Privacy Policy

The data controller is Phoenix University Agwada, Institution address not configured. Privacy requests should be sent to privacy@phoenixuniversity.edu.ng. General institutional enquiries may be sent to info@phoenixuniversity.edu.ng.

• Account and login data, including institution ID, email address, phone number, roles, session records, IP address, user agent, and authentication security events.
• Admissions and JAMB data, including application number, JAMB registration number, application status, screening decisions, scores, programme choices, and uploaded admission records.
• Student profile data, including names, date of birth, gender, nationality, state and local government of origin, contact details, addresses, disability status where provided, religion, marital status, occupation, languages, and identification details.
• Health, emergency, guardian, sponsor, and referee data, including blood group, genotype, allergies, medical history, health insurance details, emergency contacts, guardian details, sponsor details, and referee recommendations.
• Staff records, documents, academic records, hostel records, attendance records, course registration records, timetable records, scholarship records, payment and wallet records, notifications, audit logs, and support messages.
• Uploaded files, including passport photographs, signatures, birth certificates, indigene letters, O-Level results, UTME results, testimonials, attestation letters, academic certificates, staff documents, migration files, and batch-upload spreadsheets.
• Technical and service-provider data, including essential cookies, refresh tokens, request identifiers, file metadata, email delivery feedback, payment gateway references, and Google Workspace provisioning data when enabled.

• To create, secure, and manage applicant, student, staff, guardian, and administrator accounts.
• To process applications, verify eligibility, evaluate screening decisions, issue admission offers, migrate successful applicants to student records, and administer academic registration.
• To deliver student services such as profile onboarding, course registration, timetable access, attendance, hostel allocation, scholarships, notifications, e-filing, payment processing, receipts, and reporting.
• To protect accounts and institutional systems through authentication, authorization, audit trails, fraud prevention, payment reconciliation, incident response, and abuse detection.
• To comply with legal, regulatory, accreditation, audit, tax, financial reporting, and institutional record-keeping duties.
• To communicate important notices, account activation messages, password reset instructions, payment updates, referee requests, admission updates, and student email provisioning details.

We process personal data under the Nigeria Data Protection Act 2023 and other applicable laws. Depending on the activity, our lawful bases include performance of educational and administrative services, compliance with legal obligations, legitimate interests in securing and operating the portal, consent where required, vital interests for emergency and safety matters, and public-interest or regulatory duties.

We share personal data only where necessary for institutional operations, legal duties, or service delivery. Recipients may include authorized university staff, payment gateways, banks, AWS/S3 and email delivery providers, Google Workspace for student email provisioning when enabled, SMS or notification providers, regulators, accreditation bodies, auditors, law-enforcement bodies, and approved processors acting under contract or instruction.

The portal uses essential authentication and session cookies, including secure refresh-token cookies, to keep users signed in and protect account access. We do not use non-essential marketing or behavioral advertising cookies by default. If non-essential analytics or tracking is introduced, we will provide appropriate notice and consent controls before enabling it.

Some service providers may process data outside Nigeria, including cloud hosting, email delivery, payment infrastructure, and Google Workspace services. Where cross-border transfers occur, the university will use appropriate contractual, technical, and organizational safeguards and will assess transfer requirements under applicable Nigerian data protection rules.

• Request access to personal data held about you.
• Request correction of inaccurate or incomplete data.
• Request deletion where the data is no longer required and no legal or institutional retention duty applies.
• Request restriction of processing or object to processing where the law permits.
• Request portability of data you provided in a structured format where technically feasible and legally applicable.
• Withdraw consent where processing is based on consent, without affecting lawful processing already completed.
• Complain to the Nigeria Data Protection Commission if you believe your privacy rights have been violated.

We aim to respond to verified privacy-rights requests within 30 days. We may request identity verification and may refuse or limit a request where disclosure would affect another person’s rights, conflict with legal obligations, compromise security, or interfere with institutional records that must be retained.

We use access controls, role-based authorization, private file storage, secure cookies, audit trails, encryption controls, validation, monitoring, and administrative safeguards to protect personal data. No system is risk-free, so users should keep credentials confidential, use strong passwords, and report suspected account misuse promptly.

We may update this policy when portal features, service providers, legal obligations, or institutional practices change. Material updates will be published on this page with a new effective date.