1. Introduction

Atlas is a Govtech Africa platform for conducting, managing, validating and publishing institutional assessments. Govtech Africa Limited ("Govtech Africa", "we", "us" or "our") respects the privacy of individuals whose personal data is processed through the Atlas website and platform.

This Notice explains how personal data may be collected, used, stored, disclosed and protected when you visit Atlas, submit an enquiry, register to participate in an assessment, use an Atlas account, participate as an assessor, validator, panel member or programme administrator, or otherwise interact with an assessment conducted through Atlas.

This Notice is intended to support compliance with the Nigeria Data Protection Act 2023 ("NDP Act"), the Nigeria Data Protection Act - General Application and Implementation Directive 2025 ("GAID"), applicable guidance issued by the Nigeria Data Protection Commission ("NDPC"), and other applicable data protection laws. It supplements Govtech Africa's general corporate privacy policy.

2. Who Is Responsible for Your Personal Data?

2.1 Processing controlled by Govtech Africa

Govtech Africa generally acts as a data controller in relation to personal data for which it determines the purposes and means of processing, including:

• enquiries submitted directly to Govtech Africa about Atlas;
• operation and security of the Atlas website;
• platform administration and technical support;
• fraud, abuse and cybersecurity monitoring;
• maintenance of Govtech Africa's business and compliance records; and
• communications concerning Govtech Africa's relationship with prospective or existing programme owners.

2.2 Programme-specific processing

An institution that commissions or operates an assessment through Atlas will generally determine the assessment purpose, methodology, participation rules, evidence requirements, authorised assessors or validators, publication rules, lawful basis and retention requirements. That institution is referred to in this Notice as the "Programme Controller".

For such programme processing, Govtech Africa will ordinarily act as a data processor, providing the Atlas technology and processing personal data on the documented instructions of the Programme Controller. A Programme Controller may issue an additional programme-specific privacy notice.

3. Personal Data We May Process

3.1 Identity and contact data

• full name;
• work email address;
• telephone number;
• organisation, ministry, department, agency or institution;
• job title;
• department or unit; and
• professional role.

3.2 Registration and participation data

• the programme you wish to participate in;
• proposed programme role;
• information submitted to support or explain your registration;
• approval, rejection or participation status;
• assignments allocated to you; and
• communications regarding your participation.

3.3 Account and authentication data

• username or email identifier;
• protected authentication credentials;
• account status;
• access permissions;
• authentication and session information; and
• records concerning account creation, suspension, deactivation or role changes.

4. Assessment and Professional Activity Data

Where you participate in an assessment, Atlas may process information concerning your professional activities within that assessment, including:

• assessment assignments;
• scores submitted;
• written reasons or justifications;
• evidence reviewed;
• validation actions;
• reconciliations;
• panel activities;
• endorsements;
• appeal-related actions;
• approvals;
• gate or process sign-offs;
• timestamps; and
• audit records showing actions carried out through the platform.

5. Evidence and Uploaded Information

Atlas may process evidence used to support institutional assessments, including submitted returns, reports and documents, inspection records, website or system observations, screenshots, automated assessment results, supporting documents, institutional correspondence, appeal materials and other evidence permitted under the applicable assessment methodology.

Evidence should not contain personal data that is unnecessary for the assessment. Sensitive personal data should not be submitted unless its processing is specifically authorised, necessary, proportionate and supported by an appropriate lawful basis and safeguards.

6. Enquiry Data

Where you contact Govtech Africa about Atlas, we may collect your name, work email address, organisation, role, website, programme or assessment interests and the contents of your enquiry. Information submitted through a general Atlas enquiry form will be used to respond to and manage the enquiry and will not be added to an unrelated marketing list without an appropriate lawful basis.

7. Technical and Security Data

• IP address;
• browser type;
• device and operating-system information;
• login timestamps;
• session information;
• request logs;
• security events;
• error logs; and
• information reasonably necessary to detect abuse, unauthorised access or cyber threats.

8. Why We Process Personal Data

• operate and secure Atlas;
• respond to enquiries;
• register and authenticate authorised users;
• administer assessment programmes;
• allocate assessment roles and assignments;
• collect and preserve assessment evidence;
• permit assessors to make and explain assessments;
• permit independent validation and reconciliation;
• manage institutional review and appeals;
• maintain accountability and audit trails;
• publish approved assessment results where applicable;
• provide technical support;
• investigate security incidents or misuse;
• comply with legal and regulatory obligations;
• establish, exercise or defend legal claims; and
• improve the reliability, security and performance of the platform.

9. Lawful Bases for Processing

Where Govtech Africa acts as controller, the lawful basis depends on the processing concerned. Govtech Africa may rely on:

• steps taken at your request before entering into a contract or performance of a contract, where applicable;
• legitimate interests, including responding to professional enquiries, operating and securing Atlas, preventing fraud and maintaining reliable platform records, provided those interests do not override the rights and interests of data subjects;
• legal obligation, where processing is required by applicable law;
• public interest, where Govtech Africa is itself authorised to undertake relevant public-interest processing; and
• consent, where the law requires consent or where consent is otherwise the appropriate basis.

Where Govtech Africa acts as processor, the Programme Controller is responsible for determining and documenting the appropriate lawful basis for programme processing.

10. Public Attribution of Assessment Activities

Atlas is designed to provide traceability and accountability for institutional assessments. Depending on the methodology and publication rules established by the Programme Controller, an assessor's or validator's name, professional role, authorship of a score, assessment justification, validation role or participation in an assessment decision may form part of the assessment record and may be displayed to authorised programme participants or, where expressly provided by the applicable methodology, published as part of the public assessment record.

Individuals participating in a programme must be informed of the applicable attribution and publication arrangements before their participation begins. Govtech Africa will not use an assessor's personal data for unrelated publicity or marketing merely because the individual participated in an assessment.

11. Automated Processing

Atlas may use automated tools to collect or evaluate objective evidence and may generate proposed measurements, findings or score levels. Where human judgement is required, such automated outputs are intended to assist rather than replace the authorised assessor or decision-maker.

Atlas does not intend to subject individuals to decisions based solely on automated processing that produce legal or similarly significant effects unless such processing has been specifically assessed, lawfully authorised and accompanied by the safeguards required by applicable law.

12. Who May Receive Personal Data?

• the relevant Programme Controller;
• authorised programme administrators;
• assessors, validators and panel members where required by their roles;
• authorised Govtech Africa personnel;
• hosting, infrastructure and technology providers;
• security and support providers;
• professional advisers;
• auditors;
• regulators and supervisory authorities;
• courts or law-enforcement bodies where legally required; and
• other persons authorised by the Programme Controller or applicable law.

Access will be limited according to role and legitimate need. Govtech Africa does not sell personal data.

13. Programme Isolation and Access Control

Atlas is designed so that access to programme data is restricted according to programme membership and assigned roles. Access permissions are intended to prevent users of one programme from accessing the confidential records of another programme. Govtech Africa applies technical and organisational measures appropriate to the nature and risks of the processing.

14. International Transfers and Hosting

Atlas may be hosted in Nigeria or in another location agreed with the relevant Programme Controller. Where personal data is transferred from Nigeria to another country or made accessible from another country, the transfer must be supported by a lawful transfer basis and appropriate safeguards under the NDP Act. Where a Programme Controller requires in-country hosting, the relevant deployment arrangements may provide for such hosting.

15. Data Retention

Personal data is retained only for as long as necessary for the purpose for which it was collected and for applicable contractual, security, audit, regulatory, public-record and legal requirements.

For processing controlled directly by Govtech Africa, the following default periods apply unless a longer period is reasonably required by law, investigation or legal proceedings:

• general Atlas enquiries: up to 12 months after the enquiry is closed;
• unsuccessful or withdrawn participant registrations: up to 12 months after the relevant decision or withdrawal;
• Govtech-controlled account and administrative information: up to 24 months after account deactivation; and
• routine security and access logs: ordinarily up to 24 months, unless a longer period is necessary for investigation or legal purposes.

Programme-controlled assessment records, evidence, scoring records and audit trails will be retained according to the retention instructions of the relevant Programme Controller and applicable public-record, audit or legal requirements. Published assessment records may be retained for an extended period where continuing availability is necessary for accountability, transparency, public-interest archiving, legal claims or other lawful purposes.

16. Security

Govtech Africa implements appropriate technical and organisational measures designed to protect personal data against unauthorised access, unlawful disclosure, alteration, accidental loss, misuse, destruction and other personal data breaches. Measures may include authentication controls, role-based access controls, protected credentials, encryption where appropriate, audit logging, system monitoring, backups, secure configuration, vulnerability management and incident-response procedures.

No internet-connected platform can be guaranteed to be completely secure.

17. Your Data Protection Rights

Subject to applicable legal conditions and exemptions, you may have the right to:

• be informed about processing of your personal data;
• request access to your personal data;
• request correction of inaccurate or incomplete information;
• request deletion where applicable;
• request restriction of processing;
• object to certain processing;
• withdraw consent where processing is based on consent;
• request portability where applicable;
• object to or challenge qualifying automated decision-making; and
• lodge a complaint with the Nigeria Data Protection Commission.

Where the relevant information is controlled by a Programme Controller, Govtech Africa may refer your request to that institution or assist the institution in responding. Some rights, including erasure, may lawfully be restricted where information must be retained for public-interest, statutory-record, legal-claim, freedom-of-information, audit, accountability or other lawful purposes.

18. Personal Data Breaches

Govtech Africa maintains procedures for detecting, investigating, containing and responding to personal data breaches. Where Govtech Africa acts as processor, relevant breaches will be communicated to the Programme Controller in accordance with contractual and legal requirements. Where Govtech Africa acts as controller, it will make any notification to the NDPC or affected data subjects required by applicable law.

19. Children

Atlas is intended for professional and institutional use and is not directed at children. Personal data relating to children should not be uploaded to Atlas unless such processing is specifically required for a lawful assessment purpose and appropriate legal bases, safeguards and data-protection assessments have been completed.

20. Data Protection Officer

Data Protection Officer: Fortune Ikenna Awuzie
Email: [email protected]
Telephone: +234 913 916 7076
Product: Atlas

Where your request concerns a particular assessment programme, please identify the programme concerned.

21. Complaints

If you believe your personal data has been processed unlawfully or unfairly, you may first contact the Govtech Africa Data Protection Officer or, where appropriate, the relevant Programme Controller. You also have the right to lodge a complaint with the Nigeria Data Protection Commission.

22. Changes to This Notice

We may update this Notice where Atlas functionality, processing practices, technology, contractual arrangements or applicable law changes. The latest version will display its effective or last-updated date. Material changes affecting how personal data is processed will be communicated through an appropriate channel where required.