Legal & Privacy Center
LearnExpress ERP by PenBytes Limited
NDPRA Compliant
Last Updated: August 2025
Effective Date: August 1, 2025
Introduction
LearnExpress ERP is a cloud-based Software-as-a-Service (SaaS) solution developed and managed by PenBytes Limited. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use LearnExpress ERP, in compliance with the Nigeria Data Protection Regulation (NDPR) 2019 and other applicable data protection laws.
📌 Our Commitment: We are committed to protecting your privacy and ensuring that your personal data is processed lawfully, fairly, and transparently.
Important Information & Who We Are
PenBytes Limited is the Data Controller responsible for your personal information when you use LearnExpress ERP.
The Data We Collect About You
We collect and process the following categories of personal data:
Identity Data
- Full name, username, or alias
- Role/position (e.g., Teacher, Administrator, Student, Parent)
- Institution/School name and location
- Country of residence/work
Contact Data
- Email address
- Phone numbers (mobile and/or landline)
- Postal address (if provided)
Academic & Usage Data
- Student records (names, classes, grades, attendance)
- Assessment results and performance data
- Activity logs and system usage patterns
- Learning progress and course completion data
Image & Media Data
- Profile photos
- Uploaded images or videos
- Captured images for identification purposes
Financial Data
- Subscription payment information
- Invoicing and billing details
- Transaction history
Technical Data
- IP address
- Login activity and session logs
- Device information (type, OS, browser version)
- Cookies and tracking technologies
How We Collect Your Data
- Directly from you: When you create an account, subscribe, complete forms, or interact with LearnExpress ERP.
- Automatically: Through cookies, server logs, analytics tools, and system monitoring.
- From third parties: Payment providers, authentication services, partner institutions, and authorized representatives.
- From your institution: If your school/organization has registered you as a user.
How We Use Your Personal Data
We process your personal data for the following purposes:
- Service Delivery: To provide, manage, and maintain LearnExpress ERP services.
- Academic Management: Enable performance tracking, reporting, and learning analytics.
- Financial Processing: Process payments, manage subscriptions, and generate invoices.
- Service Improvement: Analyze usage patterns to enhance user experience and develop new features.
- Communication: Send updates, announcements, support information, and service-related notifications.
- Security & Compliance: Ensure platform security, prevent fraud, and comply with legal obligations.
Lawful Basis for Processing
Under NDPR, we process your data based on the following lawful bases:
✓ Contractual Necessity: Processing is necessary for the performance of the service contract with you or your institution.
✓ Legitimate Interests: Processing is necessary for our legitimate business interests (service improvement, security, and support), provided your rights are not overridden.
✓ Consent: Where you have given explicit consent (e.g., marketing communications).
✓ Legal Obligation: Processing is required to comply with applicable laws and regulations.
NDPRA Compliance Principles
We adhere to the following principles under the Nigeria Data Protection Regulation (NDPR) 2019:
1. Lawfulness, Fairness, and Transparency: Data is processed lawfully, fairly, and transparently.
2. Purpose Limitation: Data is collected for specified, explicit, and legitimate purposes.
3. Data Minimization: We collect only data that is adequate, relevant, and limited to what is necessary.
4. Accuracy: Data is accurate and kept up to date.
5. Storage Limitation: Data is kept only as long as necessary.
6. Integrity and Confidentiality: Data is processed securely with appropriate technical and organizational measures.
7. Accountability: We are accountable for compliance and can demonstrate our compliance.
Data Sharing
We may share your personal data with:
- Authorized Personnel: Employees and administrators of PenBytes Limited who need access to perform their duties.
- Service Providers: Trusted third-party providers who assist with payment processing, cloud hosting, analytics, and customer support.
- Regulatory Authorities: Where required by law or to protect the rights and safety of users.
- Your Institution: If you are registered through a school or organization, they may have access to data related to your role.
🔒 We do not sell or rent your personal data to third parties for marketing purposes.
International Data Transfers
As a cloud-based platform, your data may be stored or processed in data centers located outside Nigeria. We ensure appropriate safeguards are in place, including:
- Transfer agreements incorporating standard contractual clauses
- Processor agreements with data protection commitments
- Compliance with NDPR data transfer requirements
Data Security
We implement comprehensive security measures to protect your personal data:
- Encryption: Data is encrypted in transit (TLS/SSL) and at rest.
- Access Controls: Role-based access controls limit data access to authorized personnel only.
- Monitoring: Continuous monitoring for security incidents and suspicious activities.
- Regular Audits: Security assessments and penetration testing are conducted regularly.
- Incident Response: A documented incident response plan is in place.
Data Retention
We retain your personal data only as long as necessary for the purposes outlined in this policy. Retention periods are determined based on:
- The purpose for which the data was collected
- Legal, regulatory, and contractual obligations
- Legitimate business needs
After the retention period, your data will be securely deleted or anonymized.
Your Privacy Rights
Under NDPR, you have the following rights regarding your personal data:
Right to Access: Request a copy of the personal data we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete data.
Right to Erasure: Request deletion of your personal data ("right to be forgotten").
Right to Object: Object to certain processing activities, including direct marketing.
Right to Restriction: Request restriction of processing in certain circumstances.
Right to Data Portability: Request transfer of your data to another service provider.
Right to Withdraw Consent: Withdraw consent where processing is based on consent.
To exercise any of these rights, please contact us at privacy@penbytes.com.ng. We will respond within 30 days as required by NDPR.
Children's Data
LearnExpress ERP is designed for educational institutions and may process data of children (individuals under 18) as provided by their schools or parents. We do not directly collect data from children without parental or institutional consent. If you are a parent or guardian and have concerns about your child's data, please contact us.
Cookies
We use cookies and similar technologies to:
- Maintain user sessions and authentication
- Analyze platform usage and performance
- Remember preferences and settings
You can manage cookie preferences through your browser settings.
Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes in our practices, technology, or legal requirements. Any changes will be:
- Posted on this page
- Communicated via email or platform notification for significant changes
- Effective 30 days after posting
If you have questions, concerns, or wish to exercise your privacy rights, please contact us:
You also have the right to lodge a complaint with the Nigeria Data Protection Bureau (NDPB) if you are unsatisfied with our response.
Effective Date: August 1, 2025
Introduction
These Terms of Service ("Terms") govern your use of LearnExpress ERP, a cloud-based School Management System provided by PenBytes Limited ("Company," "we," "us," "our"). By accessing or using LearnExpress ERP, you agree to be bound by these Terms.
📌 Please read these Terms carefully before using LearnExpress ERP. If you do not agree to these Terms, please do not use our services.
Acceptance of Terms
By using LearnExpress ERP, you represent that:
- You have read, understood, and agree to these Terms
- You have the authority to enter into this agreement on behalf of your organization
- You are at least 18 years old (or have parental consent)
Definitions
- "Platform" means the LearnExpress ERP software and associated services.
- "User" means any individual who registers for or uses the Platform.
- "Institution" means the school, organization, or entity that subscribes to the Platform.
- "Data" means all information and content uploaded, processed, or stored on the Platform.
- "Subscription" means the paid plan selected by the Institution.
User Accounts
Account Registration
- Users must provide accurate and complete information during registration.
- Users are responsible for maintaining the security of their credentials.
- Users must notify us immediately of any unauthorized access.
Account Types
- Institution Admin: Full platform access and management capabilities.
- Staff/Teacher: Access to teaching and administrative tools.
- Student: Access to learning resources and progress tracking.
- Parent: Access to student progress and communication tools.
License & Use
We grant you a limited, non-exclusive, non-transferable, revocable license to access and use LearnExpress ERP in accordance with these Terms and your subscription plan.
User Obligations
- Use the Platform in accordance with all applicable laws and regulations.
- Maintain the confidentiality of your account credentials.
- Ensure the accuracy and completeness of data you enter.
- Comply with our Acceptable Use Policy.
Prohibited Uses
You may not:
- Use the Platform for any unlawful or fraudulent purpose
- Interfere with or disrupt the Platform's security features
- Attempt to gain unauthorized access to the Platform or its data
- Reverse engineer, decompile, or disassemble the Platform
- Use the Platform to store or transmit malware, viruses, or harmful code
- Share or distribute Platform content without authorization
Payment & Billing
Subscription Fees
- Fees are based on the selected subscription tier and student population.
- Fees are billed per term or per academic session as per your agreement.
- Onboarding fees are one-time and non-refundable.
Payment Terms
- Payments are due as specified in your invoice.
- Late payments may result in suspension of services.
- We accept payments via bank transfer, card, and approved payment gateways.
Subscription & Renewal
- Subscriptions are for a fixed term (termly or annual).
- Subscriptions automatically renew unless cancelled before the renewal date.
- We will provide notice of upcoming renewals.
- Subscription upgrades/downgrades can be requested at any time.
Intellectual Property
- Platform IP: All content, code, design, trademarks, and software are owned by PenBytes Limited.
- No Transfer: These Terms do not transfer any intellectual property rights.
- Feedback: Any suggestions or feedback become our property.
Data Ownership
- Your Data: You retain ownership of all data you upload to the Platform.
- License to Use: You grant us a license to process your data to provide the service.
- Data Portability: We will provide data export upon request and termination.
Disclaimer of Warranties
THE PLATFORM IS PROVIDED "AS IS" WITHOUT ANY WARRANTIES, EXPRESS OR IMPLIED. We do not guarantee that the Platform will be error-free, secure, or uninterrupted.
Limitation of Liability
TO THE MAXIMUM EXTENT PERMITTED BY LAW, PENBYTES LIMITED SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES.
Our total liability shall not exceed the amount paid by you for the subscription in the preceding 12 months.
Termination
- By You: You may cancel your subscription at any time. No refunds for partial terms.
- By Us: We may suspend or terminate access for violation of these Terms, non-payment, or security concerns.
- Data Export: Upon termination, we will provide data export for 30 days.
Governing Law
These Terms are governed by the laws of the Federal Republic of Nigeria. Any disputes shall be resolved exclusively in the courts of Nigeria.
Amendments
We reserve the right to update these Terms. Changes will be communicated via email or platform notification. Continued use after changes constitutes acceptance.
- Email: support@penbytes.com.ng
- Phone: +234-706-676-2981
- Address: 20 Tsamiya Road, Costain Quarters, Kaduna, Nigeria
Effective Date: August 1, 2025
Security Overview
At PenBytes Limited, we take security seriously. This document provides an overview of the security measures implemented to protect LearnExpress ERP and your data.
🔒 Our Commitment: We maintain a comprehensive security program aligned with industry best practices and regulatory requirements.
Physical Security
- Data Centers: Hosted in Tier-3 and Tier-4 data centers with strict physical access controls.
- Surveillance: 24/7 CCTV monitoring and security personnel.
- Access: Biometric authentication and multi-factor access control.
- Environmental Controls: Fire suppression, climate control, and backup power systems.
Data Encryption
- In Transit: TLS 1.3 encryption for all data transmission.
- At Rest: AES-256 encryption for all stored data.
- Key Management: Secure key storage and rotation policies.
- Backup Encryption: Encrypted backups stored in secure locations.
Access Control
- Authentication: Strong password requirements and optional Multi-Factor Authentication (MFA).
- Authorization: Role-Based Access Control (RBAC) limiting data access to authorized users.
- Account Management: Regular access reviews and automated account lifecycle management.
- API Security: API keys and OAuth 2.0 authentication for integrations.
Network Security
- Firewalls: Next-generation firewalls with intrusion detection/prevention.
- Segmentation: Network segmentation to isolate sensitive systems.
- Monitoring: 24/7 network monitoring and threat intelligence.
- DDoS Protection: Distributed denial-of-service mitigation.
Application Security
- Secure Development: Secure coding practices and code reviews.
- Testing: Regular vulnerability assessments and penetration testing.
- Updates: Regular security patches and updates.
- Logging: Comprehensive audit logging and activity monitoring.
Incident Response
- Plan: Documented incident response plan.
- Team: Dedicated security incident response team.
- Communication: Clear escalation and notification procedures.
- Recovery: Regular testing of recovery procedures.
Compliance
- NDPR: Compliance with Nigeria Data Protection Regulation.
- ISO 27001: Aligned with information security management standards.
- Data Protection: Regular compliance audits and assessments.
- Transparency: Regular security reports to clients.
Effective Date: August 1, 2025
Compliance Statement
PenBytes Limited is committed to maintaining the highest standards of compliance with applicable laws and regulations, including the Nigeria Data Protection Regulation (NDPR) 2019.
NDPRA Compliance Framework
1. Data Protection Principles
Lawfulness, Fairness, and Transparency: All data processing is conducted lawfully, fairly, and transparently.
Purpose Limitation: Data is collected for specified, explicit, and legitimate purposes.
Data Minimization: We collect only data that is adequate, relevant, and limited to what is necessary.
Accuracy: Data is accurate, complete, and kept up to date.
Storage Limitation: Data is retained only as long as necessary.
Integrity and Confidentiality: Data is processed securely with appropriate technical and organizational measures.
Accountability: We demonstrate and document our compliance with NDPR.
2. Compliance Audits
- Regular internal audits conducted to ensure ongoing compliance.
- Third-party compliance assessments performed annually.
- Continuous monitoring and improvement of compliance measures.
3. Data Subject Rights
- Right to Access
- Right to Rectification
- Right to Erasure
- Right to Object
- Right to Restriction
- Right to Data Portability
- Right to Withdraw Consent
- Right to Lodge a Complaint
4. Data Breach Management
- Documented breach notification procedure.
- 72-hour notification to NDPB for reportable breaches.
- Transparent communication with affected data subjects.
- Regular testing of breach response procedures.
5. Vendor Management
- All third-party vendors undergo security and privacy assessments.
- Data processing agreements in place with all data processors.
- Regular vendor compliance reviews.
6. Training & Awareness
- Regular staff training on data protection and privacy.
- Security awareness programs for all employees.
- Specialized training for data protection personnel.
7. Data Protection Impact Assessments
- DPIAs conducted for high-risk processing activities.
- Regular reviews and updates to DPIAs.
- Integration of privacy by design and default.
📌 Our Commitment: We are committed to continuous improvement and maintaining the highest standards of data protection and compliance.
8. Compliance Contact
Effective Date: August 1, 2025
Member Terms
These Member Terms ("Member Terms") apply to all registered users of LearnExpress ERP. By registering, you agree to these terms in addition to our Terms of Service and Privacy Policy.
Eligibility
- You must be at least 18 years old to register as a user.
- If you are under 18, you must have parental/guardian consent.
- You must have the authority to represent your institution.
- You must provide accurate and complete information.
Registration
- Account Creation: All members must create an account to access the platform.
- Single Account: Users may hold only one account unless authorized.
- Credentials: You are responsible for maintaining the security of your credentials.
- Account Recovery: We provide secure account recovery processes.
Member Responsibilities
- Maintain accurate and up-to-date profile information.
- Keep your login credentials secure and confidential.
- Report any unauthorized access or security incidents immediately.
- Comply with all applicable laws and regulations.
- Respect the intellectual property rights of PenBytes Limited and other users.
- Use the Platform responsibly and in accordance with our Acceptable Use Policy.
Data & Privacy
- Your personal data is collected and processed in accordance with our Privacy Policy.
- You have the right to access, correct, and delete your personal data.
- We implement appropriate security measures to protect your data.
- Data is retained only as long as necessary for service delivery.
Communication
- Service Updates: You will receive notifications about platform updates, maintenance, and security.
- Support: You can contact our support team via email or phone.
- Marketing: You may receive marketing communications with the option to unsubscribe.
- Newsletter: Optional newsletters and product updates.
Subscription & Billing
- Plan Selection: Choose a plan based on your institution's needs.
- Billing Cycle: Billed per term (3 months) or annually.
- Payment Methods: Bank transfer, card, or approved payment gateways.
- Price Changes: 30-day notice for any price changes.
- Cancellation: You may cancel anytime, with effect from the next billing cycle.
Termination
- By Member: You may terminate your account at any time.
-
By Us: We may suspend or terminate accounts for:
- Violation of these Member Terms
- Non-payment of fees
- Security concerns
- Fraudulent or unlawful activity
- Data Export: Data export will be provided within 30 days of termination.
Code of Conduct
- Respect other users and their privacy.
- Do not share your account credentials with others.
- Do not upload or share illegal, harmful, or offensive content.
- Do not attempt to disrupt or compromise the Platform.
- Do not use the Platform for unauthorized commercial purposes.
Dispute Resolution
- Informal Resolution: We encourage you to contact us directly to resolve any disputes.
- Formal Process: If unresolved, disputes will be resolved through the courts of Nigeria.
- Governing Law: These Member Terms are governed by the laws of Nigeria.
- Support: support@penbytes.com.ng
- Phone: +234-706-676-2981
- Address: 20 Tsamiya Road, Costain Quarters, Kaduna, Nigeria