Elite Skillhub ("we") runs the learning platform at everchristy.org. This notice explains what personal data we collect, why, how long we keep it, who else receives it, and the rights you have. It applies to visitors, learners and instructors.
1. Who is responsible
The data controller is Elite Skillhub. Contact us about anything in this notice at info@everchristy.org or +234 803 462 8203.
We process personal data under the Nigeria Data Protection Act 2023 and, for people in the European Union or the United Kingdom, the General Data Protection Regulation (GDPR / UK GDPR).
2. What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Account: name, username, e-mail, password (stored only as a one-way hash), phone, date of birth, gender, country, state, LGA, city, address, photo and biography you add | Creating and running your account, identifying you on certificates, contacting you about your courses | Contract with you |
| Learning profile: education level, goals, languages, occupation, learning preferences, accessibility needs you choose to tell us | Suggesting courses and adapting your learning | Contract; for accessibility needs, your consent (you can remove them in Settings) |
| Learning records: enrolments, lesson progress, quiz answers and scores, assignments and files you submit, attendance, grades, certificates | Teaching, assessing and certifying your work | Contract |
| Payments: amounts, course, method, payment reference, invoices, receipts you upload, refunds | Taking payment, issuing invoices, accounting | Contract; legal obligation (tax and accounting records) |
| Messages, forum posts, reviews, notes, contact-form messages | Features you choose to use; answering your questions | Contract; legitimate interest in answering enquiries |
| Security records: IP address, browser, login attempts, account activity, e-mails sent to you | Protecting accounts, preventing fraud and abuse, fixing faults | Legitimate interest in a secure service |
| Visitor statistics: pages viewed, clicks, time on page, browser and device, approximate location derived from the IP address | Understanding how the site is used so we can improve it | Your consent (see section 3) |
If you sign in with Google, Facebook or GitHub, we receive your name, e-mail address and profile picture from that service. We do not make decisions about you by automated means alone.
3. Cookies and visitor statistics
Some cookies are needed for the site to work and are always set: your login session (which also protects your account
and forms), your basket, and ec_consent, which remembers your choice below for 180 days.
Only if you press Accept analytics do we also:
- record page visits, clicks and time on page in our own statistics, using two cookies
(
analytics_visitor_id, one year;analytics_session_id, the visit). The approximate location of your IP address is looked up from ipinfo.io; - load Google Tag Manager, which can set Google Analytics cookies (names beginning
_ga).
Visitor statistics are not linked to your account. You can change your choice at any time: . Choosing Essential only stops the statistics and removes their cookies.
4. Who receives your data
We do not sell personal data. We share it only with services that help us run the platform, each for its own purpose:
- our web hosting provider, which stores the site, the database and backups;
- payment providers (Paystack, PayPal) when you pay online. They receive what they need to take the payment; we never receive your full card number;
- our e-mail service, to deliver account and course e-mails;
- Google, Facebook or GitHub, only if you choose to sign in with them;
- ipinfo.io and Google, only for visitor statistics you have accepted;
- your instructors and course administrators, who see your progress, submissions and grades for their courses;
- anyone you give a certificate number to, who can confirm it is genuine on the verification page;
- authorities, where the law requires it.
Some of these providers process data outside Nigeria (for example in the European Union or the United States). Where that happens we rely on the safeguards the law requires, such as the provider's data protection terms.
5. How long we keep it
| Data | Kept for |
|---|---|
| Account, learning profile and learning records | While your account is open; see "Erasure" below |
| Payments, invoices, receipts and refunds | As long as tax and accounting law requires, also after your account is erased |
| Visitor statistics (page visits, clicks, IP locations) | 90 days |
| Account activity, login attempts, password resets | 90 days |
| IP address and browser in course activity and certificate checks | 90 days (then removed, the count stays) |
| Record of e-mails sent to you | 1 year |
| Contact-form messages and support requests | 2 years (support requests: after the last message) |
| Server error logs (e-mail addresses masked) | 30 days |
| Database backups | 30 days |
These periods are applied automatically every day.
6. Your rights
- Access and a copy of your data. Logged-in learners can download everything we store about their account from Settings > Your data (a JSON file). Others can ask us at info@everchristy.org.
- Correction. Edit your details in your profile and settings, or ask us.
- Erasure. Settings > Delete account closes your account at once and erases your personal data 14 days later; the delay lets us undo a mistaken or unauthorised deletion if you contact us. Erasure removes your name, contact details, address, date of birth, photo, profile, notes, reviews, notifications and logs. We keep payment records, which the law requires, and your learning records and certificates in anonymised form; messages and forum posts you wrote stay, shown as "Deleted user".
- Withdraw consent to visitor statistics at any time with Cookie settings.
- Object or restrict processing based on legitimate interest, and data portability (the download above is in a machine-readable format).
We answer requests within one month. We may need to confirm your identity first.
7. Security
The site uses HTTPS, passwords are stored only as one-way hashes, access to records is limited by role, and backups are encrypted. No system is completely secure; if a breach puts your rights at risk we will tell you and the regulator as the law requires.
8. Learners under 18
Learners under 18 need the consent of a parent or guardian. When someone under 18 signs up, we ask for a parent's or guardian's e-mail address and send them a link to agree or decline; the account is activated only after they agree. If they decline, or nobody answers within 30 days, the new account and its data are deleted (an existing account is paused instead). We keep the guardian's name, contact details and answer as the record of consent while the account exists. If you believe a child has given us personal data without that consent, contact us and we will remove it.
9. Changes and complaints
We will update this notice when our practices change and show the date at the top. If you are unhappy with how we handle your data, contact us first at info@everchristy.org. You can also complain to the Nigeria Data Protection Commission (ndpc.gov.ng) or, in the EU or UK, to your local data protection authority.