Enterprise Development Centre (www.edc.edu.ng), the enterprise centre of Pan-Atlantic University, located at Km 22, Lekki-Epe Expressway, Ajah, Lagos ("We", "Us", "Enterprise Development Centre", "EDC"), is committed to protecting and respecting your privacy. This Privacy Policy ("Policy") relates to the programmes, training, mentoring, advisory, research, events, websites, portals and other digital services provided by EDC ("Services") and sets out the basis on which the Personal Data collected from you, or that you provide to Us, will be processed by Us. "Personal Data" means any information that identifies or relates to a particular individual and also includes information referred to as "personally identifiable information" or "personal information" under applicable data privacy laws, rules, or regulations (collectively the "Data Protection Laws"). This Policy does not cover the practices of companies/organisations We don't own or control or people We don't manage. For clarity, this Policy applies when EDC acts as a "Data Controller" (as defined in the Nigeria Data Protection Act, 2023 (the "NDPA") and the General Application and Implementation Directive, 2025 (the "GAID")). Note that EDC may also process Personal Data on behalf of funders, clients or partner organisations in connection with programmes, surveys or services EDC delivers for them, in which case EDC acts as a Data Processor and the funder, client or partner organisation is the Data Controller. If EDC is the Data Processor for your Personal Data, please contact the relevant Data Controller in the first instance to address your rights with respect to such data; EDC will support the Data Controller in responding to your request. Please read the following carefully to understand EDC's views and practices regarding your Personal Data and how EDC will treat it. 
This Policy applies to applicants and participants in EDC programmes; alumni; mentors, facilitators and trainers We work with; partners, funders and their representatives; visitors to EDC's websites and portals; event and webinar attendees; and EDC employees and job applicants.

Sources of Personal Data

Depending on the programme, service or processing activity, we may obtain Personal Data from: 

● You, when you provide information directly to EDC through applications, registrations, surveys, assessments, correspondence, programme activities (learning, mentoring, advisory), and account creation on our websites and portals. 
● Your use of EDC websites and portals, where certain information is collected automatically through your interaction with our digital services, including through cookies and similar technologies where applicable.  ● Programme partners, funders and collaborating organisations, where Personal Data is shared with EDC for purposes connected with the relevant programme or activity. 
● Service providers and other third parties, where they provide or process Personal Data on EDC's behalf or in connection with the delivery, administration, monitoring, evaluation or operation of EDC programmes and services. 
● Other lawful sources, including publicly available sources or other sources where EDC is permitted to obtain the Personal Data under applicable data protection requirements. 

The source of Personal Data and EDC's role in processing it may vary depending on the relevant processing activity. EDC may act as a Data Controller, Data Processor or Joint Controller, as applicable. 

Information We Collect from You

We collect and process Personal Data that is necessary for the programmes, services and activities we provide. The information we collect will depend on your relationship with EDC and the nature of your interaction with us. 
We may collect Personal Data when you: 

● register or apply for an EDC programme, training, event or service; 
● create or use an account on an EDC website or portal; 
● participate in training, mentoring, advisory, research, monitoring and evaluation, or other programme activities; 
● complete surveys, assessments, feedback forms or other data collection activities; 
● communicate or correspond with us; 
● use our websites, portals and other digital services; or 
● otherwise provide information to us in connection with our activities. 

We may also receive Personal Data about you from programme partners, funders, service providers and other third parties where this is necessary for the relevant programme, service or activity and permitted under applicable data protection requirements. 

Categories of Personal Data We Collect

The categories of Personal Data EDC may collect will depend on the particular programme, service, processing activity and your relationship with EDC. The table below sets out the categories of Personal Data that we may collect. Throughout this Privacy Policy, we will refer back to the categories of Personal Data listed in this table (for example, "Category A. Personal identifiers and contact information"). 

EDC may also process special categories of personal data or other sensitive personal data where this is necessary for a specific programme or processing activity and where there is an appropriate lawful basis and applicable safeguards. Where such information is collected, we will provide appropriate information about the purpose and basis for its processing. 
The specific categories of Personal Data collected will be communicated at or before the point of collection, where required, and will depend on the particular EDC programme, service or activity.

Lawful Basis for Processing

Under the NDPA, 2023 and the GAID, 2025, the lawful bases we rely on for processing of your Personal Data could be: 
Legitimate Interest: We may process your Personal Data based on our legitimate interests, which include our legitimate interest to deliver, administer and improve our programmes and Services; to monitor, evaluate and report on the outcomes of our programmes; and to maintain and improve the security and performance of our websites and portals; unless you have objected or your prior consent is required. We rely on legitimate interest only where our interests are not overridden by your rights and freedoms. 
Contract: We may process Personal Data in order for us to provide the Services and meet our contractual obligations towards you, when we have a contract with you (for example, when you accept a place on a programme or enrol in a fee-paying training). 
Consent: We will rely on your consent where required, for example when you sign up to receive updates about EDC programmes and events, or where we process sensitive personal data. In any such case, we will indicate this and ask for your specific, informed consent. You may withdraw your consent at any time; this will not affect processing carried out before you withdrew it. 
Legal Obligation: We may process your Personal Data to comply with a legal or regulatory obligation, such as keeping financial records, responding to lawful requests from regulators, or detecting, preventing or investigating crime or fraud, including working with law enforcement agencies. 
Vital Interests: In rare emergencies, we may process your Personal Data where necessary to protect your life or health or that of another person, for example where you fall ill during an EDC event. 
Public Interest: Where applicable, we may process your Personal Data where necessary for the performance of a task carried out in the public interest, such as a programme delivered under a government mandate. 
Where we process sensitive personal data (such as health or disability information), we rely on your explicit consent.

Your Rights

Subject to local data protection laws and in particular under the Nigeria Data Protection Act, 2023 (NDPA), you have a number of important rights. Those include rights to: 

● be informed about how your Personal Data is processed, which this Policy is intended to do
● access to your Personal Data if it does not breach the privacy of another individual
● require Us to correct any mistakes in your information which We hold
● request the erasure of Personal Data concerning you in certain situations  ● receive the Personal Data concerning you which you have provided to Us, in a structured, commonly used and machine-readable format and have the right to transmit those data to a third party in certain situations  ● withdraw your consent at any time, where We rely on your consent  ● object at any time to processing of Personal Data concerning you for direct marketing  ● object to decisions being taken by automated means which produce legal effects concerning you or similarly significantly affect you  ● object in certain other situations to our continued processing of your Personal Data  ● restrict our processing of your Personal Data even while we hold on to it  ● lodge a complaint with the Nigeria Data Protection Commission (NDPC).

Where you request access, We will provide you with a copy of your Personal Data together with information on the purposes for which it is processed, the categories of Personal Data concerned, the recipients or categories of recipients to whom it has been disclosed, how long it will be kept, the source of the Personal Data where it was not collected from you, and whether it is used for automated decision-making.

If you would like to exercise any of those rights, please: 

● contact us using our Contact details below 
● let Us have enough information to identify you, 
● let Us have proof of your identity and address. Where you are a user of our Services you should email us from the email address that you used to register with EDC. Receipt of an email from this address will usually be sufficient to confirm your identity. In all other cases we may request one or more identification documents, such as a copy of your NIN slip, driving licence or passport; and 
● let Us know the information to which your request relates. 

We will only use Personal Data provided in your request to verify your identity and complete your request. You do not need an account to submit a request. Where a request does not contain enough information for Us to verify you or understand it, We will contact you for clarification.

We will work to respond to your request within thirty (30) days of receipt. We will not charge you a fee for making a request unless your request(s) is excessive, repetitive, or manifestly unfounded. If we determine that your request warrants a fee, we will notify you of the fee and explain that decision before completing your request. 

Uses made of your information when you request assistance from EDC

When you contact EDC to request information, advice or support, for example through an enquiry, a business advisory or clinic session, or a support request on one of our portals, We will use the information you provide to:

● respond to your enquiry or request; 
● provide the advisory, mentoring, training or other support you have requested;  ● refer you, with your agreement, to a programme partner or other organisation better placed to assist you;  ● follow up with you to find out whether the assistance met your needs; and  ● keep a record of the interaction for quality assurance, programme reporting and to improve our support. 

Uses made of your information

We use the Personal Data obtained from you for the following purposes: 

● to process and assess applications and determine eligibility for our programmes; 
● to deliver and administer training, mentoring, advisory and other programme activities, including issuing certificates;  ● to communicate with you about programmes you have applied to or participate in, including start dates, reminders and changes; 
● to monitor, evaluate and report on our programmes, including reporting to funders and programme partners (see Aggregate Data below); 
● to conduct research on enterprise development and entrepreneurship;  ● to process payments, grants and reimbursements; 
● to operate, secure and improve our websites, portals and learning platforms, and to detect, prevent and address technical issues;  ● to respond to enquiries and provide support;  ● to administer employment and recruitment, where you are an EDC employee or job applicant;  ● to meet legal, regulatory, audit and funder-reporting obligations; and  ● where you have agreed, to send you updates about EDC programmes, events and opportunities. 

Marketing: if you have agreed to receive updates from us, or your details were obtained through an existing relationship with a clear opportunity to opt out, you can unsubscribe at any time using the link in any message, or by contacting us. 
We will not use your Personal Data for purposes incompatible with those described above without first informing you and, where required, obtaining your consent.
Aggregate Data We may combine and anonymise Personal Data so that it no longer identifies you, and use it to monitor and evaluate our programmes, report on outcomes to funders and programme partners, conduct research, and publish reports and insights on enterprise development. Aggregate Data is not Personal Data because it cannot be used to identify you. 
Where possible, we report in aggregated or anonymised form. Where a funder or programme partner requires individual-level information, we will tell you at the point we collect your data, or update you if this changes. 
Where a reporting group is small enough that individuals could be identified (for example, a small cohort in a single Local Government Area), We will combine or suppress those figures before sharing or publishing them.

Disclosure of your information

We may disclose your Personal Data to third parties:

● if we are under a duty to disclose or share your Personal Data in order to comply with any legal obligation, or in order to enforce or apply our terms and conditions and other agreements, but we will endeavour to minimise such disclosure to only that reasonably necessary and, where possible, to provide you with notice of such disclosure; 
● to funders, programme partners and collaborating organisations, where necessary for the delivery, monitoring, evaluation and reporting of the programme you are participating in;  ● to service providers who process Personal Data on our behalf;  ● to Pan-Atlantic University, where necessary for institutional administration, certification or audit;  ● to our professional advisers, auditors and insurers; and/or  ● to any other party with your consent or at your direction. 

Where you join a programme delivered together with a partner institution, we will tell you at the point of collection which partner will receive your Personal Data and why.
We disclose your Personal Data to service providers and other parties for the following purposes:

We disclose your Personal Data to the following categories of service providers and other parties: 

● Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity.  
● Debugging to identify and repair errors that impair the intended functionality of our websites and portals. 
● Performing services on our behalf, including website and portal hosting, cloud storage, learning management, survey and data collection, email sending, customer relationship management, payment processing and analytics. 
● Undertaking research, monitoring and evaluation of our programmes. 
● Undertaking activities to verify or maintain the quality or safety of a service or functionality that we provide.  
We disclose your Personal Data to the following categories of service providers and other parties: 

● Service providers, including: 

● Other parties at your direction, including:

The categories of Personal Data we share, and the third parties we share them with, are set out in the table under Categories of Personal Data We Collect.
When we disclose Personal Data to a service provider, we enter into a written agreement that describes the purpose and requires the recipient to process the Personal Data only on our instructions, keep it confidential, protect it with appropriate security, and not use it for any purpose except performing the contract. Where we share Personal Data with a funder or partner that acts as a Data Controller in its own right, we put a data sharing agreement in place.

Sales of Personal Data

We do not sell your Personal Data.

How we store your Personal Data

Security We take appropriate technical and organisational measures to ensure that all Personal Data is kept secure, including security measures to prevent Personal Data from being accidentally lost, or used or accessed in an unauthorised way. We limit access to your Personal Data to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality. 
We also have procedures in place to deal with any suspected Personal Data breach. We will notify you and the Nigeria Data Protection Commission (NDPC) of a Personal Data breach where We are legally required to do so. 
Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your Personal Data, we cannot guarantee the security of your data transmitted to our websites and portals; therefore, any transmission remains at your own risk. Once we have received your information, we will use strict procedures and security features in order to prevent unauthorised access.
Keeping your Personal Data up to date
Please inform us if any of your personal details change, so that our records remain accurate. You may update them through your account on the relevant EDC portal, where available, or by contacting Us at .gn.ude.uap%40opdcde

We will endeavour to update your Personal Data within thirty (30) days of any new or updated Personal Data being provided to Us, in order to ensure that the Personal Data We hold about you is as accurate and up to date as possible.
How long we keep your Personal Data
We will hold your Personal Data only for as long as necessary to fulfil the purpose for which it was collected, for example for the duration of a programme plus a reasonable follow-up period for monitoring, evaluation and funder reporting, and thereafter for as long as necessary to comply with any legal, accounting, audit or reporting obligation.

When your Personal Data is no longer required, We will securely delete or anonymise it. You may also ask Us to erase your Personal Data at any time (see Your Rights). 

Automated Decision-Making

We may use automated tools to help with tasks such as screening applications or matching participants to programmes, mentors or opportunities. If you believe an automated process has affected you unfairly, you can ask for a human review by contacting Us (see Your Rights). 

Children's Personal Data

EDC's programmes and services are generally intended for adults. We do not knowingly collect Personal Data from children outside a programme specifically designed for that purpose. Any such programme will have its own dedicated consent process, including obtaining the consent of a parent or legal guardian where required. 

Cookies and Similar Technologies

Our websites and portals use cookies and similar technologies to make them work properly and to understand how they are used. Apart from strictly necessary cookies, We only use cookies with your consent, which you can give, refuse or withdraw at any time through our cookie banner/preference section. For full details, please see our Cookie Policy (https://edc.edu.ng/edc-cookie-policy)

Third Party Websites

Our websites and portals may, from time to time, contain links to and from the websites of our programme partners, funders and affiliated organisations. If you follow a link to any of these websites, please note that these websites have their own privacy policies and terms of use and that we do not accept any responsibility or liability for these policies and terms of use. Please check these policies before you submit any Personal Data to these websites. 

How to complain

We hope that We can resolve any query or concern you raise about our use of your information. 
If you are not satisfied with how We have handled your Personal Data or your request, you can raise a formal grievance with EDC by contacting our Data Protection Officer at .gn.ude.uap%40opdcde You may also do this using a Standard Notice to Address Grievance (SNAG), the standard template provided under the GAID for requesting that an organisation address a data protection concern. 
The Nigeria Data Protection Act, 2023 (NDPA) also gives you the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) via gn.vog.cpdn%40ofni at any time where you believe an infringement of data protection laws has occurred. 

Changes to our privacy policy

We may update this Privacy Policy from time to time. Where We make a material change, We will let you know before the change takes effect, for example by a prominent notice on our website or by email where We have your contact details, and We will update the date at the end of this Policy. Your continued use of the Services and the Website shall be deemed your acceptance of the varied Privacy Policy. 

Contact

If you have any questions about this Privacy Policy, wish to exercise any of your rights, or want to report a potential data breach, please reach out to .gn.ude.uap%40opdcde Please note that EDC's Data Protection Officer (DPO) responds to any requests submitted to gn.ude.uap%40opdcde, attention EDC's DPO.

Email: gn.ude.uap%40opdcde

Address: Enterprise Development Centre, Pan-Atlantic University, Km 22, Lekki-Epe Expressway, Ajah, Lagos, Nigeria.

Enterprise Development Centre (EDC), Pan-Atlantic University
LAST UPDATED ON OCTOBER 5TH 2026