TERTIASYNC

POLICY LIBRARY / 02

TertiaSync / Policy Library

Data
Policy.

How TertiaSync collects, uses, protects, retains, and manages personal data across its academic workspace.

Document record

Version: 1.0
Effective: November 14, 2026
Last revised: November 13, 2026
Jurisdiction: Nigeria

Privacy commitment

TertiaSync processes personal data to operate its academic services, maintain platform security, and support the student community. This Policy explains the information involved and the choices and rights available to you.

Article 01

INTRODUCTION

TertiaSync ("TertiaSync," "we," "our," or "us") respects your privacy and is committed to the responsible handling of personal data.

This Data Policy explains what personal data TertiaSync collects, how we use it, how it may be shared, how we protect it, how long it is retained, and the rights available to users under applicable data-protection law, including the Nigeria Data Protection Act 2023 (NDPA).

TertiaSync is currently designed for undergraduate students enrolled at Nigerian tertiary institutions. This Policy applies to individuals who visit or use the Platform, including registered users, contributors, student representatives, and other authorized users.

The personal data TertiaSync processes depends on the features you use and the information you choose to provide.

Where applicable law requires consent for a particular processing activity, TertiaSync will request consent through an appropriate mechanism. Where another lawful basis applies, processing may be carried out on that basis.

Article 02

DATA WE COLLECT

The information TertiaSync collects depends on how you use the Platform and the information you provide.

2.1 Account Information

When creating and managing an account, TertiaSync may collect information such as:

—Full name;

—Email address;

—Password or authentication credentials;

—Institution;

—Faculty;

—Department;

—Admission session;

—Academic level.

Certain account and academic fields are managed differently within TertiaSync:

—Name, institution, faculty, and department are not directly editable through ordinary profile editing.

—Users may submit an Information Update Request to propose changes to eligible account information.

—Academic level may be changed by the user subject to the applicable 180-day restriction.

—Academic session and current semester are derived from the institution's academic configuration and are not ordinary user-editable profile fields.

2.2 Optional Profile Information

Users may voluntarily add additional information to their profiles, including:

—Phone number;

—Matriculation number.

Phone number and matriculation number are optional and are not required to create a TertiaSync account.

TertiaSync does not represent that a matriculation number is institutionally verified merely because a user enters one into their profile.

2.3 Academic Information

Depending on the features used, TertiaSync may process information entered into academic tools, including:

—Courses and course codes;

—Grades or scores;

—Credit units;

—Semester information;

—Academic schedules;

—Examination dates;

—Academic session information; and

—Other academic information entered by the user.

This information is used to provide academic organization and calculation features, including CGPA calculations, semester planning, examination countdowns, and relevant reminders.

TertiaSync does not represent calculations generated by the Platform as official institutional academic records or results.

2.4 Contributions and Uploaded Materials

When you submit an academic contribution, TertiaSync may process:

—Uploaded files;

—Titles and descriptions;

—Course information;

—Institution, faculty, department, and level information;

—Academic session information;

—Submission dates;

—Moderation status;

—Contribution-related records; and

—Aura Points associated with approved contributions.

This information is used to review, moderate, organize, maintain, and publish approved academic resources and administer the contribution system.

Contributions may include Past Questions, Solutions or Solved Past Questions, Lecture Notes, Handouts, Summaries, Course Outlines, and Technical or Practical Guides, subject to the Contribution Rules.

2.5 Representative and Administrative Information

Where users are assigned representative or administrative responsibilities, TertiaSync may process information relating to those responsibilities, including:

—Assigned roles, such as class representative, assistant class representative, or course representative;

—The institution, faculty, department, level, or course associated with the role;

—Role assignment and removal records;

—Announcements and academic updates created or published;

—Timetables and other representative publications;

—Actions performed through representative or administrative functionality; and

—Relevant moderation and accountability records.

This information is used to administer authorized Platform permissions, support academic communication, maintain representative functionality, and protect the integrity of the Platform.

Representative permissions are governed by the Platform's access-control arrangements. Having a representative role does not give a user unrestricted access to other users' personal information.

2.6 Request Information Updates

If you submit an Information Update Request, TertiaSync may process:

—The account information you want changed;

—The proposed replacement information;

—Your reason for requesting the change;

—The date the request was submitted;

—The request's review status;

—The decision and outcome; and

—Relevant administrative review records.

This information is used to review requests, prevent unauthorized account changes, maintain accurate account information, and preserve appropriate accountability.

Academic session and current semester are derived from institutional academic configuration and are not ordinary fields for this change-request process.

2.7 Communications, Feedback, and Support

If you contact TertiaSync through email, feedback forms, support channels, reports, or other communication methods, we may process:

—Your name or account identifier, where available;

—Your email address or other contact information;

—The content of your message;

—Screenshots or attachments you submit;

—The date and time of communication; and

—Relevant technical information needed to investigate the matter.

This information may be used to respond to you, provide support, investigate reports, handle complaints, resolve technical issues, and address account or security matters.

Where feedback continues to serve a legitimate operational purpose after an account is deleted, TertiaSync may retain the relevant feedback in anonymized or de-identified form where reasonably appropriate. Information that no longer has a continuing purpose will be handled in accordance with the applicable retention and deletion requirements.

2.8 Technical and Usage Information

TertiaSync may process technical or usage information necessary to operate, maintain, and secure the Platform, including, where available:

—IP address;

—Browser information;

—Device information;

—Operating system;

—Timestamps;

—Pages or features accessed;

—Error information;

—Session and authentication information; and

—Security-related events.

This information may be used for:

—Platform security;

—Abuse and fraud prevention;

—Troubleshooting;

—Performance and reliability;

—Maintaining Platform functionality; and

—Understanding general Platform usage.

2.9 Payment and Transaction Information

The November 14, 2026 MVP does not offer Premium subscriptions or paid user plans.

Where advertising or other payment functionality is made available, TertiaSync may process relevant transaction information, such as:

—Advertiser or payer contact information;

—Transaction references;

—Payment status;

—Amount paid;

—Payment date; and

—Campaign or service details associated with the transaction.

Where an external payment provider processes a transaction, that provider may separately process payment information under its own privacy and security arrangements.

TertiaSync does not intend to store complete payment card details.

2.10 Advertising Information

Because advertising forms part of the TertiaSync MVP, the Platform may process limited information relating to the display and interaction with advertisements, where such functionality is implemented.

This may include:

—Advertisement display records;

—Impressions;

—Clicks;

—Campaign information; and

—Relevant technical information associated with advertisement delivery.

TertiaSync does not provide advertisers with users' private account information merely because an advertisement is displayed or clicked.

Any additional advertising-related data processing will be subject to applicable law and appropriate notice or consent where required.

Article 03

PASSWORDS AND AUTHENTICATION

TertiaSync uses an authentication service to support account registration, login, password management, and account security.

TertiaSync does not intentionally store user passwords in plain text in its application database.

Authentication credentials are handled through the authentication infrastructure and its applicable credential-protection mechanisms.

Authentication-related information may be processed to:

—Verify account access;

—Maintain login sessions;

—Support password recovery;

—Detect suspicious access;

—Protect accounts; and

—Investigate authentication-related security incidents.

Users are responsible for protecting their account credentials and should not share their passwords with others.

If you believe your account has been accessed without authorization, you should contact TertiaSync through the designated support channel.

Article 04

HOW WE USE PERSONAL DATA

Depending on the circumstances, TertiaSync may process personal data to:

—Create, manage, and authenticate user accounts;

—Provide and operate the Platform;

—Personalize academic resources and features;

—Organize resources according to institution, faculty, department, curriculum, level, course, or academic session;

—Provide CGPA and academic organization tools;

—Support semester planning and examination countdown functionality;

—Operate the Past Questions Archive and contribution system;

—Review, approve, reject, organize, or remove submitted materials;

—Administer Aura Points;

—Operate Department Pulse and relevant academic communication features;

—Support announcements, timetables, and authorized representative functions;

—Review Information Update Requests;

—Respond to feedback, complaints, reports, and support requests;

—Deliver relevant account and Platform communications;

—Display and administer advertisements;

—Process relevant advertising or other permitted transactions;

—Maintain Platform security and integrity;

—Detect and prevent fraud, abuse, unauthorized access, or policy violations;

—Investigate security incidents and complaints;

—Comply with applicable legal obligations;

—Establish, exercise, or defend legal claims; and

—Maintain, secure, troubleshoot, and improve the Platform.

Depending on the processing activity, TertiaSync may rely on an applicable lawful basis, including:

Performance of a contract

Where processing is necessary to provide the Platform or perform obligations associated with your use of it.

Legitimate interests

Where processing is necessary for legitimate operational interests, such as maintaining security, preventing abuse, administering the contribution system, and improving Platform reliability, provided those interests are not overridden by applicable rights and protections.

Legal obligations

Where processing is necessary to comply with applicable laws or lawful requests.

Consent

Where consent is required or relied upon for a particular activity.

Where processing is based on consent, you may withdraw that consent, subject to applicable legal limitations. Withdrawal does not affect processing lawfully carried out before the withdrawal.

TertiaSync will not intentionally process personal data for purposes incompatible with the purpose for which it was collected without an appropriate legal basis or notice where required.

Article 05

THIRD-PARTY SERVICE PROVIDERS AND DATA SHARING

TertiaSync does not sell or rent users' personal data to advertisers or data brokers.

TertiaSync may use third-party service providers and infrastructure providers necessary to operate the Platform.

These providers may process personal data on TertiaSync's behalf or as independent service providers, depending on the service and their respective responsibilities.

Supabase

TertiaSync uses Supabase for backend infrastructure, including database services, authentication, storage, and related backend functionality. Information processed through Supabase may include account information, academic information, uploaded materials, and other information required to operate the Platform.

Vercel

TertiaSync uses Vercel for Platform hosting and deployment infrastructure. Technical information may be processed through this infrastructure to deliver, maintain, and secure the Platform.

Other Infrastructure and Technology Providers

TertiaSync may use additional third-party providers for services such as email delivery, domain registration, security, monitoring, storage, or other technical functionality where those services are actually implemented. TertiaSync will not identify a provider as an active data processor merely because it may be considered for future use.

Advertisers and External Destinations

Advertisers may provide advertisements, promotional materials, and links to external websites, applications, or services. TertiaSync does not automatically share private user account information with advertisers merely to display their advertisements. If you interact with an external website, application, or service through an advertisement or other Platform link, that external service may collect information directly from you under its own privacy policy and terms. TertiaSync is not responsible for the independent data-processing practices of external services.

Where third parties process personal data on TertiaSync's behalf, TertiaSync will take appropriate steps to establish relevant safeguards as required by applicable law.

Legal and Regulatory Disclosures

TertiaSync may disclose personal data where reasonably necessary to:

—Comply with applicable law;

—Respond to valid legal processes or lawful requests;

—Protect the rights, safety, or property of TertiaSync, its users, or others;

—Investigate suspected fraud, abuse, or security incidents; or

—Establish, exercise, or defend legal claims.

TertiaSync will limit such disclosures to what is reasonably necessary and legally permitted.

Article 06

ACCESS CONTROLS AND DATA SECURITY

TertiaSync uses reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, disclosure, or destruction.

These measures may include:

—Authentication and credential-protection mechanisms;

—Encryption during transmission where supported by the relevant infrastructure;

—Database access controls;

—Row Level Security (RLS), where implemented and configured;

—Role-Based Access Control (RBAC);

—Restricted administrative access;

—Security monitoring and controls; and

—Appropriate maintenance and security practices.

TertiaSync uses role-based permissions to restrict access to administrative and representative functionality according to authorized responsibilities.

For example, class representatives and assistant class representatives may have certain announcement-related permissions, while course representatives may have permissions limited to their assigned course scope.

These permissions do not grant unrestricted access to user accounts or personal information.

Access to personal data is intended to be limited to authorized individuals and systems that require it for legitimate Platform operations.

No online service can guarantee absolute security. Users are also responsible for taking reasonable steps to protect their accounts, devices, and login credentials.

Article 07

DATA RETENTION

TertiaSync aims to retain personal data only for as long as reasonably necessary for the purposes for which it was collected, subject to applicable legal, security, operational, and accountability requirements.

Retention periods may differ depending on the type of information, the purpose of processing, and whether a legitimate reason exists to retain it.

Account and Profile Data

Personal data associated with a user's account, including optional profile information such as phone number and matriculation number, will generally be deleted when the user deletes their account, subject to limited technical, legal, security, or other circumstances where retention is required or reasonably necessary.

Academic Information

Academic information entered into personal academic tools, such as courses, CGPA records, schedules, and examination dates, will generally be deleted with the user's account, subject to applicable technical or legal limitations.

Contribution Records and Uploaded Materials

Personal information and records associated with contributions will be handled in accordance with the Contribution Rules and applicable account-deletion procedures. Where a user deletes their account, their personal archive contributions will be handled in accordance with the Contribution Rules, including deletion where required under those Rules. TertiaSync may retain limited moderation, security, or accountability records where reasonably necessary for legitimate operational or legal purposes.

Representative Publications

Announcements, timetables, and other academic publications created by an authorized representative in the course of their representative responsibilities may remain available after the representative's role ends or their account is deleted. Such publications may remain because they serve an academic community purpose independent of the personal account of the individual who created them. Where appropriate, personal attribution or identifying information associated with the former representative will be removed or anonymized. TertiaSync may remove or amend such publications where required by law, where they are inaccurate or outdated, where they violate Platform policies, or where removal is otherwise appropriate.

Feedback and Support Records

Feedback and support records may be retained while they serve a legitimate operational purpose, such as resolving technical issues, investigating recurring problems, or improving Platform functionality. Where continued retention is appropriate after account deletion, TertiaSync may anonymize or de-identify the relevant information. Information that no longer serves a legitimate purpose will be handled in accordance with applicable deletion requirements.

Account Change and Administrative Records

Records of Information Update Requests, representative role assignments, administrative actions, and relevant moderation decisions may be retained for as long as reasonably necessary to maintain account integrity, prevent abuse, resolve disputes, and support legitimate accountability requirements.

Technical Records and Backups

Technical logs, security records, and backups may remain for limited periods based on operational, security, and recovery requirements. Where information remains in backups or technical records after a deletion request, it may persist until the relevant retention or backup cycle permits its removal, subject to applicable law.

Article 08

ACCOUNT DELETION

Users may request deletion of their TertiaSync accounts through the available account settings or designated support channel.

When an account is deleted, TertiaSync will delete personal data associated with that account in accordance with this Policy, the Contribution Rules, and applicable law.

Account deletion may affect access to the Platform and the academic information stored in the account.

The following distinctions apply:

Personal account information

Personal account and profile information will be deleted, subject to limited lawful or legitimate retention exceptions.

Personal academic information

Information entered into personal academic tools will generally be deleted with the account, subject to applicable technical or legal limitations.

Archive contributions

Contributions associated with the deleted account will be handled in accordance with the Contribution Rules. Personal archive contributions are subject to deletion as provided under those Rules.

Representative publications

Announcements, timetables, and other academic publications created in an official representative capacity may remain available where they continue to serve the academic community. Personal attribution will be removed or anonymized where appropriate.

Feedback and support records

Feedback may be retained in anonymized or de-identified form where it continues to serve a legitimate operational purpose. Other account-identifiable feedback will be handled according to applicable retention requirements.

Aura Points

Aura Points associated with a deleted account will be removed and will not be treated as a transferable monetary balance.

TertiaSync may retain limited information where necessary for legal compliance, security, fraud prevention, dispute resolution, enforcement of rights, or protection of the Platform and its users.

Deleting a TertiaSync account does not automatically remove copies of information that may remain on a user's own device, in browser storage, or in other independent services outside TertiaSync's control.

Article 09

COOKIES, LOCAL STORAGE AND SIMILAR TECHNOLOGIES

TertiaSync may use cookies, local storage, IndexedDB, service workers, cache storage, and similar technologies to support Platform functionality.

These technologies may be used for the following purposes:

Authentication and Sessions

Maintaining login sessions, supporting authentication, and helping protect accounts.

Preferences and Application Settings

Remembering relevant settings and preferences to improve the user experience.

Progressive Web App Functionality

Supporting the Platform's Progressive Web App (PWA) functionality, including caching certain application resources and information to improve loading and support applicable offline functionality.

Temporary and Locally Stored Application Data

TertiaSync may store certain application data locally on a user's device, including cached resources, previously accessed academic materials, and other temporary application information where supported by the relevant feature. Some locally stored information may remain on a device even after a user deletes their TertiaSync account.

Feedback and Pending Operations

Where supported by the application, certain information may be temporarily stored locally to support pending operations, such as feedback submissions awaiting transmission.

Security and Performance

Certain technologies may support application security, troubleshooting, reliability, and performance.

The specific technologies and retention periods may change as TertiaSync develops.

Users may manage or delete cookies and locally stored application data through their browser or device settings. Disabling or deleting certain technologies may affect login sessions, cached information, offline functionality, or other Platform features.

Deleting local application data does not necessarily delete information stored on TertiaSync's servers. Similarly, deleting a server-side account does not automatically guarantee that all locally cached information has been erased from the user's device.

Where non-essential tracking technologies are introduced, TertiaSync will provide appropriate information and obtain consent where required by applicable law.

Article 10

YOUR DATA PROTECTION RIGHTS

Subject to applicable law and relevant limitations, users may have rights concerning their personal data, including:

Right to Be Informed

The right to receive information about how personal data is collected and processed.

Right of Access

The right to request information about personal data TertiaSync processes about you and, where applicable, obtain a copy.

Right to Rectification

The right to request correction of inaccurate or incomplete personal data.

Right to Erasure

The right to request deletion of personal data in appropriate circumstances.

Right to Restriction

The right to request restriction of certain processing where applicable.

Right to Data Portability

The right to request personal data in a portable format where applicable.

Right to Object

The right to object to certain forms of personal data processing where applicable.

Right to Withdraw Consent

Where processing is based on consent, the right to withdraw that consent, subject to applicable limitations.

Rights Relating to Automated Decisions

Where applicable, users may have rights concerning decisions based solely on automated processing that produce legal or similarly significant effects.

Exercising a data-protection right does not necessarily require TertiaSync to remove every record or publication associated with a user.

For example, representative-created announcements and timetables may be retained separately from the former representative's personal account information where there is a lawful basis and legitimate academic purpose for doing so.

Similarly, the deletion of personal archive contributions will be handled in accordance with the Contribution Rules and applicable law.

How to Exercise Your Rights

To exercise a data-protection right, submit a request through:

Email correspondence

tertiasync.support@gmail.com

Please describe the nature of your request and provide sufficient information for TertiaSync to identify the relevant account or personal data.

TertiaSync may reasonably verify the identity of a requester before processing a request to protect personal data against unauthorized disclosure or alteration. Requests will be handled within the period required by applicable law.

Where a request cannot be fully granted, TertiaSync may explain the applicable legal or operational reason, subject to relevant legal requirements.

Users may also have the right to lodge a complaint with the Nigeria Data Protection Commission or another competent authority where applicable.

Article 11

AGE AND ELIGIBILITY

TertiaSync is currently designed for undergraduate students enrolled at Nigerian tertiary institutions.

The Platform is not designed as a general-purpose service for children.

TertiaSync does not intentionally seek to collect personal data from individuals who are not eligible to use the Platform.

Where TertiaSync becomes aware that an ineligible individual has created an account or provided personal data in circumstances that require action, appropriate steps may be taken in accordance with applicable law and the Terms of Use.

Where personal data relating to a child is processed, TertiaSync will apply the safeguards and consent requirements required by applicable data-protection law.

Article 12

INTERNATIONAL DATA PROCESSING

Some third-party infrastructure or technology providers used by TertiaSync may process or store information outside Nigeria.

Where personal data is transferred or made accessible outside Nigeria, TertiaSync will take appropriate steps required by applicable Nigerian data-protection law.

Such steps may include assessing the relevant transfer arrangements and ensuring that appropriate safeguards or other lawful transfer mechanisms are in place where required.

The location of third-party infrastructure may change as TertiaSync develops.

Article 13

DATA BREACHES AND SECURITY INCIDENTS

TertiaSync takes reasonable steps to prevent, identify, investigate, and respond to personal-data breaches and other security incidents.

If TertiaSync becomes aware of a personal-data breach or security incident, appropriate steps may include:

—Investigating the nature and scope of the incident;

—Taking steps to contain or mitigate its effects;

—Assessing the personal data and individuals potentially affected;

—Documenting relevant details of the incident;

—Implementing appropriate corrective measures; and

—Reviewing security practices to reduce the likelihood of recurrence.

Where notification to the Nigeria Data Protection Commission, affected users, or another appropriate authority is legally required, TertiaSync will provide such notification in accordance with applicable requirements.

Article 14

CHANGES TO THIS POLICY

TertiaSync may update this Data Policy when necessary to reflect changes to:

—The Platform and its features;

—Data-processing practices;

—Third-party service providers;

—Technology and infrastructure;

—Security measures;

—Legal or regulatory requirements; or

—Other relevant circumstances.

Material changes may be communicated through the Platform or another appropriate channel.

The Last Updated date will be changed when this Policy is revised.

Users are encouraged to review this Policy periodically to remain informed about how TertiaSync handles personal data.

Article 15

CONTACT AND PRIVACY REQUESTS

For privacy questions, data-protection requests, complaints, or concerns, contact:

Correspondence