1. Introduction
This Privacy Policy explains how Obi Expeditions Limited, trading as Tannok (“Tannok,” “we,” “us,” or “our”), collects, uses, discloses, and safeguards personal data when schools, educators, students, and parents use our education infrastructure platform (the “Platform”). Please read this Policy alongside our Terms of Service and, for schools, our Data Processing Agreement.
2. Information We Collect
We collect information you or your school provide directly, including: name, email address, phone number, school name, role (Owner, School Admin, office staff, teacher, student, or parent/guardian), date of birth, student identification and enrollment information, and academic records (results, assessments, attendance). We also collect limited technical information (device type, log data) needed to operate the Platform securely across web, Android, iOS, and other supported devices.
We collect payment information when a school or payer uses Tannok Pay, including payer name, email address, phone number, student or invoice reference, fee details, amount, payment method, transaction reference, payment status, settlement account details, and any KYC or KYB information we require. We do not store full card numbers or CVV. Card data is handled by our payment processor.
3. How We Use Information
We use information to provide and maintain the Platform, process and publish academic results, authenticate users, communicate with schools and users, improve the Platform, and comply with legal obligations. We use date of birth and consent records to apply our age policy, obtain guardian consent where required, restrict minor accounts, and keep an audit trail of legal acceptances.
We use payment data to process payments, reconcile and settle funds, issue receipts, handle refunds and chargebacks, prevent fraud, meet KYC, KYB, tax, and accounting obligations, and resolve disputes.
As the Platform’s functionality extends over time (learning, digital identity, and marketplace features), we will use information for those purposes only as disclosed through this Policy or an update to it before the relevant feature is introduced.
4. Legal Basis for Processing
Where a school inputs student or parent data into the Platform, the school is the data controller and instructs us on the purposes and means of processing; our processing in that context is grounded in the contract between the school and Tannok, and the consents the school has obtained from students and parents. Where a user establishes a direct relationship with Tannok (see Section 11 and our Terms of Service), Tannok is the data controller and processes personal data on the basis of consent, contract, or another lawful basis available under the Nigeria Data Protection Act 2023 (“NDPA”).
For age and consent checks, we rely on our contract with the school or user, our legal obligations to protect children and keep compliance records, and our legitimate interest in safeguarding users and preventing misuse. Where we ask for guardian consent, we rely on that consent and on the school’s confirmation that it has obtained it. For payment processing, we rely on the contract with the school or payer, legal obligations for KYC, tax, and accounting, and our legitimate interest in fraud prevention and dispute resolution.
5. Third-Party Service Providers
We use third-party service providers to operate the Platform, including for cloud hosting, database services, email delivery, content delivery, analytics, payment processing, settlement, and identity verification. Our payment processors include licensed payment partners and the banks and settlement partners used to complete a transaction. These providers are contractually bound to protect personal data and may use it only to provide the services we request. We do not sell personal data.
6. Data Security
We implement technical and organizational measures appropriate to the risk, including encryption in transit and at rest, access controls, regular security review, and staff confidentiality obligations. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
7. Data Retention
School data is retained while the school maintains an active subscription and, following termination, for the period described in the Data Processing Agreement. Within 90 days of a school’s closure, Tannok will purge the school’s operational data and issue an online deletion certificate confirming what was destroyed and what was retained under the DPA.
Once a student or parent establishes a direct relationship with Tannok (see Section 11), their verified academic records become part of that individual’s lifetime academic record with Tannok, described in Section 8, and are retained for as long as the individual maintains a direct relationship with Tannok, unless they request deletion under Section 13, subject to the limits described there. Audit and security logs are retained for a limited period as necessary for security purposes.
Age declarations, guardian consent records, and legal acceptance records are retained while the account is active and for a reasonable period afterwards so we can demonstrate compliance and resolve disputes. Payment and transaction records are retained for the period required by tax, accounting, anti-fraud, and dispute rules, and for as long as needed to resolve a payment, refund, or chargeback.
8. Lifetime Academic Record and Result Verification
A core purpose of a direct relationship with Tannok is to give a student a permanent, portable academic record that follows them from school through their career, and that can be verified by third parties they choose to share it with. To provide this, once an individual has a direct relationship with Tannok:
- Tannok retains that individual’s verified academic records (results, credentials, dates of attendance, and institution) for the duration of the relationship, rather than deleting them when a school relationship ends, so the record remains available to the individual and to verifiers they authorize.
- Tannok may offer a Result Verification service, through which an employer, institution, or other third party can submit a request to confirm specific academic results or credentials belonging to an individual.
- Tannok will only disclose information through the Result Verification service where the individual has authorized that specific disclosure (for example, by providing a verification code or approving a pending request), or as otherwise required or permitted by law. A verification response discloses only the minimum information needed to confirm what was asked (for example, pass/fail status, grade, dates, and institution), not an individual’s full record, unless the individual has specifically authorized broader disclosure.
- An individual can review who has requested verification of their record, and can decline or revoke standing authorization for future requests, through their account settings.
9. Erasure and the Lifetime Record
Because a verified academic record loses its value as a credential if it can be altered or removed after the fact, an individual’s right to erasure under Section 13 does not extend to verified results and credentials once issued, except where required by law or where the record is shown to be inaccurate or fraudulently entered, in which case Tannok will correct or annotate the record rather than silently delete it. An individual may still request deletion of other personal data associated with their account (such as contact details) and may close their account to stop further use, without erasing the underlying verified record.
11. Children’s Data and Direct Users
Many users of the Platform are students who are children. In line with the NDPA and the Child’s Rights Act 2003, a “child” is a person under 18. Where a school provisions a student account, the school is responsible for obtaining the consent of a parent or guardian, consistent with the layered consent architecture presented at account creation, which also covers the possibility that the student or parent may later transition to a direct relationship with Tannok. Where a student or parent establishes a direct relationship with Tannok, we will seek any consent required by law directly, in a clear and age-appropriate form, and a parent or guardian’s consent will be sought for a data subject who is a child.
Staff accounts are not available to anyone under 16. Adult staff roles are 18 or older. A junior teacher or teaching assistant may be 16 or 17 only with guardian consent, school attestation, adult supervision, and restricted permissions. We may ask for a date of birth and guardian details before enabling a minor staff account. If we learn that an adult role is held by someone under 18, we will restrict that account and notify support.
11A. Age and Consent Records
We keep records of the date of birth you provide, the age band that applies to your account, the legal document versions you accept, when you accept them, and any guardian consent or school attestation connected to a minor account. We use these records to apply the age policy, restrict permissions, respond to a dispute, and demonstrate compliance.
A school may record guardian consent for a minor teacher or student. We store the guardian’s name, contact details, relationship to the minor, the consent status, and the school’s attestation. A guardian may contact us or the school to review or withdraw consent, subject to law and any records we must retain.
11B. Payment Data
We collect and use payment data as described in this Policy and the Tannok Pay Terms. Public payment links may collect payer details to complete a payment. We do not display full account numbers; we store masked account details. Dedicated virtual accounts may be issued to verified schools, parents, students and merchants as part of a phased rollout. Vault payments are not currently available. We will provide additional notice and obtain any consent required by law before we enable a new use of payment data.
We may share payment data with payment processors, banks, settlement partners, auditors, and regulators where required. We do not store full card numbers or CVV. A payment processor may collect card details directly from the payer under its own privacy terms.
12. Cross-Border Data Transfer
Where personal data is transferred outside Nigeria (including to service providers described in Section 5), we take steps required under the NDPA to ensure the data receives an adequate level of protection, including through contractual safeguards with the recipient.
13. Your Rights
Subject to the NDPA, you have the right to access your personal data, request correction of inaccurate data, request deletion where applicable, object to certain processing, request a portable copy of your data, and withdraw consent at any time where processing is based on consent. Section 9 describes a limited exception to deletion for verified academic records held as part of a direct relationship with Tannok. Where your data was provided by your school, you may also need to contact your school to exercise some of these rights, as it may be the data controller for that data. We will respond to verified requests within the time required by law.
14. Regulatory Framework
We are committed to complying with the Nigeria Data Protection Act 2023 and any implementing regulations issued by the Nigeria Data Protection Commission. Where we process personal data of users outside Nigeria, we take account of other applicable data protection law, such as the EU General Data Protection Regulation, to the extent it applies.
15. Data Breach Notification
If a personal data breach affecting you occurs, we will notify affected users and, where required by law, the Nigeria Data Protection Commission, without undue delay, describing the nature of the breach, likely consequences, and the measures taken or proposed to address it.
16. Changes to This Policy
We may update this Policy from time to time. We will post the updated Policy on this page with a revised “Last updated” date, and will provide additional notice for material changes.
Appendix A. Multi-Country Operation
Tannok is operated globally as a product of Obi Expeditions Limited (RC 9837624, Nigeria), serving schools across jurisdictions in compliance with applicable local law. This Policy applies wherever Tannok is active.
Where a Country Schedule in Appendix B covers the school’s or user’s country, it supplements this Policy and prevails on any conflict, including which regulator, consent age, and retention rules apply. Additional African markets are added by publishing new schedules as Tannok activates them.
English is the controlling language of this Policy; translations, where provided (including for Francophone markets), are for convenience only.
Appendix B. Country Schedules
Schedule 1: Nigeria. Complete as set out in this Policy: Nigeria Data Protection Act 2023 and Nigeria Data Protection Commission; child means under 18 (Child’s Rights Act 2003) with layered parental consent; adult staff roles are 18 or older; junior teachers and teaching assistants may be 16 or 17 with guardian consent, school attestation, adult supervision, and restricted permissions; staff accounts are not available under 16.
Additional markets. Tannok operates across Africa and beyond. Where Tannok activates in another country, a country schedule setting out the governing law, data regulator, and consent rules for that market is published here; it supplements this Policy and prevails on any conflict. Activation in any market is subject to all required local licences and registrations.
17. Contact
Obi Expeditions Limited (RC 9837624), trading as Tannok
Data Protection queries: [email protected]
Security: tannok.com/security
Operated by Obi Expeditions Limited (RC 9837624), trading as Tannok