Effective date: 1 January 2025 ·
Last updated: 5 June 2026
1. Who We Are
The RMRDC Training School is an e-learning initiative of the Raw Materials Research and Development Council (RMRDC), a Federal Government agency under the Federal Ministry of Science, Technology and Innovation, located at No 17 Aguiyi Ironsi Street, Maitama, Abuja, Nigeria.
This Privacy Policy applies to the RMRDC Training School platform accessible at training.rmrdc.gov.ng and the Learning Management System at learn.rmrdc.gov.ng. RMRDC is the data controller responsible for your personal information.
We are committed to complying with the Nigeria Data Protection Regulation (NDPR) 2019, the Nigeria Data Protection Act 2023, and applicable international best practices for the protection of personal data.
2. What Information We Collect
We only collect information that is necessary to deliver our services. This includes:
Information you provide directly:
- Account registration: full name, email address, phone number, and password when you create an account.
- Profile information: any optional details you choose to add to your profile.
- Payment information: for paid courses, payment is processed by Paystack. We do not store your card details — only a transaction reference and status.
- Communications: messages you send us via the contact form or email.
Information collected automatically:
- Usage data: pages visited, courses viewed, enrollment dates, and learning progress.
- Session data: login timestamps, session tokens, and inactivity tracking for security purposes.
- Device and browser information: IP address, browser type, and operating system — used only for security and troubleshooting.
We do not collect special category data (such as health information, ethnicity, or political opinions) unless you explicitly provide it in a course context where it is directly relevant and you have consented to its collection.
3. How We Use Your Information
We use your information for the following purposes:
- Account management: creating and managing your learner account on both the portal and the LMS.
- Course delivery: enrolling you in courses, tracking your progress, and issuing certificates of completion.
- Payments: processing payments for paid courses and verifying transactions.
- Communications: sending welcome emails, password reset links, and important service notifications. We do not send unsolicited marketing emails.
- Security: detecting and preventing fraudulent access, enforcing login attempt limits, and maintaining session integrity.
- Service improvement: understanding how learners use the platform in aggregate (anonymised analytics) to improve course content and user experience.
- Legal compliance: retaining records as required by Nigerian law and NDPR obligations.
4. How We Share Your Information
Your personal information is never sold, rented, or traded to third parties for commercial purposes. We share data only in the following limited circumstances:
- Moodle LMS (learn.rmrdc.gov.ng): when you register on the portal, an account is automatically created on our Moodle instance so you can access course materials. This is a first-party system operated by RMRDC.
- Paystack: payment information is passed to Paystack (a PCI-DSS compliant payment processor) when you purchase a paid course. Paystack's own privacy policy governs their handling of that data.
- Legal requirements: we may disclose information if required by a court order, government authority, or where we believe disclosure is necessary to protect the rights or safety of users or the public.
- Service providers: limited technical vendors (e.g. our email hosting provider) who process data strictly on our behalf and under data processing agreements.
Any third party that receives your data is contractually required to handle it in accordance with NDPR and to use it only for the specified purpose.
5. How We Protect Your Information
We implement industry-standard technical and organisational measures to protect your data:
- Encryption in transit: all data exchanged between your browser and our servers is encrypted using HTTPS/TLS.
- Password hashing: passwords are stored using bcrypt, a one-way hashing algorithm. We never store or see your plain-text password.
- Login protection: we limit failed login attempts and temporarily lock accounts after repeated failures to prevent brute-force attacks.
- Session security: sessions expire after 24 hours of inactivity and session IDs are regenerated on login to prevent session fixation.
- Access control: access to personal data is restricted to authorised RMRDC staff who need it to perform their duties.
Despite these measures, no online system is completely secure. In the event of a data breach likely to result in risk to your rights and freedoms, we will notify affected users and the relevant authority within the timeframe required by NDPR.
6. How Long We Keep Your Data
We retain your personal data only for as long as necessary:
- Active accounts: retained for the duration your account remains active.
- Certificates and completion records: retained for a minimum of 7 years to support verification requests.
- Payment records: retained for 7 years to comply with Nigerian financial regulations.
- Login attempt logs: purged automatically after 24 hours.
- Password reset tokens: expire after 1 hour and are deleted after use.
- Deleted accounts: personal identifiers are removed within 30 days of an account deletion request, subject to any legal hold requirements.
7. Cookies and Tracking
We use the following types of cookies:
- Session cookie (PHPSESSID): strictly necessary — keeps you logged in while you use the platform. Expires when you close your browser or after 24 hours of inactivity.
- Moodle session cookie (MoodleSession): strictly necessary — maintains your session on the Learning Management System.
We do not currently use advertising cookies, third-party tracking pixels, or analytics cookies that identify you personally. If this changes in future, this policy will be updated and you will be notified.
The cookies we use are strictly necessary to deliver the service and cannot be disabled without preventing you from logging in or accessing your courses.
8. Your Rights Under NDPR
Under the Nigeria Data Protection Regulation 2019 and the Nigeria Data Protection Act 2023, you have the following rights regarding your personal data:
Right to Access
Request a copy of all personal data we hold about you.
Right to Rectification
Correct inaccurate or incomplete information in your profile.
Right to Erasure
Request deletion of your personal data, subject to legal obligations.
Right to Object
Object to certain types of processing of your personal data.
Right to Portability
Receive your data in a structured, machine-readable format.
Right to Restriction
Ask us to limit how we process your data in certain circumstances.
To exercise any of these rights, please contact our Data Protection Officer at the address below. We will respond within 30 days. You may also lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your rights have been violated.
9. Children's Privacy
The RMRDC Training School is intended for professional development and is designed for adults aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18.
If we become aware that we have inadvertently collected data from a minor, we will delete it immediately. If you believe a minor has registered on our platform, please contact us at [email protected].
10. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes we will:
- Update the Last updated date at the top of this page.
- Send a notification email to all registered users if the changes significantly affect how we handle their data.
Your continued use of the platform after the effective date of any update constitutes acceptance of the revised policy. We encourage you to review this page periodically.