Privacy Policy
Our comprehensive commitment to protecting school data, student records, and institutional privacy under Nigerian and international data protection standards.
Local Air-Gapped Student Data Sovereignty
Unlike cloud-hosted testing software, Stark CBT is an offline local area network (LAN) software system. All student bio-data, exam scores, questions, and session responses remain 100% inside your school premises on your own computer hardware. Neither XpanSieve Studio nor any third-party cloud vendor has access to, hosts, transfers, or mines your school’s student examination databases.
1. Identity of the Data Controller & Scope
This Privacy Policy governs the processing of personal information by XpanSieve Studio (the developers and licensors of Stark CBT, hereinafter referred to as “we”, “our”, or “us”) in connection with our public website (starkcbt.xpansieve.studio), license management services, and technical support interactions.
Under the Nigeria Data Protection Act (NDPA) 2023 and the Nigeria Data Protection Regulation (NDPR) overseen by the Nigeria Data Protection Commission (NDPC), XpanSieve Studio acts as a:
- Data Controller: For school administrator inquiries, quotation requests, software licensing records, and technical support communications collected directly through our website or direct official channels.
- Software Provider / Non-Processor of On-Premises Records: When a school operates Stark CBT within its internal local area network, the school institution is the sole Data Controller of its students’ and teachers’ information. Stark CBT operates offline without telemetry or external data relays.
2. Lawful Bases for Processing (NDPA Section 25)
In compliance with Section 25 of the NDPA 2023, we process personal data strictly where a clear lawful justification exists:
Consent (NDPA Section 25)
Where you or an authorized school representative voluntarily submits contact inquiries, demo requests, or communication preferences.
Contract Performance
Processing required to issue school software license keys, provide software activation tokens, and deliver requested technical support services.
Legal Obligation
Compliance with Nigerian statutory accounting, tax, educational reporting, and regulatory standards.
Legitimate Interests
Maintaining the security, diagnostic stability, anti-malpractice safeguards, and architectural integrity of our offline testing software.
3. Categories of Personal Data Collected
We adhere strictly to the principle of data minimization. We collect only the information necessary to provide software licensing and support:
A. Licensee & Contact Records
School representative name, official email address, phone/WhatsApp number, institution name, campus address, and registered student volume for licensing verification.
B. Technical Machine Identifiers for Hardware Activation
Cryptographic hardware machine fingerprint hashes used solely to tie an offline license key to the school’s designated examination server PC. These hashes cannot be reversed into personal identifying details.
C. Sensitive Personal Data Notice (NDPA Section 30)
We never collect, process, or store sensitive personal data (such as religious affiliations, biometrics, health data, or political opinions) through our public web services.
4. Your Data Subject Rights (NDPA Part IV)
Under Part IV of the NDPA 2023, data subjects possess robust legal rights regarding their personal information. All verified requests receive a written response within thirty (30) days:
| Data Subject Right | Description | Response Window |
|---|---|---|
| Right to Be Informed | Receive clear, transparent information about how your personal data is collected and processed. | At collection |
| Right of Access | Request confirmation of whether we hold your personal data and receive an accessible copy. | Within 30 days |
| Right to Rectification | Request immediate correction of any inaccurate, incomplete, or outdated information. | Within 30 days |
| Right to Erasure (To Be Forgotten) | Request deletion of personal data where there is no lawful or contractual ground for retention. | Within 30 days |
| Right to Restrict Processing | Limit the scope of processing under specific legal or disputed factual circumstances. | Within 30 days |
| Right to Data Portability | Obtain and reuse your data in a structured, commonly used, and machine-readable format. | Within 30 days |
| Right to Object | Object at any time to processing based on legitimate interests or direct communication. | Within 30 days |
| Automated Decision Safeguards | Not be subject to decisions based solely on automated processing producing significant legal effects. | Within 30 days |
To exercise any of the rights listed above, contact our Data Protection desk at starkcbt.xpansieve@gmail.com.
5. Data Storage, Retention & Cross-Border Transfers (NDPA Part VI)
Website contact requests and licensing records are retained only for the duration necessary to satisfy contractual obligations and statutory auditing periods (typically 7 years for commercial licensing records).
Any cross-border transit of web inquiry data adheres strictly to Part VI of the NDPA 2023, utilizing jurisdictions deemed adequate by the Nigeria Data Protection Commission (NDPC) or protected by Standard Contractual Clauses (SCCs).
6. Security Measures & Breach Notification (NDPA Section 39)
We implement administrative, technical, and physical safeguards—including SSL/TLS transport encryption, strict role-based access restrictions, and regular security vulnerability evaluations.
In the unexpected event of a personal data breach impacting rights and freedoms, we adhere strictly to statutory requirements under Section 39 of the NDPA 2023: notifying the Nigeria Data Protection Commission (NDPC) within 72 hours of confirmation and notifying affected data subjects without undue delay.
Data Protection Contact & Inquiries
For inquiries regarding our compliance with the Nigeria Data Protection Act, exercising your data subject rights, or requesting a Data Processing Agreement (DPA), contact: