Privacy Policy

1. Who we are

DigMusEd (Digital Music Education) ("DigMusEd", "we", "us") operates https://www.digmused.com and the associated examination, remote proctoring, orchestra and concert services. For the purposes of the Nigeria Data Protection Act 2023 ("NDPA") and its implementing regulations and directives issued by the Nigeria Data Protection Commission ("NDPC"), we are the data controller of the personal data described in this policy.

Data protection enquiries: dpo@digmused.com. General enquiries: info@digmused.com.

2. Personal data we collect

• Identity and contact data — full name, date of birth, gender, nationality, email address, telephone/WhatsApp number, address, and, for candidates under 18, the details of a parent or guardian.
• Registration and academic data — instrument or voice, grade, teacher, school or centre, exam entries, unique exam number, marks, examiner comments, results and certificates.
• Payment data — transaction reference, amount, status and channel as returned by our payment processor (Paystack). We do not receive or store your full card number, CVV or bank credentials.
• Examination submission data — audio and video recordings of performances, order numbers, uploaded documents and written answers.
• Proctoring data (sensitive personal data) — a reference photograph, live webcam captures, facial-comparison results, environment-scan images, short background-audio clips, tab/fullscreen-exit events, device and browser signals and integrity flags.
• Technical data — IP address, device, browser and operating system, and the cookies or similar identifiers described in section 13. Blog article views are counted without storing personal data.
• Communications — emails, contact-form messages, newsletter sign-ups and marketing preferences.

3. Lawful bases for processing

We process personal data only where one of the lawful bases in the NDPA applies:

• Contract — to register you, deliver examinations, mark submissions, issue results and certificates and process payments.
• Consent — for the capture and analysis of biometric proctoring data, for newsletters and marketing, and for any promotional use of your name, image or recordings. Consent is given by a clear, separate action, is never a condition of an unrelated service, and may be withdrawn at any time as easily as it was given. Withdrawal does not affect processing already carried out; withdrawing consent to proctoring means a remotely proctored exam cannot proceed.
• Legal obligation — for tax, accounting, regulatory and law-enforcement requirements.
• Legitimate interests — for platform security, fraud and malpractice prevention, audit logging of staff actions and the defence of legal claims, balanced against your rights and freedoms.
• Vital interests or public interest — only in the limited circumstances recognised by the NDPA.

4. Biometric and proctoring data

Remote proctoring involves sensitive personal data. With your explicit consent, given before the exam starts, we take a reference photograph, compare live webcam frames against it, scan your environment for prohibited items and detect unusual noise. Flagged moments are stored with an image and, where noise is detected, a short audio clip.

Image and audio frames selected for analysis are sent to third-party AI providers (section 6) solely to produce integrity signals for your exam, and for no other purpose of ours.

Automated flags never determine an outcome on their own. Every flagged session is reviewed by a human member of the exam board before any sanction, and you may challenge a decision under sections 8 and 9.

You may decline biometric proctoring. Where an alternative assessment route (such as video submission) is available we will offer it; otherwise a remotely proctored exam cannot proceed.

5. How we use your data

• To create and administer your account, entries and examination sessions.
• To verify identity, deter and detect malpractice, and protect the integrity of our qualifications.
• To mark submissions, moderate results, issue certificates and verify certificates on request.
• To take payment, provide receipts and manage refunds and disputes.
• To send service messages such as confirmations, invitations, reminders, results and security alerts.
• To send marketing and newsletters where you have opted in; every message includes an unsubscribe link and you may opt out at any time.
• To use your recordings, name or images for promotion only where you have given separate, optional consent (this is not required to sit an exam).
• To maintain security, back-ups, audit trails and statistical reporting, in aggregated or de-identified form wherever possible.

6. Disclosure and service providers

We do not sell personal data. We share it only with the following categories of recipients, and where they act on our behalf they are bound by written data-processing terms:

• Database, authentication and application hosting — Supabase (database hosted in Frankfurt, Germany) and Cloudflare (website delivery).
• File storage — Google Drive, used to store exam videos, proctoring session recordings and concert media.
• Payments — Paystack, to collect fees securely.
• Email delivery — our SMTP email service provider, for transactional and permitted marketing messages.
• AI analysis — Google (Gemini), OpenAI and the Lovable AI gateway, used to analyse proctoring frames and audio for integrity signals, and Google/OpenAI for drafting marketing content (which does not involve candidate data).
• Examiners, moderators, exam board members and accredited centres, strictly on a role-based need-to-know basis.
• Professional advisers, auditors, the NDPC, courts, regulators and law-enforcement bodies where required by law or to establish or defend legal claims.

7. Transfers outside Nigeria

Our providers process data outside Nigeria, including in Germany and the United States. We transfer personal data abroad only where permitted by the NDPA — where the destination is subject to an adequacy decision or the recipient is bound by contractual clauses, binding rules or other safeguards giving a level of protection essentially equivalent to Nigerian law — or with your consent for a specific transfer. Transfers are encrypted in transit. Details of the safeguards for a specific transfer are available on request.

8. Your rights

Subject to the conditions and exemptions in the NDPA, you have the right to:

• Be informed about how your data is used (this policy).
• Access a copy of the personal data we hold about you.
• Have inaccurate or incomplete data corrected.
• Request erasure or restriction where the data is no longer necessary or was processed unlawfully.
• Object to processing, including direct marketing and processing based on legitimate interests.
• Receive your data in a structured, commonly used, machine-readable format.
• Withdraw consent at any time where consent is the lawful basis.
• Not be subject to a decision based solely on automated processing that significantly affects you, and to obtain human review.
• Lodge a complaint with the Nigeria Data Protection Commission, or seek a remedy in the Nigerian courts.

9. Exercising your rights

Send your request to dpo@digmused.com with enough information for us to identify you. We respond within 30 days and will tell you if we need a lawful extension. Requests are free unless manifestly unfounded or excessive. We may need to verify your identity first. Examination scripts, marks and integrity records may be withheld or redacted where disclosure would compromise assessment security or the rights of others.

10. Retention

We keep personal data only as long as necessary for the purposes above, then delete or anonymise it. Our standard periods are:

• Account and contact data — while the account is active and up to 24 months after it is closed.
• Examination entries, marks, results and certificate records — kept for as long as needed to verify a qualification, since a certification body must be able to confirm results on request.
• Performance video and audio submissions — up to 24 months after results are released, unless a dispute is open.
• Proctoring images, audio clips and integrity flags — up to 12 months after the session, unless needed for an ongoing malpractice or legal matter.
• Payment and accounting records — at least 6 years, as required by Nigerian tax and company law.
• Marketing consents and suppression lists — until consent is withdrawn, and thereafter only as needed to honour the withdrawal.
• Records of when and how you accepted our terms or gave or withdrew a consent (date, document version and source) — kept as evidence for 6 years after they were last relied on, and held in an access-restricted, append-only log.

11. Security and breaches

We apply technical and organisational measures appropriate to the risk: TLS encryption in transit, role-based access control, private storage with time-limited signed links, row-level database security, audit logging of staff actions and least-privilege administration. No system is completely secure; you are responsible for keeping your password confidential and your device secure.

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the NDPC within 72 hours of becoming aware of it and, where the risk is high, inform affected individuals without undue delay.

12. Children

A person under 18 is a child for the purposes of this policy. Children may be registered and examined only with the verifiable consent of a parent or legal guardian (which may be given through an authorised school or teacher who confirms they hold that consent). We do not use a child's name, image or recordings for promotion without the separate written consent of a parent or guardian. If we learn that we hold a child's data without valid consent we will delete it promptly.

13. Cookies

We use strictly necessary cookies and local storage for sign-in, session security and the exam player. We do not currently use advertising or third-party analytics cookies. If we introduce any non-essential cookies we will ask for your consent first. Blocking strictly necessary cookies will prevent the portal and examination tools from working.

14. Changes to this policy

We may update this policy to reflect changes in law or our services. The current version and its effective date are always shown on this page, and we will notify you of material changes by email or an on-site notice. Effective date: 29 September 2026.

15. Contact

Data Protection Officer, DigMusEd — dpo@digmused.com. General enquiries — info@digmused.com. You may also contact the Nigeria Data Protection Commission directly.