Privacy Notice

1. Who we are

ZentriNet Technologies LTD (“ZentriNet”, “we”, “us”, “our”), with offices at 82, Uselu Lagos Road, Benin City, Nigeria, operates the zAccess platform (“Service”). For data we collect directly from you when you sign up, we act as the data controller. When you use zAccess as part of a school, university or training organization (the “Tenant”), the Tenant is the controller of your account and exam data, and ZentriNet acts as a processor on the Tenant’s behalf.

2. Personal data we collect

• Account data: name, email address, phone number, hashed password, role and tenant membership.
• Profile data: avatar, display name, class label and preferences.
• Exam & assessment data: questions you author, attempts, answers, grades and certificates.
• Proctoring & identity data: webcam snapshots, screen captures, identity-document images and biometric matching results, browser/device telemetry, and incident events — only when you sit a proctored exam or undergo identity verification.
• Support data: messages and attachments you send through the contact form or support tickets.
• Usage & technical data: log records, device identifiers, IP address, referrer, time-zone, performance and error metrics.
• Cookies: see “Cookies” below.

3. Why we use your data and our legal basis

• To deliver the Service (account creation, exam delivery, grading, certificates) — performance of contract.
• To run proctoring and identity verification — performance of contract with the Tenant; consent where required by law for biometric processing.
• To secure the Service (fraud detection, abuse prevention, rate limiting, audit logs) — legitimate interests in protecting users and our platform.
• To provide customer support — performance of contract and legitimate interests.
• To process payments — performance of contract; payment data is collected directly by Paddle (see below).
• To comply with legal obligations — tax, accounting, lawful requests from authorities.
• To improve the Service — legitimate interests; we use aggregated analytics, not individual profiling.

4. Who we share data with

• Your Tenant — the school or organization that owns your account.
• Paddle.com Market Limited — our Merchant of Record for sales, subscription management, payments, tax compliance and invoicing. Paddle’s privacy notice is available at paddle.com/legal/privacy.
• Cloud infrastructure providers (Lovable Cloud / Supabase, Cloudflare) — hosting, database, edge compute and CDN services under written data-processing agreements.
• Email and notification providers — to send transactional and authentication emails.
• Optional third-party AI providers — only when you use AI-assisted features; inputs are sent for the sole purpose of generating the requested output and are not used to train external models.
• Professional advisers (legal, accounting) — where strictly necessary.
• Public authorities — where required by law.

We do not sell your personal data.

5. International transfers

Data may be processed outside Nigeria, including in the European Union and the United States. Where this happens, transfers are protected by contractual safeguards (such as Standard Contractual Clauses) and by the security measures described below.

6. Data retention

We keep account data for as long as your account is active. Exam attempts, grades and certificates are kept for as long as your Tenant requires (typically the duration of the academic record-keeping period). Proctoring artefacts (webcam frames, identity images) are retained only as long as needed to resolve disputes — by default no longer than 12 months — unless your Tenant configures a different period or law requires longer retention. When data is no longer needed it is deleted or anonymized.

7. Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict or object to processing of your personal data, to data portability, and to withdraw consent at any time without affecting prior lawful processing. Where processing is carried out by your Tenant as controller, please direct these requests to your Tenant first. Otherwise, contact us at support@zaccess.zentrinet.com. You also have the right to complain to your local data-protection authority.

8. Security

We apply appropriate technical and organizational measures to protect personal data, including encryption in transit, encryption at rest for sensitive fields, access controls, audit logging, periodic security review and least-privilege service accounts. No system is completely secure; if we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by law.

9. Cookies

We use a small number of cookies and similar technologies. Essentialcookies are required to sign you in, keep your session active and remember your preferences. We may use analytics cookies to understand aggregated usage; you can opt out at any time. We do not use marketing or advertising cookies.

10. Children

zAccess is provided to schools and organizations that may use it with students under the age of 18. Accounts for such students are created by the Tenant, which is responsible for obtaining parental consent where applicable. We do not knowingly collect personal data from children outside of an existing Tenant relationship.

11. Changes to this notice

We may update this notice from time to time. Material changes will be notified by email or in-product. The “Last updated” date at the top reflects the current version.

12. Contact

Questions or requests? Email support@zaccess.zentrinet.com or write to ZentriNet Technologies LTD, 82 Uselu Lagos Road, Benin City, Nigeria.