Privacy Policy

1. Who we are

DigMusEd (Digital Music Education) ("DigMusEd", "we", "us") operates https://www.digmused.com and the associated examination, proctoring, orchestra and concert services. For the purposes of the Nigeria Data Protection Act 2023 ("NDPA") we are the data controller of the personal data described in this policy.

Data protection enquiries: dpo@digmused.com. General enquiries: info@digmused.com.

2. Personal data we collect

• Identity and contact data — full name, date of birth, gender, nationality, email address, telephone number, postal address, and where applicable the details of a parent or guardian for candidates under 18.
• Registration and academic data — instrument or voice, grade or level, teacher, school or centre, examination history, entries, scores, marks, examiner comments, results and certificates.
• Payment data — transaction references, amounts, currency, status and the last digits of a card as returned by our payment processor. We never receive or store your full card number, CVV or bank password.
• Examination submission data — audio and video recordings of performances, uploaded documents and written answers.
• Proctoring data (sensitive personal data) — identity photographs, live webcam captures, facial-comparison scores, environment scan images, short background-audio clips, device and browser signals, and automatically generated integrity flags.
• Technical data — IP address, device type, browser, operating system, referring URLs, pages viewed, and cookie identifiers.
• Communications — emails, contact form messages, support requests and your marketing preferences.

3. Lawful bases for processing (section 25, NDPA)

• Performance of a contract — to register you, deliver examinations, mark submissions, issue results and certificates, and process payments.
• Consent — for optional marketing communications, for non-essential cookies, and for the capture and processing of biometric proctoring data. Consent may be withdrawn at any time (withdrawal does not affect processing already carried out, and may mean you cannot sit a remotely proctored exam).
• Legal obligation — for tax, accounting, regulatory and law-enforcement requirements.
• Legitimate interests — for platform security, fraud and malpractice prevention, audit logging of staff actions, service improvement and defence of legal claims, balanced against your rights and freedoms.
• Vital interests / public interest — only in the rare circumstances recognised by the NDPA.

4. Biometric and proctoring data

Remote proctoring involves the processing of sensitive personal data. Before an exam we ask you to register a reference photograph; during the exam our AI proctoring engine compares live webcam frames against that reference, scans your environment for prohibited items and detects unusual noise. Flagged moments are stored with an image and, where noise is detected, a short audio clip.

Automated flags never determine an outcome on their own. Every flagged session is reviewed by a human member of the exam board before any decision is made, and you may challenge a decision under section 8 below.

You may decline biometric proctoring; where an alternative assessment route is available we will offer it, otherwise a remotely proctored exam cannot proceed.

5. How we use your data

• To create and administer your account, entries and examination sessions.
• To verify identity, deter and detect malpractice, and preserve the integrity and value of our qualifications.
• To mark submissions, moderate results, issue certificates and verify certificates on request.
• To take payment and provide receipts, and to manage refunds and disputes.
• To send service messages such as confirmations, invitations, reminders, results notices and security alerts.
• To send marketing about DigMusEd programmes where you have consented; every marketing email includes an unsubscribe link.
• To maintain security, back-ups, audit trails and statistical reporting (in aggregated or de-identified form wherever possible).

6. Disclosure and third-party processors

We do not sell personal data. We share it only with processors and partners bound by written contracts that meet the requirements of section 29 of the NDPA:

• Cloud hosting, database and file-storage providers used to run the platform.
• Payment processors (including Paystack) to collect fees securely.
• Email delivery providers used to send transactional and permitted marketing messages.
• AI processing providers (including Google Gemini) used solely to analyse proctoring frames and audio for integrity signals.
• Examiners, moderators, exam board members and accredited centres, strictly on a role-based need-to-know basis.
• Professional advisers, auditors, regulators, the Nigeria Data Protection Commission and law-enforcement bodies where legally required or to establish or defend legal claims.

7. International transfers

Some of our processors operate servers outside Nigeria. Where personal data is transferred abroad we rely on the mechanisms permitted by sections 41–43 of the NDPA — an adequacy determination by the Commission, or contractual clauses and binding safeguards imposing standards essentially equivalent to Nigerian law, together with encryption in transit and at rest. Details of the safeguards applying to a specific transfer are available on request.

8. Your rights

Subject to the conditions in the NDPA, you have the right to:

• Be informed about how your data is used (this policy).
• Access a copy of the personal data we hold about you.
• Have inaccurate or incomplete data corrected.
• Request erasure where the data is no longer necessary or was processed unlawfully.
• Restrict or object to processing, including profiling and direct marketing.
• Receive your data in a portable, machine-readable format.
• Withdraw consent at any time where consent is the lawful basis.
• Not be subject to a decision based solely on automated processing that significantly affects you, and to obtain human review of any such decision.
• Lodge a complaint with the Nigeria Data Protection Commission.

9. Exercising your rights

Send your request to dpo@digmused.com with enough information for us to identify you. We respond within 30 days, and will tell you if we need a lawful extension. Requests are free unless manifestly unfounded or excessive. Examination scripts, marks and integrity records may be withheld where disclosure would compromise assessment security or the rights of others.

10. Retention

• Account and contact data — for the life of the account and 24 months after it is closed.
• Examination entries, marks, results and certificate records — retained permanently, as a certification body must be able to verify a qualification indefinitely.
• Performance video and audio submissions — 24 months after the results release, unless a dispute is open.
• Proctoring images, audio clips and integrity flags — 12 months after the session, unless required for an ongoing malpractice or legal matter.
• Payment and accounting records — 6 years, as required by Nigerian tax law.
• Marketing consents and suppression lists — until consent is withdrawn, and thereafter as needed to honour the withdrawal.

11. Security

We apply technical and organisational measures appropriate to the risk: TLS encryption in transit, encryption at rest, role-based access control, private storage buckets with time-limited signed links, row-level database security, audit logging of staff actions, least-privilege administration and periodic security reviews. No system can be guaranteed absolutely secure; you are responsible for keeping your password confidential and for the security of the device you use.

If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission within 72 hours and inform affected individuals without undue delay.

12. Children

Candidates under 18 may only be registered by a parent, guardian or an authorised school or teacher, who must provide verifiable consent for the processing described in this policy, including proctoring where applicable. We do not knowingly collect data directly from a child without that consent, and will delete such data promptly if it comes to our attention.

13. Cookies

We use strictly necessary cookies for sign-in, session security and the exam player. Optional analytics or advertising cookies are set only with your consent and can be refused or cleared through your browser settings. Blocking strictly necessary cookies will prevent the portal and examination tools from functioning.

14. Changes to this policy

We may update this policy to reflect changes in law or our services. The current version and its effective date are always shown on this page; material changes will be notified by email or an on-site notice. Effective date: 5 August 2026.

15. Contact

Data Protection Contact, DigMusEd — dpo@digmused.com. General enquiries — info@digmused.com. You also have the right to contact the Nigeria Data Protection Commission directly.