LEGACY by Gabriel

LEGACY by Gabriel (“LEGACY”, the “Platform”, “we”, “us”, or “our”) is committed to protecting the privacy and personal data of every User who interacts with our Platform. This Privacy Policy explains — in clear, transparent terms — what information we collect about you, why we collect it, how we use and protect it, with whom we may share it, how long we keep it, and the rights you have as a data subject.

This Policy applies to all services offered under LEGACY by Gabriel, including but not limited to CoreLibrary, ExamSphere, LEGACY Pay, LEGACY AI, E-Learning, Student Tools, Career Hub, DevLab, LEGACY Connect, Business Catalogue, LEGACY Voice, Aspirants Guide, Live Campus Maps, Campus Events, and the Spiritual Corner. It governs data collected through our website, mobile-optimised interfaces, email correspondence, and official communication channels.

This Policy is prepared in accordance with the Nigeria Data Protection Act (NDPA) 2023, the Nigeria Data Protection Regulation (NDPR) 2019, and reflects the principles of the European Union General Data Protection Regulation (GDPR) where applicable to international Users. It should be read together with our Terms and Conditions, which together form the complete legal framework governing your use of the Platform.

By creating an Account, accessing, or otherwise using the Platform, you acknowledge that you have read, understood, and consented to the collection and processing of your personal data as described in this Policy. If you do not agree with any part of this Policy, you should not use the Platform.

Data Controller: The entity responsible for determining the purposes and means of processing your personal data is LEGACY by Gabriel, operated by Gabriel Oluwademilade Adeniji.

Data Protection Officer (DPO): Gabriel Adeniji serves as the appointed Data Protection Officer for LEGACY by Gabriel. The DPO is responsible for overseeing our data protection strategy, ensuring compliance with the NDPA 2023 and the NDPR, handling data subject requests, and serving as the primary point of contact for the Nigeria Data Protection Commission (NDPC) and other regulatory bodies.

We collect information in three principal ways: (a) information you actively provide to us, (b) information we collect automatically as you use the Platform, and (c) information generated by your interactions with Platform features.

A. Information You Provide Directly

• Account Registration Data: Your full name, email address, phone number, matriculation number, faculty and department, and university or institution name.
• Profile Picture: A profile picture is collected only if you choose to upload one. This is entirely optional and can be removed at any time from your account settings.
• User-Submitted Content: Academic notes, past questions, comments, forum posts, business listings, community contributions, and any other material you upload to the Platform.
• Communications: Messages, support tickets, feedback, and any correspondence you direct to our team.
• Preferences: Study planner entries, notification settings, theme preferences (light/dark mode), and similar personalisation choices.

B. Information Collected Automatically

• Usage Data: Pages visited, features accessed, buttons clicked, time spent, session timestamps, and navigation paths within the Platform.
• Device & Browser Information: Device type, operating system, browser type and version, screen resolution, and language preferences.
• Approximate Location: General geographic location derived from your IP address (country/region level only).
• Cookies & Similar Identifiers: Session IDs, authentication tokens, and analytics identifiers (see Section 12).

C. Feature-Specific Data

• LEGACY Pay: Transaction history, LGC balance, top-up records, and any data provided during the payment process. Payments are processed primarily through Flutterwave (see Section 8).
• ExamSphere: Exam attempt logs, scores, time taken per question, and any automatically generated malpractice flags.
• CoreLibrary: Download history, reading progress, and the content of your Offline Library.
• LEGACY AI: User prompts and AI responses stored to enable conversation continuity (see Section 7).

Under the NDPA 2023 and NDPR, we only process your personal data when we have a valid lawful basis for doing so. The specific lawful basis depends on the nature of the processing:

• Consent: For optional features such as uploading a profile picture, subscribing to newsletters, enabling non-essential analytics cookies, and marketing communications.
• Performance of a Contract: For core service delivery — account creation and access, ExamSphere practice, CoreLibrary access, LEGACY Pay transactions, and any premium features you engage with.
• Legitimate Interests: For Platform security and fraud prevention, service improvement, bug diagnosis, aggregated analytics, and protecting the integrity of LEGACY by Gabriel — balanced against your rights and freedoms.
• Legal Obligation: For compliance with Nigerian law, response to regulatory requests, cooperation with law enforcement, and retention of financial records as required by FIRS and CBN.
• Vital Interests: In rare circumstances, to protect the vital interests of you or another person (e.g., emergency situations).

Your personal data is processed for the following clearly defined purposes:

• To Provide the Service: Creating and managing your Account, authenticating logins, displaying your profile, enabling downloads and uploads, running practice examinations, processing LEGACY Pay transactions, and delivering referral rewards.
• To Improve the Service: Diagnosing bugs, measuring feature performance, analysing usage patterns, and developing new modules that better serve our User community.
• To Communicate With You: Responding to your enquiries, sending transactional notifications (e.g., payment confirmations, exam results), issuing service updates, and — where you have opted in — sending marketing messages.
• To Maintain Security & Integrity: Detecting and preventing fraud, examination malpractice, LGC reselling, scraping, automated abuse, and violations of our Terms and Conditions.
• To Comply with the Law: Meeting statutory retention requirements, responding to lawful government requests, and exercising or defending legal claims.

The table below summarises the specific data handling practices for key modules within LEGACY by Gabriel:

ExamSphere Malpractice Records: For the purpose of enforcing academic integrity across the Platform, malpractice flags and associated exam logs are preserved while the User maintains an account on LEGACY by Gabriel. Malpractice data associated with banned accounts may be retained indefinitely for legal, security, and compliance purposes.

LEGACY AI is powered internally by The LEGACY Team. Unlike platforms that rely on external AI providers, LEGACY AI is developed, hosted, and maintained in-house, giving us full control over how your prompts and conversation history are stored and processed.

• Prompts and AI-generated responses are processed within LEGACY’s own systems and are never transmitted to third-party AI providers.
• LEGACY does not use your AI conversations to train public or third-party AI models. Any internal improvements are made using anonymised, aggregated data only.
• Your conversation history is retained solely to enable continuity of your sessions and to help you revisit past interactions.
• Sensitive personal data, confidential information, or exam answers should not be entered into LEGACY AI prompts.
• AI outputs may be inaccurate or incomplete. Always verify AI-generated content against authoritative sources before relying on it.

LEGACY by Gabriel processes payments primarily through Flutterwave, a licensed and regulated payment processor.

• Standard Payments: All standard payments on LEGACY Pay are handled securely through Flutterwave’s payment infrastructure. We do not store payment card details on our servers.
• Manual Payments (Certain Conditions): Under certain conditions — such as manual bank transfers or offline top-ups — payments may be processed outside the standard Flutterwave flow. These are treated as exceptions and are handled on a case-by-case basis.
• Data Responsibility: We are not responsible for the personal data that Flutterwave collects, processes, or stores during payment. Flutterwave’s data handling is governed by its own privacy policy and terms of service, which we recommend you review.
• Shared Data: LEGACY receives only the minimum transaction information required to confirm and credit your payment — such as transaction reference, amount, status, and, where applicable, the sender name on a manual transfer.
• We do not engage any other third-party payment processors for standard transactions at this time.

Because LEGACY by Gabriel serves a global student audience and works with Flutterwave for payment processing, certain personal data may be transferred to and processed in countries outside Nigeria.

Whenever your data is transferred cross-border, we apply NDPA-compliant safeguards, which may include:

• Standard Contractual Clauses (SCCs) or equivalent data transfer agreements with Flutterwave or any other regulated partner;
• Adequacy assessments to confirm the destination country offers an acceptable level of data protection;
• Reliance on partners with recognised certifications such as ISO 27001 or PCI-DSS compliance;
• Minimisation — we only transfer the personal data strictly required for the service in question.

In line with our Terms and Conditions and applicable Nigerian law, LEGACY by Gabriel retains all User data indefinitely for legal compliance purposes. This retention framework is designed to ensure we can meet statutory obligations under the Central Bank of Nigeria (CBN), the Federal Inland Revenue Service (FIRS), the NDPA 2023, and other regulatory bodies.

• Active accounts: Data remains stored while your Account is in use and accessible to you.
• Voluntarily deleted accounts: Core identity data, financial records, and malpractice flags are retained as required for legal compliance. Non-essential data (e.g., profile picture, preferences) is removed upon deletion.
• Terminated accounts (for Terms violations): Data is retained in full for legal, regulatory, financial, compliance, and security purposes.
• Backups: Automated backups may persist for up to 90 days in normal rotation, after which they are cyclically overwritten.

Once retention is no longer legally required, data is securely deleted or irreversibly anonymised.

Under the NDPA 2023, the NDPR, and where applicable the GDPR, you have significant rights over your personal data. LEGACY by Gabriel honours each of the following rights:

• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You may correct any inaccurate or incomplete personal data we hold.
• Right to Erasure (“Right to be Forgotten”): You may request deletion of your personal data, subject to our legal retention obligations outlined in Section 10.
• Right to Restrict Processing: You may request that we temporarily limit how we use your data while a dispute is being resolved.
• Right to Data Portability: You may request a copy of your data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to specific types of processing, including direct marketing.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time.
• Right to Lodge a Complaint: You may file a complaint with the Nigeria Data Protection Commission (NDPC) if you believe our processing of your personal data infringes your rights.

How to exercise your rights: Send a written request to gabriel@legacybygabriel.com.ng. We will respond to verified requests within thirty (30) days. For complex requests, we may extend this period by an additional 30 days with prior notice.

LEGACY by Gabriel uses cookies and similar tracking technologies to deliver, maintain, and improve the Platform. This section forms our full Cookie Policy — bundled here for your convenience.

Types of Cookies We Use:

• Essential Cookies (always active): Required for core functionality such as authentication, session management, security, and LEGACY Pay transactions. The Platform cannot function properly without these.
• Preferences Cookies (consent required): Remember your theme (light/dark mode), language, and non-essential personalisation choices.

Managing Cookies: You can manage your cookie preferences through our on-site cookie consent banner or via your browser settings. Disabling essential cookies may impair your ability to use the Platform. You may withdraw consent for non-essential cookies at any time.

From time to time, LEGACY may contact you with marketing messages, product updates, educational content, promotional offers, and news about new features. These communications are managed by Gideon Aderibigbe, our Marketing Lead, and are sent from gideonaderibigbe@legacybygabriel.com.ng.

• Opt-Out Model: By default, Users receive marketing communications as part of their engagement with the Platform. You may opt out at any time.
• Brand Ambassadors may additionally receive dedicated promotional materials, campaign briefings, and performance updates relevant to their role.
• How to Opt Out: Click the “unsubscribe” link at the foot of any marketing email, adjust your notification preferences within your Account settings, or email gideonaderibigbe@legacybygabriel.com.ng directly.
• Transactional Messages: Opting out of marketing does not affect essential transactional messages (e.g., payment confirmations, security alerts, account notifications), which you will continue to receive.

LEGACY by Gabriel is available to Users aged 13 years and above. For Users under the age of 18, we operate on a self-declaration model — Users confirm during registration that they meet the minimum age requirement and that, where applicable, they have the consent of a parent or legal guardian.

• We minimise the data collected from minors and apply additional safeguards where practicable.
• Parents and guardians may request access to, correction of, or deletion of their child’s data by emailing gabriel@legacybygabriel.com.ng with verifiable proof of guardianship.
• If we become aware that we have collected data from a child under 13 without appropriate consent, we will promptly delete such data.

LEGACY by Gabriel implements industry-aware technical and organisational security measures designed to protect your personal data against unauthorised access, alteration, disclosure, or destruction:

• HTTPS / TLS Encryption: All communication between your device and our servers is encrypted using industry-standard TLS protocols.
• Server-Side Access Controls: Strict, role-based access is enforced across our hosting and database infrastructure, with least-privilege principles.
• Regular Backups: Automated backups protect against data loss and enable recovery from unexpected incidents.
• Two-Factor Authentication (2FA): 2FA is coming soon as an additional layer of Account security.
• Continuous Monitoring: We monitor our Platform for suspicious activity, anomaly patterns, and potential threats.
• Periodic Security Reviews: Our systems and processes are reviewed regularly to identify and address emerging risks.

In the unlikely event of a personal data breach that is likely to result in a risk to your rights and freedoms, LEGACY by Gabriel commits to transparent and timely notification in accordance with the NDPA 2023.

• Regulator Notification: The Nigeria Data Protection Commission (NDPC) will be notified within seventy-two (72) hours of our becoming aware of a qualifying breach.
• User Notification: Affected Users will be notified within seventy-two (72) hours via email and/or in-app notification, including a description of the breach, the data affected, the likely consequences, and the measures we are taking in response.
• Your Role: If you suspect a breach, compromise, or unauthorised access affecting your Account or our Platform, please report it immediately to gabriel@legacybygabriel.com.ng.

LEGACY by Gabriel respects intellectual property rights and handles copyright concerns through our combined Privacy Policy and Terms and Conditions rather than a standalone DMCA page.

• All content on the Platform is assumed to belong to LEGACY by Gabriel unless a valid copyright notice from the original owner is present.
• Users must not upload content that infringes third-party copyrights, trademarks, or other intellectual property rights.
• Copyright takedown requests may be sent to gabriel@legacybygabriel.com.ng, accompanied by reasonable proof of ownership and precise details of the infringing material. Verified requests will be actioned promptly.
• Users found to repeatedly infringe intellectual property rights will have their Accounts suspended or permanently banned in accordance with the Terms and Conditions.

LEGACY by Gabriel may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or operational practices. When we make material changes, we will:

• Update the Effective Date and Version Number displayed at the top of this document.
• Notify registered Users via email and/or in-app notification, including a summary of the key changes.
• Where legally required, seek fresh consent for any new categories of processing.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data. Your continued use of the Platform after any update constitutes your acceptance of the revised Policy.

If you have any questions, concerns, complaints, or requests relating to this Privacy Policy or the processing of your personal data, please reach out through any of the channels below:

• Data Protection Officer: Gabriel Adeniji — gabriel@legacybygabriel.com.ng
• Primary Business Email: gabriel@legacybygabriel.com.ng
• Marketing & Promotions Email: gideonaderibigbe@legacybygabriel.com.ng
• WhatsApp Business: +234 704 995 8371
• Website: legacybygabriel.com.ng
• Regulator: You may also contact the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng should any concern remain unresolved.