Data Protection Policy

Marque Technologies Engineering Academy is committed to processing personal data lawfully, fairly, and transparently. We treat data protection as a fundamental right of our users and embed privacy principles into all aspects of our platform design and operations.

• Organisation: Marque Technologies Engineering Academy
• Address: Lagos, Nigeria
• Data Protection Officer (DPO): privacy@marquetechacademy.com
• Regulatory Body: Nigeria Data Protection Commission (NDPC) ndpc.gov.ng

We process all personal data in accordance with the following principles:

• Lawfulness, Fairness & Transparency: We process data on a valid legal basis and are open about how we use it.
• Purpose Limitation: Data is collected for specified, explicit, and legitimate purposes and not processed in ways incompatible with those purposes.
• Data Minimisation: We only collect data that is adequate, relevant, and limited to what is necessary.
• Accuracy: We take reasonable steps to ensure personal data is accurate and kept up to date.
• Storage Limitation: Data is kept only as long as necessary for the stated purpose.
• Integrity & Confidentiality: Data is processed with appropriate security measures against unauthorised access, accidental loss, or destruction.
• Accountability: We are responsible for and can demonstrate compliance with these principles.

• Encryption in Transit: All data transmitted between your browser and our servers uses TLS 1.2+.
• Encryption at Rest: Database contents are encrypted at rest using AES-256.
• Password Security: Passwords are never stored in plain text. We use bcrypt hashing via Supabase Auth.
• Row-Level Security (RLS): Database access is governed by Supabase RLS policies ensuring users can only access their own data.
• Access Control: Internal staff access to production data is role-based and logged.
• Security Headers: We deploy HTTP security headers including CSP, HSTS, X-Frame-Options, and others.
• Incident Response: We have a documented process to identify, contain, and report data breaches within 72 hours to the NDPC where required.

As a data subject under Nigerian law, you are entitled to:

• Request access to your personal data (Subject Access Request)
• Request correction of inaccurate data
• Request deletion of your data (right to erasure)
• Object to processing or request restriction
• Receive your data in portable format (data portability)
• Withdraw consent at any time (where consent is the legal basis)
• Lodge a complaint with the NDPC

Submit data requests to our DPO at privacy@marquetechacademy.com. We will respond within 30 days as required under the NDPA 2023.

We engage the following sub-processors who handle data on our behalf:

• Supabase Inc. Database, authentication, and file storage. Data Processing Agreement in place. See Supabase Privacy Policy.
• Payment Provider Payment processing. PCI-DSS compliant. We do not store card data.

All sub-processors are bound by data processing agreements consistent with NDPR/NDPA requirements.

In the event of a personal data breach, we will:

• Assess and contain the breach immediately upon discovery.
• Notify affected data subjects without undue delay if the breach poses a high risk to their rights.
• Notify the NDPC within 72 hours where required by law.
• Maintain an internal breach register.

To report a suspected data breach or security vulnerability, contact us at security@marquetechacademy.com.

This Data Protection Policy is reviewed at least annually or when significant changes occur to our data processing activities, applicable law, or regulatory guidance from the NDPC.