Legal

Privacy Policy

Last updated 14 October 2026.

This Privacy Policy explains how Cognivo Tech LLC handles personal data within the TVET Last Mile platform. We take the privacy of programme beneficiaries seriously, because the people this platform serves are among those it most needs to protect.

Data we process

On behalf of the organisations that run programmes, the Service processes beneficiary profile data (such as name, trade, training provider, location and cohort), learning activity, outcome observations, and consent records. For platform users (staff and administrators) we process an email address and authentication credentials.

Data residency and encryption

The platform is designed to be hosted in Nigeria, in line with the Nigeria Data Protection Act (NDPA) 2023. Where a particular deployment is actually hosted is decided by the organisation operating it: the operator declares the hosting region in the deployment's configuration, and the platform shows that declaration — or “not declared” — to the organisation's administrators. The software cannot itself verify the physical location of the servers it runs on.

Administrators have a security posture screen that checks the running deployment and reports, with evidence, whether the database connection is encrypted, whether each organisation's data is isolated at the database level, whether the sign-in cookie is protected, and whether a data-encryption key is configured. It reports what it finds, including anything that needs attention.

Passwords are stored only as salted scrypt hashes. Data is encrypted in transit when the deployment is served over HTTPS. When the operator has configured a data-encryption key, stored copies of data-export files are encrypted by the application (AES-256-GCM); when no key is configured, the platform says so and does not store those files at all. Other stored data, such as names and phone numbers, is not individually encrypted by the application: encryption at rest of the database and its backups depends on the hosting platform and must be confirmed with the operator.

Lawful basis and consent

Beneficiary data is processed under the programme's lawful basis, and the Service records consent per beneficiary for the data they agree to share. Withdrawing consent stops the associated data flows.

Cookies

We use a single strictly-necessary cookie to keep signed-in users authenticated. We do not use advertising or third-party tracking cookies. A notice of this is shown on first visit.

Your rights

The NDPA 2023 gives data subjects rights of access, correction and erasure.

A copy of your data. A graduate with a login can ask for a copy from “My data & privacy” in their dashboard; programme staff can raise the same request on a graduate's behalf. Once an administrator of the organisation approves it, the export is a file containing the graduate's record and the records the platform holds about them. Credentials, such as verification-code hashes, are left out.

Erasure. A graduate, or staff on their behalf, can ask for their personal details to be erased. An erasure must be approved by a second person — whoever raised the request cannot approve it. When it is carried out, the name, phone number and local government area are permanently removed, the login is disconnected from the record, and the graduate's other records are deleted. It cannot be undone. Three things are deliberately kept: verified outcome observations and course completions, which remain attached to an anonymous record (keeping its reference code, trade, state and cohort) so that the programme's reported totals do not change; and the audit trail, which is never altered and records actions by identifier rather than by name. The login account itself is disconnected rather than deleted; ask the organisation's administrator to remove it.

Requests are decided by the organisation that runs the programme, not automatically. Correction of a record is handled by the organisation's staff. Every request, decision, export and erasure is recorded in the audit trail.

Security

Access is role-based and enforced on the server, each organisation's data is strictly isolated from every other, and administrative actions are audited.

Contact

Privacy questions can be raised through your organisation's administrator or with Cognivo Tech LLC.