Privacy Policy
Last Updated: May 6, 2026
At **Burgeon**, we understand that your privacy is a fundamental right. This Privacy Policy is designed to provide full transparency into our data practices, ensuring you have the information necessary to control your personal data. We operate in strict accordance with the **Nigeria Data Protection Act (NDPA)**, the **General Data Protection Regulation (GDPR)**, and the **California Consumer Privacy Act (CCPA)** where applicable.
1. Granular Data Collection
We categorize the data we collect into the following specific groups:
A. Individual Identity & Professional Data
Collected directly during registration or profile updates:
- Legal Identity: Legal first name, last name, and middle name (if provided).
- Contact Metadata: Primary email address, secondary backup email, and verified phone number.
- Professional Profile: Current job title, industry sector, pronouns, and a comprehensive biography.
- Documentation: Uploaded CVs, resumes, and certification records.
B. Financial & Transactional Records
Required for the fulfillment of our contractual services:
- Payout Information: Bank account name, bank account number, bank code (BVN not stored), and SWIFT/BIC codes for international transfers.
- Transaction History: Detailed records of all subscriptions, course purchases, and refunds, including timestamps and unique transaction references.
- Billing Address: Full street address, state/province, postal code, and country of residence.
C. Technical & Behavioral Metadata
Collected automatically via our infrastructure:
- Network Identifiers: IP addresses (IPv4 and IPv6), ISP details, and approximate geolocation data.
- Device Telemetry: Hardware model, operating system version, browser engine details, and screen resolution.
- Platform Interaction: Real-time tracking of lesson engagement, quiz attempt duration, navigation paths, and feature utilization.
2. Processing Purposes & Lawful Basis
| Purpose | Lawful Basis (GDPR/NDPR) |
|---|---|
| Account Provisioning & Access | Performance of a Contract |
| Fraud Detection & Security | Legitimate Interest / Legal Obligation |
| Marketing & Newsletters | Express Consent |
| Financial Auditing (7 Years) | Legal Obligation |
3. Third-Party Data Disclosures
We engage strictly vetted "Sub-Processors" to maintain platform integrity:
- Cloud Infrastructure: **Microsoft Azure** (West US/North Europe) for secure database and application hosting.
- Payment Orchestration: **Paystack, Flutterwave, and Stripe** for secure payment processing. We never see or store your raw card details.
- Communication Systems: **SendGrid/AWS SES** for transactional emails and OTP delivery.
- Tenant Organizations: Schools and Instructors whose courses you join have access to your enrollment status and progress metrics.
4. Data Subject Rights & Procedures
You have the following rights regarding your data:
- Right to Erasure (Right to be Forgotten): You may request the deletion of your account. Note that financial transaction data must be retained for 7 years per statutory requirements.
- Right to Portability: You may request an export of your data in a structured JSON or CSV format.
- Right to Restriction: You may request that we temporarily stop processing your data while a dispute is being resolved.
How to Exercise Your Rights:
To make a formal Data Subject Access Request (DSAR), please email **privacy@burgeon.space** with the subject line "DSAR Request". We will respond within 30 days as required by law.
5. Data Breach Notification Policy
In the unlikely event of a data breach that poses a high risk to your rights and freedoms, Burgeon will notify you and the relevant Supervisory Authority (e.g., NITDA/NDPC in Nigeria) within **72 hours** of discovery, as per NDPR and GDPR requirements.
6. Protection of Minors
Burgeon provides educational services that may be accessed by minors.
- Parental Consent: If you are under the age of 18, your use of the platform is contingent upon parental or legal guardian supervision.
- Under 13 Policy: We do not intentionally collect data from children under 13 without verifiable parental consent. If we discover such data exists, it will be scrubbed from our production servers immediately.
7. Contact & Regulatory Information
If you have unresolved concerns, you have the right to lodge a complaint with your local Data Protection Authority.
Burgeon Data Protection Office
Email: privacy@burgeon.space
Lagos, Nigeria.