Privacy Policy
Bluepip Academy International
Effective Date: 17 March 2026
Last Updated: 17 March 2026
1. Introduction
Bluepip Academy International (“Bluepip Academy”, “we”, “our”, or “us”) is committed to protecting the privacy and personal data of every person who uses our platform, including parents, students, and teachers. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, how we protect it, and what rights you have over it.
This Policy applies to all users of:
- Our website at bluepip.gbis.com.ng
- Our online tutoring platform and dashboards
- All related services provided by Bluepip Academy
By registering for or using our platform, you confirm that you have read, understood, and agree to this Privacy Policy.
2. Who We Are
Bluepip Academy International Website: https://bluepip.gbis.com.ng Email: privacy@bluepipacademy.com Country of Registration: Federal Republic of Nigeria
Bluepip Academy is registered as a Data Controller under the Nigeria Data Protection Regulation (NDPR) administered by the National Information Technology Development Agency (NITDA).
3. Applicable Laws
Our data practices comply with or are aligned to:
- Nigeria Data Protection Regulation (NDPR) 2019 — our primary governing law
- Nigeria Data Protection Act (NDPA) 2023 — as applicable
- General Data Protection Regulation (GDPR) — for users in the European Economic Area (EEA) and United Kingdom
- Children’s Online Privacy Protection Act (COPPA) — additional protections for students under 13 in the United States
- UK Data Protection Act 2018 — for users in the United Kingdom
Where multiple laws apply, we adopt the stricter standard.
4. Data We Collect
4.1 Parent Account Data
When a parent registers, we collect:
- Full name
- Email address
- Phone number
- Country of residence and timezone
- Payment information (processed securely by Paystack or Stripe; we do not store raw card numbers)
- Billing address
- Communication preferences
- Digital consent records (with timestamp)
4.2 Student Profile Data
Parents create student profiles containing:
- Student’s first and last name
- Date of birth and age group
- Country of residence and timezone
- School name and grade/class level
- Subjects selected for tutoring
- Preferred session days and times
- Session history, attendance records, and progress data
- Materials downloaded
- Session ratings and feedback
4.3 Teacher Account Data
When a teacher registers or is onboarded, we collect:
- Full name
- Email address
- Phone number
- Country of residence and timezone
- Professional qualifications and teaching experience
- Subjects offered and teaching levels
- Bank account details (for salary/wallet payment processing)
- Session records, punctuality data, and performance metrics
- Materials uploaded to the platform
4.4 Technical Data
We automatically collect when you use the platform:
- IP address
- Browser type and version
- Device type and operating system
- Pages visited and session duration
- Login timestamps
- Zoom session metadata (start time, end time, duration)
- Error logs
4.5 Communication Data
- Messages sent through the internal platform messaging system
- Support requests submitted to us
- Feedback and rating submissions
4.6 Recording Data
- Video recordings of live tutoring sessions
- Recording metadata (session date, duration, participants, subject)
- Recording access logs (who viewed a recording, when, for how long)
5. How We Use Your Data
| Purpose | Legal Basis (NDPR/GDPR) |
|---|---|
| Creating and managing your account | Performance of contract |
| Scheduling and delivering tutoring sessions | Performance of contract |
| Processing payments and teacher payouts | Performance of contract |
| Sending session reminders and platform notifications | Performance of contract / Legitimate interests |
| Storing and providing access to session recordings | Performance of contract / Consent |
| Monitoring teacher performance and conduct | Legitimate interests |
| Maintaining platform security and preventing fraud | Legitimate interests |
| Complying with legal obligations | Legal obligation |
| Improving our platform and services | Legitimate interests |
| Sending marketing communications (with your consent) | Consent |
We will never sell, rent, or trade your personal data to third parties for commercial purposes.
6. Children’s Data — Special Protections
Bluepip Academy provides services to students as young as 10 years of age. We treat all student data with the highest level of care.
6.1 Parental Consent Required
All student accounts are created and managed by a parent or legal guardian. No student under 18 may register independently. We require verified parental consent before any student account is activated.
6.2 Data Minimisation for Students
We collect only the minimum data necessary to deliver the tutoring service. We do not:
- Collect behavioural or advertising data from students
- Allow students to post publicly visible content
- Enable student-to-student communication
- Display student data to anyone other than their parent, assigned teacher (session-relevant only), and our administrative staff
6.3 Students Under 13 (COPPA)
For students identified as under 13 years of age, we apply additional restrictions:
- No marketing communications are directed to the student
- No third-party tracking tools are active during the student’s session
- Parents may request complete data deletion at any time
7. Session Recordings
All live tutoring sessions are recorded by default, subject to consent obtained at registration. Recordings are:
- Stored securely on cloud infrastructure with encryption at rest
- Accessible only to platform administrators by default
- Made available to parents only upon an explicit access request approved by an administrator
- Made available to teachers only at administrator discretion (e.g., for professional development)
- Retained for a maximum of 24 months from the session date, after which they are permanently deleted
- Automatically compressed after 12 months to optimise storage costs
Recording access links are time-limited and tokenised. They cannot be shared or used after expiry.
Parents and students who do not consent to recording may withdraw consent by contacting us at privacy@bluepipacademy.com, understanding that this may affect service delivery.
8. Data Sharing
We share personal data only with the following categories of recipients, and only to the extent necessary:
8.1 Service Providers (Data Processors)
| Provider | Purpose | Location |
|---|---|---|
| Paystack | Payment processing (Nigerian users) | Nigeria |
| Stripe | Payment processing (international users) | United States |
| Zoom | Live session video conferencing | United States |
| Cloudflare / R2 | Recording and materials storage | Global |
| Email service provider | Transactional and notification emails | [As applicable] |
| Mochahost | WordPress hosting | United States |
All service providers are bound by Data Processing Agreements that require them to handle your data in accordance with applicable law.
8.2 Legal Disclosures
We may disclose personal data if required to do so by law, court order, or regulatory authority, or where necessary to protect the safety of our users, particularly minors.
8.3 No Sale of Data
We do not sell, rent, or trade personal data to any third party for marketing or commercial purposes.
9. International Data Transfers
Bluepip Academy is based in Nigeria. Some of our service providers process data in other countries, including the United States and the European Union. When data is transferred internationally, we ensure adequate safeguards are in place, including:
- Standard Contractual Clauses (for GDPR compliance)
- Data Processing Agreements with all processors
- Encryption in transit and at rest
10. Data Retention
| Data Type | Retention Period |
|---|---|
| Parent and student account data | Duration of account + 3 years after closure |
| Teacher account data | Duration of engagement + 3 years |
| Payment records | 7 years (regulatory requirement) |
| Session recordings | 24 months from session date |
| Session metadata and logs | 36 months |
| Audit and security logs | 12 months |
| Marketing consent records | Until consent is withdrawn + 2 years |
After the applicable retention period, data is securely and permanently deleted.
11. Your Rights
Depending on your location, you may have the following rights:
All Users (NDPR)
- Right to information — know what data we hold about you
- Right of access — request a copy of your personal data
- Right to rectification — request correction of inaccurate data
- Right to deletion — request erasure of your data (subject to legal obligations)
- Right to object — object to processing based on legitimate interests
EEA/UK Users (GDPR/UK GDPR) All of the above, plus:
- Right to data portability — receive your data in a machine-readable format
- Right to restrict processing
- Right to withdraw consent at any time (where processing is based on consent)
- Right to lodge a complaint with your supervisory authority
How to Exercise Your Rights
Submit a written request to: privacy@bluepipacademy.com
We will respond within 30 days. Where a request is complex, we may extend this by a further 60 days with notice.
12. Security
We implement appropriate technical and organisational measures to protect personal data, including:
- TLS/HTTPS encryption for all data in transit
- Encryption at rest for stored recordings and sensitive data
- Access controls — data is accessible only to authorised personnel with a need to know
- Regular security audits and vulnerability assessments
- Secure password hashing (not stored in plain text)
- Audit logging of all administrative actions involving personal data
- Two-factor authentication for administrator accounts
No system is completely secure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach.
13. Cookies
We use cookies and similar technologies on our website. Please refer to our separate Cookie Policy for full details. You may manage cookie preferences through the cookie banner displayed on your first visit.
14. Third-Party Links
Our website may contain links to third-party websites. We are not responsible for the privacy practices of those websites. We encourage you to read their privacy policies before providing any personal data.
15. Changes to This Policy
We may update this Privacy Policy from time to time. Where changes are material, we will notify you by email at least 14 days before the changes take effect. Your continued use of the platform after that date constitutes acceptance of the updated Policy.
The current version is always available at: https://bluepip.gbis.com.ng/privacy-policy
16. Contact Us
For all privacy-related enquiries, including data access requests, deletion requests, or complaints:
Bluepip Academy International — Data Privacy Email: privacy@bluepipacademy.com Website: https://bluepip.gbis.com.ng/contact
If you are in the EU/EEA and are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.
This Privacy Policy was prepared in accordance with the Nigeria Data Protection Regulation (NDPR) 2019, the Nigeria Data Protection Act (NDPA) 2023, the EU General Data Protection Regulation (GDPR) 2016/679, and the UK Data Protection Act 2018.