Privacy Policy

This Privacy Policy explains how Mannaplus Group of Schools (“we”, “us”, “our”, or “the School”) collects, uses, stores, shares, and protects personal data obtained through our website mannaplusgroupofschools.org (the “Website”), including via our Contact form, Admission Application form, and any other means by which a visitor submits personal information to us.

This Policy is written to comply with the Nigeria Data Protection Act, 2023 (“NDPA”), the General Application and Implementation Directive 2025 (“GAID”) issued by the Nigeria Data Protection Commission (“NDPC”), and the Child’s Rights Act 2003. By using this Website, submitting any form, or otherwise providing personal data to us, you acknowledge that you have read and understood this Policy.

1. Who We Are

Data Controller: Mannaplus Group of Schools, a primary and secondary educational institution located at 34, Orisun Ibukun Avenue, Arinko Road, Sango Ota, Ogun State, Nigeria.

Contact for Privacy Matters: [email protected] / [email protected]

For the purposes of the NDPA, Mannaplus Group of Schools is the “Data Controller” — the organisation that determines why and how your personal data is processed through this Website.

2. Personal Data We Collect

2.1 Contact / Enquiry Form

When you fill out our Contact form, we collect:

• Full name
• Email address
• Phone number (optional)
• Your area of interest (Primary School, College, Admissions, or General Enquiry)
• Any message or question you type into the form

2.2 Admission Application Form

When a parent or guardian submits an application on our behalf, we may collect:

• The applicant child’s full name, date of birth, and intended class/level
• Parent or guardian full name, phone number, email address, and home address
• Prior academic records or supporting documents voluntarily uploaded
• Any other information requested as part of the admissions process

2.3 Academic Quiz Feature

Our “Test Your Knowledge” quiz feature does not require you to submit any personal data. Quiz questions are fetched from a third-party public trivia database (opentdb.com) and no responses, scores, or identifying information are transmitted, stored, or linked to you.

2.4 Automatically Collected Technical Data

Like most websites, certain limited technical data is automatically processed by our infrastructure providers to keep the Website secure and functioning, including:

• IP address and approximate location (used for security/fraud prevention by Cloudflare, our hosting and security provider)
• Browser type, device type, and general usage patterns (used for bot detection via Cloudflare Turnstile)
• Security cookies set by Cloudflare to distinguish human visitors from automated bots

We do not use advertising trackers, behavioural profiling cookies, or any analytics that build a marketing profile of individual visitors.

3. Why We Collect Your Data

Under Section 25 of the NDPA, we only process personal data where a lawful basis exists:

• Consent — for Contact and Admission form submissions, given when you tick the consent checkbox before submitting.
• Contractual necessity — to process an admission application, a step toward a potential enrolment contract.
• Legitimate interest — to secure our Website against fraud, spam, and malicious activity.

We use your data to: respond to enquiries, process admission applications, schedule interviews/exams/tours, maintain internal student records, and protect the Website from abuse. We do not use your data for third-party marketing, and we never sell, rent, or trade your personal data.

4. Children’s Personal Data — Special Protection

As a school, we process the personal data of children. Under the NDPA (read with the Child’s Rights Act 2003), a “child” is any person under 18, who cannot independently consent to processing of their own data.

Parental/Guardian Consent: Where our Admission Application form collects a child’s data, it must be submitted with the explicit consent of the child’s parent or legal guardian. By submitting that form, the submitting adult confirms they are the parent/guardian and consents on the child’s behalf to the processing described here.

We do not knowingly collect data directly from a child without parental/guardian involvement. If we become aware this has happened, we will take reasonable steps to delete that data promptly.

5. Third Parties Who Process Data On Our Behalf

We share limited data with trusted service providers, strictly to operate the Website:

Provider	Role	Data Involved
Cloudflare, Inc.	Hosting, security, bot/spam protection (Turnstile), domain & SSL	IP address, browser/device signals, security tokens
Formspree, Inc.	Receives and forwards Contact form submissions to our inbox	Name, email, phone, message, interest
Open Trivia Database	Supplies academic quiz questions	None — no personal data is sent

These providers are based outside Nigeria. We rely on the fact that they are established global infrastructure providers with their own robust security and privacy safeguards, consistent with cross-border transfer conditions under the NDPA. We do not transfer data to any other third party for marketing or resale.

6. How Long We Keep Your Data

• Contact/Enquiry submissions: up to 12 months from submission, or until resolved, whichever is longer.
• Successful admission applications: retained for the duration of enrolment and a reasonable period after, as part of academic records.
• Unsuccessful applications: up to 12 months after a decision is communicated, then securely deleted, unless earlier deletion is requested.

7. How We Protect Your Data

• HTTPS/SSL encryption on all pages and form submissions
• Cloudflare Web Application Firewall (WAF) with managed threat-detection rules
• Cloudflare Turnstile bot/spam verification with server-side token verification
• Rate limiting against automated flooding attempts
• A hidden honeypot field to catch automated spam
• Restricted internal access to submitted form data

No method of transmission or storage over the internet is 100% secure, but we commit to acting promptly on any identified vulnerability or breach.

8. Data Breach Notification

In the event of a personal data breach likely to risk your rights and freedoms, we will: notify the NDPC within 72 hours where feasible; notify affected individuals directly without undue delay where high risk exists; and maintain an internal breach register documenting cause and remedy.

9. Your Rights as a Data Subject

• Right of Access — confirm whether we hold your data and obtain a copy.
• Right to Rectification — correct inaccurate or incomplete data.
• Right to Erasure — request deletion, subject to legal/academic record-keeping needs.
• Right to Withdraw Consent — at any time, without affecting prior lawful processing.
• Right to Object — to processing based on legitimate interest.
• Right to Data Portability — receive your data in a structured, common format.

To exercise any of these rights, contact us using the details in Section 1.

10. Cookies and Similar Technologies

This Website uses only essential, security-related cookies set by Cloudflare (bot detection/Turnstile) and Formspree (form processing) — never for advertising or behavioural tracking. In line with the NDPC’s GAID, we do not deploy non-essential tracking cookies without your prior opt-in consent.

11. Changes to This Policy

We may update this Policy to reflect changes in our practices, technology, or legal obligations. The Effective Date above will be updated accordingly.

12. Contact Us

Mannaplus Group of Schools
34, Orisun Ibukun Avenue, Arinko Road, Sango Ota, Ogun State, Nigeria
Email: [email protected] / [email protected]

This Privacy Policy is a compliance starting point based on the Nigeria Data Protection Act 2023 and related directives. It is not a substitute for advice from a licensed Nigerian legal practitioner.