1. Who we are
Peakedubank ("we", "us") runs peakedubank.app, a paid library of NERDC-aligned teaching resources for Nigerian secondary schools, and a marketplace where teachers sell their own resources. We are the data controller for the personal data described here.
- Privacy contact / Data Protection Officer
- privacy@peakedubank.app
2. Adults only — children and pupils
Peakedubank is a professional service for teachers. You must be 18 or older to create an account. Under the Child's Rights Act 2003 anyone under 18 is a child, and the NDPA (section 31) only allows a child's data to be processed with a parent's or guardian's consent. We do not offer accounts to children and do not knowingly collect their data. If we learn an account belongs to someone under 18, we close it and delete its data. If you think a child has signed up, email privacy@peakedubank.app.
Pupils' data: our resources are used with students, but we never ask for information about them. Please do not upload, sell or message anything that identifies a pupil — names, photos, scripts with names, results or contact details. Marketplace items that contain pupils' personal data will be rejected or removed.
3. What we collect
| Data | Examples | Where it comes from |
|---|---|---|
| Account details | Name, email address, password (stored encrypted), school (optional) | You, at sign-up or from Google if you choose Google sign-in |
| Your choices | 18+ confirmation, privacy notice acceptance, email preferences, with dates | You |
| Library activity | Favourites, lesson planner entries, purchases and downloads | Your use of the site |
| Membership & payments | Plan, renewal dates, payment references, amounts. We never see or store your full card number. | Paddle and Paystack, when you pay |
| Seller information | Listings you upload, sales, earnings, payout history, bank name, account name and number | You, and Paystack when it confirms your account name |
| Messages | Messages between buyers and sellers in the inbox | You and the other teacher |
| Privacy requests | Requests you send us and our replies | You |
| Technical data | Sign-in session, IP address and device/browser details needed to keep you signed in and secure | Your browser |
We do not collect sensitive personal data (such as health, religion or biometrics) and do not ask for ID documents.
4. Why we use it and our legal basis
The NDPA (section 25) requires a lawful basis for every use of your data. Ours are:
| Purpose | Legal basis |
|---|---|
| Creating and running your account, giving access to the library, planner and favourites | Contract — needed to provide the service you signed up for |
| Taking membership and marketplace payments, giving buyers their downloads | Contract |
| Paying sellers their earnings into their bank account | Contract |
| Account emails: sign-up confirmation, password reset, buyer messages to sellers | Contract |
| Keeping payment, sale and payout records | Legal obligation — tax and accounting law |
| Preventing fraud, abuse and security incidents | Legitimate interests — protecting teachers and the platform, in a proportionate way |
| News, offers and new-resource announcements (only if you opt in) | Consent — you can withdraw it at any time |
We never sell your personal data and do not use it for advertising.
6. Data stored outside Nigeria
Some providers above store data outside Nigeria. Under sections 41–43 of the NDPA we only transfer data where it stays adequately protected — through the provider's contractual data-protection commitments, encryption in transit and at rest, and access limited to what the service needs. You can ask us for details of the safeguards for any provider.
7. How long we keep it
| Data | How long |
|---|---|
| Account, profile, favourites, planner, consent choices | While your account is open; deleted when you delete your account |
| Bank details | Until you remove them or delete your account |
| Messages you sent | While your account is open; deleted when you delete your account |
| Payment, sale and payout records | 6 years after the transaction, for tax and accounting. After you delete your account they are no longer linked to your name or email. |
| Privacy request records | A short record that we handled your request, without your name or email |
| Sign-in and security logs | Short periods kept by our hosting provider for security |
8. Your rights
Under sections 34–38 of the NDPA you can:
- Access — get a copy of your data (download it instantly from your privacy settings).
- Correct it — edit your profile any time, or ask us.
- Delete it — delete your account yourself in your privacy settings.
- Restrict or object to how we use it, including stopping any direct marketing at once.
- Move it to another service — your download is a machine-readable file.
- Withdraw consent you gave, as easily as you gave it.
- Complain to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.
Use your privacy settings or email privacy@peakedubank.app. We acknowledge every request within 2 working days, fix corrections within 21 days and finish other requests within 30 days — sooner where we can. Requests are free. If we can't do what you ask (for example because the law requires us to keep payment records), we will tell you why.
9. Emails and unsubscribing
Account emails are sent because of something you did or something that happened on your account: confirming your sign-up, resetting your password, or telling a seller a buyer has messaged them. Every one includes an unsubscribe link at the bottom; one click stops these emails to your address within minutes. Sign-in and password-reset emails still work, so you never get locked out. You can turn account emails back on from your privacy settings.
News and offers are only sent if you tick the box to opt in — it is never ticked for you and never required to use Peakedubank. You can change your mind in your privacy settings at any time. Any such email will say who it is from and include a one-click unsubscribe link, honoured within 2 days.
11. Security and data breaches
Data is encrypted in transit and at rest. Every account can only see its own data, enforced by the database itself; staff access is limited to admins who need it. Passwords are stored encrypted and common or leaked passwords are refused. Payment card details are handled only by Paddle and Paystack.
If a breach is likely to put your rights at risk, we will report it to the NDPC within 72 hours of becoming aware of it (NDPA section 40), and tell you directly without delay if the risk to you is high, with steps you can take.
12. Automated decisions
We do not make decisions about you with legal or similarly significant effects by automated means alone. Marketplace listings are reviewed by a person. Our AI tools are used only by our own team to prepare library resources and are not given your personal data.
13. Changes to this notice
If we change this notice in a way that matters, we'll show the new version when you next sign in and ask you to confirm you've read it.