1. Who We Are
This website, www.bpurplehq.org, is operated by Bpurple Technology, a technology and training company headquartered in Nigeria (“Bpurple”, “we”, “us”, or “our”). We offer technology solutions, corporate training through our Academy, and STACK NextGen, a digital and data literacy programme.
For the personal data described in this policy, we act as the data controller under the Nigeria Data Protection Act 2023 (“NDPA”) and applicable regulations and directives issued by the Nigeria Data Protection Commission (“NDPC”), including the General Application and Implementation Directive (“GAID”).
Privacy contact: Data Protection Officer, privacy@bpurplehq.org.
2. Who This Policy Covers
This policy applies to visitors to our website, people who contact us, and people who sign up for STACK NextGen.
3. What Personal Data We Collect
Information you give us
- Sign-up and enquiry forms, including the STACK NextGen “Join the cohort” form: full name, phone number, and email address.
- Messages you send through our contact form, email, or WhatsApp.
- Programme participation records, including attendance, completion status, assessment results, and certificate records.
Information collected automatically
When you visit our website, our systems and service providers may collect technical data such as your IP address, browser and device type, pages visited, and time spent. See Section 9 for information about cookies.
4. Why We Use Your Data and Our Lawful Basis
| Purpose | Data used | Lawful basis |
|---|---|---|
| Registering you for STACK NextGen or other training, confirming your place, and communicating programme details. | Name, phone, email | Consent |
| Delivering the programme, tracking completion, and issuing certificates. | Name, contact details, participation records | Performance of the programme you signed up for; legitimate interests in running it properly. |
| Responding to enquiries and requests. | Name, contact details, message content | Legitimate interests in answering you; consent where applicable. |
| Sending news, programme updates, or offers about our services. | Name, email, phone | Consent, which you can withdraw at any time. We do not send marketing to learners under 18. |
| Keeping the website secure and understanding how it is used. | Technical data | Legitimate interests; consent for non-essential cookies. |
| Meeting legal and regulatory obligations, and handling complaints or disputes. | Any relevant data | Legal obligation; legitimate interests. |
We will not use your personal data for a new purpose that is incompatible with the purpose we told you about without first informing you and, where required, obtaining your consent.
We will only publish learner names, photos, or work—for example, to recognise top performers or feature showcase events—where we have an appropriate lawful basis and, where required, your consent.
6. Transfers Outside Nigeria
Some of our service providers may store or process data outside Nigeria. Where that happens, we take steps to ensure your data receives a level of protection that is adequate under the NDPA, using measures such as contractual safeguards. We transfer only the data needed.
7. How Long We Keep Your Data
We keep personal data only as long as needed for the purposes described above:
- Sign-up and programme records: for the duration of the programme and up to 6 months afterwards.
- Marketing preferences: until you withdraw consent, plus a minimal record that you opted out so we can respect your choice.
When the retention period ends, we securely delete or anonymise the data unless the law requires us to keep it longer.
8. Your Rights
Under the NDPA, you have the right to:
- Be informed about how your data is used.
- Access your personal data and obtain a copy.
- Have inaccurate or incomplete data corrected.
- Have your data deleted where there is no good reason for us to keep it.
- Restrict or object to our processing, including for direct marketing.
- Receive your data in a structured, commonly used, machine-readable format (data portability).
- Withdraw consent at any time, as easily as it was given.
- Not be subject to a decision based solely on automated processing that significantly affects you.
- Lodge a complaint with the Nigeria Data Protection Commission.
To exercise any of these rights, contact us using the details in Section 1. We may need to verify your identity first, and will respond within 30 days. We do not charge a fee unless a request is clearly unfounded or excessive.
We would appreciate the chance to resolve any concern before you approach the NDPC, but you are free to contact them at any time.
10. How We Protect Your Data
We apply appropriate technical and organisational measures, including encrypted connections (HTTPS), need-to-know access controls, secure hosting, staff confidentiality and data protection training, and agreements with service providers. No system is completely secure, but we work to reduce risk and review our controls regularly.
If a personal data breach is likely to put your rights and freedoms at risk, we will notify the NDPC within 72 hours of becoming aware of it and inform affected individuals directly where the risk is high.
11. Links to Other Websites
Our website may link to third-party sites, such as social media and WhatsApp. We are not responsible for their privacy practices, so we encourage you to read their policies.
12. Changes to This Policy
We may update this policy from time to time to reflect changes in our services or the law. The “Last updated” date at the top shows the latest version.
13. Contact Us
If you have questions about this policy or how we handle personal data, contact our Data Protection Officer at privacy@bpurplehq.org.