NDPR Compliance

Last updated: September 18, 2026

Amidarh Technologies ("Amidarh," "we," "our," or "us") is committed to complying with the Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act (NDP Act) 2023. This page outlines how we protect the personal data of individuals in Nigeria and uphold the principles of the NDPR across our products, including Flow and Trupper.

1. Our Role as a Data Controller and Data Processor

As a Data Controller: When we collect and process personal data directly from users who create accounts, subscribe to plans, or interact with our platform, we act as the data controller and are responsible for determining the purposes and means of processing.

As a Data Processor: When educational institutions use Trupper to manage student data, we act as a data processor on behalf of the institution (the data controller). We process such data strictly in accordance with the institution's instructions and applicable data protection agreements.

2. Lawful Basis for Processing

In accordance with the NDPR, we process personal data only when we have a lawful basis to do so. The bases we rely on include:

  • Consent: We obtain clear, informed consent before collecting and processing your personal data. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
  • Performance of a Contract: Processing necessary to fulfil our obligations under the terms of service you agreed to when creating an account or subscribing to our Services.
  • Legitimate Interest: Processing necessary for our legitimate business interests, such as improving our Services, preventing fraud, and ensuring platform security, provided these interests do not override your fundamental rights.
  • Legal Obligation: Processing necessary to comply with applicable Nigerian laws and regulations.

3. Data Subject Rights Under the NDPR

As a data subject under the NDPR, you have the following rights:

  • Right to Information: You have the right to be informed about how your personal data is collected, used, stored, and shared.
  • Right of Access: You may request access to the personal data we hold about you and obtain a copy in a commonly used, machine-readable format.
  • Right to Rectification: You may request correction of any inaccurate or incomplete personal data we hold about you.
  • Right to Deletion: You may request that we delete your personal data where it is no longer necessary for the purpose it was collected, or where you withdraw consent, subject to legal retention requirements.
  • Right to Restriction of Processing: You may request that we restrict the processing of your personal data in certain circumstances, such as when you contest its accuracy.
  • Right to Data Portability: You may request that your personal data be provided to you or transferred to another controller in a structured, commonly used, and machine-readable format.
  • Right to Object: You may object to the processing of your personal data for direct marketing or where processing is based on legitimate interests.
  • Right to Withdraw Consent: Where processing is based on consent, you have the right to withdraw consent at any time.
  • Right to Lodge a Complaint: You have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your data protection rights have been violated.

To exercise any of these rights, please contact us at privacy@amidarh.com. We will respond to your request within 30 days.

4. Consent Mechanisms

We implement the following consent mechanisms as required by the NDPR:

  • Clear and prominent privacy notices are presented at the point of data collection (e.g., during account registration).
  • Consent is obtained through affirmative action (opt-in), not pre-checked boxes or inactivity.
  • Users can withdraw consent at any time through their account settings or by contacting us.
  • Separate consent is obtained for distinct processing activities (e.g., marketing communications are separate from account creation).

5. Data Protection Measures

In compliance with the NDPR's security requirements, we implement appropriate technical and organizational measures to protect personal data, including:

  • Encryption: All data in transit is encrypted using TLS/SSL. Data at rest is encrypted using industry-standard encryption algorithms.
  • Access Controls: Role-based access controls ensure that only authorized personnel can access personal data, on a need-to-know basis.
  • Secure Authentication: Passwords are securely hashed. We support OAuth-based authentication and enforce strong password policies.
  • Regular Audits: We conduct periodic security assessments and vulnerability testing to identify and address potential risks.
  • Incident Response: We maintain an incident response plan to detect, report, and respond to data breaches in a timely manner.
  • Employee Training: Our team members undergo regular data protection awareness training.

6. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of data subjects, we will:

  • Notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of the breach.
  • Notify affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
  • Document the breach, including the facts, its effects, and the remedial actions taken.
  • Where Amidarh acts as a data processor (e.g., for Trupper institutional data), notify the data controller (the institution) without undue delay upon becoming aware of a breach.

7. International Data Transfers

Where personal data of Nigerian users is transferred outside Nigeria, we ensure that adequate safeguards are in place as required by the NDPR and NDP Act, including:

  • Ensuring the recipient country provides an adequate level of data protection, or implementing appropriate contractual safeguards (such as standard contractual clauses).
  • Obtaining the explicit consent of the data subject where required.
  • Conducting transfer impact assessments where necessary to evaluate the risks of the transfer.

Our primary infrastructure providers maintain data centres with robust security certifications. We ensure all third-party processors handling Nigerian user data are bound by data processing agreements that meet NDPR requirements.

8. Data Protection Impact Assessment (DPIA)

We conduct Data Protection Impact Assessments for processing activities that are likely to result in a high risk to the rights and freedoms of data subjects. This includes assessments for:

  • AI-powered features on Flow that process personal data to generate personalized learning content.
  • Large-scale processing of student records and examination data on Trupper.
  • Introduction of new features that involve new types of data processing.

9. Third-Party Data Processors

We engage third-party service providers to help deliver our Services. In compliance with the NDPR, we ensure that:

  • All third-party processors are bound by written data processing agreements that specify the scope, nature, and purpose of processing.
  • Third-party processors implement appropriate technical and organizational security measures.
  • We conduct due diligence on third-party processors before engagement and periodically review their compliance.
  • Third-party processors do not engage sub-processors without our prior authorization.

10. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, as outlined in our Privacy Policy. Specific retention periods include:

  • Account Data: Retained for the duration of your account and deleted or anonymized within 90 days of account deletion.
  • Transaction Records: Retained for up to 6 years as required by Nigerian tax and financial regulations.
  • Institutional Records (Trupper): Retained as directed by the institution, in accordance with applicable educational record-keeping requirements.
  • Usage and Log Data: Retained for up to 12 months for security, analytics, and service improvement purposes.

11. Complaints and Regulatory Contact

If you believe that your data protection rights have been violated, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC):

  • Nigeria Data Protection Commission (NDPC)
  • Website: ndpc.gov.ng

We encourage you to contact us first so we can attempt to resolve your concern directly.

12. Updates to This Page

We may update this NDPR compliance page from time to time to reflect changes in our practices or in applicable law. When we make material changes, we will update the "Last updated" date at the top of this page.

13. Contact Us

For any questions or concerns about our NDPR compliance or to exercise your data protection rights, please contact us: