — retained per institution policy, minimum 3 years.
• Audit logs — 7 years; write-once, append-only storage.
• AI conversation transcripts — 24 months unless converted to a case file.

Under NDPR and the NDPA 2023, data subjects have the right to:

• Access a copy of their personal data.
• Rectify inaccurate records.
• Object to processing on legitimate-interest grounds.
• Withdraw consent where consent is the basis.
• Lodge a complaint with the NDPC.

Student requests go first to your institution's DPO. For platform-level requests, contact our DPO below.

Student records remain in Nigerian data-residency regions (Lagos and Abuja data centres). A limited set of operational vendors process metadata outside Nigeria — identity provider events, email transactional logs, error-telemetry. These transfers sit under Standard Contractual Clauses equivalent and are minimised to non-sensitive fields. We do not use student data to train third-party foundation models.

For NDPR enquiries, access requests, or complaints, email our Data Protection Officer: