Privacy Notice

1. Who We Are

The course is provided by Scalentric Limited ("Scalentric", "we"), a company based in Nigeria. Scalentric decides how the personal data described here is used, so it is the data controller. Contact us at info@scalentric.org. This notice follows the Nigeria Data Protection Act 2023 (NDPA) and the General Application and Implementation Directive issued under it by the Nigeria Data Protection Commission (NDPC).

2. What We Collect When You Enrol With Your Email

• Your full name, email address, current role and country.
• Your organisation and your experience with CNA, if you choose to give them.
• When you enrolled and when you agreed to the Terms of Use and this notice.
• An account number we create.
• The public half of a key your browser creates for this site. The private half never leaves your browser and cannot be read out of it, even by the site.

3. What We Receive When You Sign In Through Your Organisation

Some organisations let their staff sign in with their work account. If you choose that, your organisation's sign-in service sends us three things: a code that identifies your work account, your work email address and your name. We ask for nothing else. We store the code only as a keyed fingerprint. You then add your role and country yourself. Your organisation's sign-in service records that you signed in to this course, under its own policies.

4. Your Learning Activity

While you are enrolled, we record with the time: modules you open, modules you mark complete or not complete, when you view or download your certificate, when you download your data, when you change your details and when you sign in through your organisation. We use this to keep your progress across devices, and to understand who uses the course, which modules help and where learners stop. Reports we share with anyone outside Scalentric contain totals only.

5. Page Visits

When a page loads, the site records the page address, the website you came from, the type of device, operating system and browser, your language and time zone, your screen size, and a visitor number made by scrambling your network address and browser details with a secret value. Visit records hold no name, email address or account number and are never linked to your account. Nothing is recorded if your browser sends a Do Not Track or Global Privacy Control signal.

6. No Cookies

The site sets no cookies of any kind, for learners or for administrators. It uses your browser's own storage for three things the course needs to work: a copy of your details and progress (local storage), your site key (IndexedDB) and, for a few minutes during organisation sign-in, a one-time code (session storage). Nothing in that storage is used for advertising or for tracking you on other sites.

7. Security and Fault Records

When something goes wrong, or when the site blocks a request it considers harmful, the server records the time, the address requested, a reference number, a scrambled form of your network address, your browser type and, if you are signed in, your account number. These records are kept for 90 days to fix faults and to protect the course. When an account is erased, its account number is removed from them.

8. Why We Use Your Information

• To enrol you, deliver the course, keep your progress and produce your certificate: this is the service you asked for (performance of a contract).
• To understand who the course reaches and improve it, and to keep the site secure: our legitimate interests, which we have weighed against your rights.
• To email you a data report and a deletion confirmation, and to tell you if an administrator deactivates your account.
• To meet legal duties, such as answering the NDPC.

9. Who Receives It

• Hostinger, our hosting provider, stores the site and its records and delivers our emails, on our behalf.
• If you use organisation sign-in, your organisation's sign-in service takes part in each sign-in.
• Authorities, only where the law requires it.

We do not sell personal data, use it for advertising or send it to any AI service.

10. How Long We Keep It

• Your account, details, progress and activity: until you delete your account. If an administrator deactivates it, for 60 days after that, then erased.
• Page visit records: three years, then deleted.
• Security and fault records: 90 days.
• After an erasure we keep a record that a deletion happened and when, with no name, email address or account number.

11. Your Rights

Under the NDPA you have the right to be informed, to see your data, to have it corrected or erased, to restrict or object to its use, to receive it in a portable form and to withdraw consent.

• My Account shows everything you gave us and lets you change it.
• Download My Data, in My Account, gives you a complete copy in a portable file.
• Delete My Account erases your account.
• For anything else, write to info@scalentric.org. We will reply within the time the law sets.
• You can also complain to the Nigeria Data Protection Commission.

12. Deleting Your Account

Delete My Account asks you twice before anything happens. When you confirm: your account stops working at once; we email you a report of everything we held; your account, progress, activity and site keys are erased from our server and your account number is removed from our fault records; your browser's copy is removed; and we check every record, then email you a confirmation that nothing is left. All of this finishes within 24 hours, usually within a minute. If you enrolled in another browser or on another device, that is a separate account: delete it there, or write to us.

13. Deactivation by the Course Administrator

The administrator may deactivate an account that breaks the Terms of Use, at the account holder's request, or at the request of the organisation whose sign-in created it. Access stops at once and we email the address on the account. The account can be restored for 60 days if you write to us. After 60 days it is erased in the same way as a deletion you ask for.

14. Security

The measures that protect your data are described on the Security page. Information in your browser is only as secure as your device, so use a device protected by a lock.

15. Transfers Outside Nigeria

Our hosting provider may store or process data outside Nigeria. Where that happens, we rely on the conditions for transfers set out in the NDPA.

16. Children

The course is for adults. Do not enrol if you are under 18.

17. Changes to This Notice

We will update this notice when our practices change and show the version and date at the top. If a change affects how we use data you have already given us, we will tell you in the course before it applies.