Privacy Policy

General

At Sierra Africa Limited, we are committed to safeguarding your privacy and protecting your personal data. This Privacy Policy explains how Sierra Africa Limited ("Sierra Africa," "we," "us," or "our"), a company registered in Nigeria with its office at 8 Levante Estate, Adesham Street, Bogije, Lagos State, Nigeria, collects, uses, processes, and shares your personal data when you use our websites, mobile applications, and related services (collectively, the "Service").

We process personal data in accordance with the Nigeria Data Protection Act 2023 (the "NDPA") and the subsidiary Nigeria Data Protection Regulation 2019 ("NDPR"), under the supervision of the Nigeria Data Protection Commission ("NDPC"). Where you are in the European Economic Area or the United Kingdom, we also process your data in accordance with the EU General Data Protection Regulation and the UK GDPR; see the section If You Are in the EEA or the UK below.

Schools and Institutional Tenants

Whollify can be used in two ways, and which one applies to you changes who is responsible for your personal data.

• Your school runs its own Whollify workspace. If you were given a Whollify account by a university, polytechnic, secondary school, bootcamp or other institution, that institution is the data controller for your academic data and Sierra Africa acts as its data processor. The school decides what is collected, which staff hold which roles, how long records are kept, and what becomes part of your official record. We process that data on the school's documented instructions in order to provide the Service, and not for our own purposes.
• You signed up yourself. Where you created your own account rather than being given one by an institution (including as a member of Whollify School, the community Sierra Africa runs for independent learners), Sierra Africa is the data controller and this Policy governs directly.

Where a school is the controller, some requests have to go through it rather than through us. If you ask us to correct or delete an academic record held in your school's tenant, we will refer you to the school, because a school is required to keep records we are not entitled to alter on our own initiative. Requests about your account itself (your login, your contact details, your device sessions) you can always make to us directly. Where we receive a request that belongs to a school, we will tell you so within 1 business day and pass it on, rather than leaving it unanswered.

Each school's tenant is logically separated from every other school's. Staff at one institution cannot see students, records or messages belonging to another. We do not combine data across tenants to build profiles, and we do not use one school's data to provide the Service to another.

Institutions are responsible for establishing a lawful basis for the data they enter or import, for informing their students and staff about how the institution uses the platform, and, where their students include children, for obtaining any consent the law requires before those students are enrolled. See Children and Young People below.

Institutions considering Whollify should raise data protection terms, retention periods and export formats with us before signing, at hello@whollify.com. Those are agreed per institution and are not set by this Policy. A data processing agreement is available on request.

Information We Collect

We collect several types of information for various purposes to provide and improve our Service to you. The types of data we collect include:

Personal Data

While using our Service, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you ("Personal Data"). This may include, but is not limited to:

• Email address
• First name and last name
• Date of birth, which we ask for to confirm your age
• For users under 18, a parent or guardian's name, email address and their consent decision
• Phone number
• Address, State, Province, ZIP/Postal code, City
• Cookies and Usage Data
• Profile information (e.g., display name, profile picture)

Academic and Platform Data

Whollify is one platform for learning, teaching, writing, research and communication. Depending on which features are available to you, what you use, and what role you hold, we process:

• Coursework submissions: documents, files, links, images, recordings, datasets, drawings, code and code repositories you submit, and quiz answers
• Assessment records for activities that are assessed, which may include instructor marks, rubric scores, peer evaluation records (who evaluated whom, when, against which rubric, the scores given and received, evaluator comments, and the rating you give your evaluator in return), runner results, AI-assisted marking proposals, accepted assessment results, gradebook entries and certificates issued to you
• Assessment inputs and outputs, including where runner results, AI-assisted marking and peer correction diverged and the work was referred to another corrector or member of staff
• Courses you take or create: enrolment, progress, notes, highlights, questions, reviews, and purchases
• Attendance registers for classes, live lessons and meetings, including check-in and check-out times and, where a school uses self check-in, the network address and any location you enter
• Pages, databases, forms, whiteboards and comments you create, including pages you choose to publish and how often a published page is viewed
• Messages, spaces, channels, threads, reactions, mentions, attachments, voice messages and read state, and the participation record of calls you join
• Forum posts and the reputation record that determines earned permissions
• Calendar entries, booking pages, scheduled sessions, availability and to-dos
• Conversations with the AI assistant, any memory you allow it to keep, and agents you set up
• Enrolment and application data, where an institution admitted or enrolled you through Whollify
• Academic records: academic periods, results and transcripts, together with the audit trail behind each entry
• Directory records, which may include people who do not hold Whollify logins (guardians, employers, sponsors, emergency contacts and external evaluators), where a school has entered or imported them, and any additional fields a school chooses to record
• Fees, invoices and payment status, where a school bills its own students through Whollify
• Device tokens for push notifications, and your notification and display preferences

Usage Data

We may also collect information on how the Service is accessed and used ("Usage Data"). This Usage Data may include information such as your computer's Internet Protocol address (e.g., IP address), browser type, browser version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers, and other diagnostic data.

Coursework Submissions

Whollify is subject-agnostic, and what counts as a submission depends on the activity. You may hand in a written document, a file, an external link, an image, an audio or video recording, a dataset, or a code repository. We store what you submit, together with when you submitted it and any revisions, so that it can be assessed and so that it forms part of your record.

Your submission is private to you, to anyone you explicitly share it with, to the staff of your institution in accordance with its policies, and, where the activity is assessed that way, to the person evaluating it or to the runner and AI-assisted marking services used by that activity. It is not public and it is not shared with other learners unless you share it or take part in a configured peer-correction workflow.

Where a submission is a code repository, it may be hosted on Whollify's own infrastructure or on a third-party service such as GitHub. You do not share external Git hosting credentials with us. Where a third-party provider hosts it, that provider's own privacy policy additionally governs the data on their infrastructure, and deleting your Whollify account does not delete a repository held there.

Assessment and AI-Assisted Marking

Activities can be assessed by an instructor, by peers, by deterministic software, through an AI-assisted workflow, or by a configured combination of these methods. The activity's creator or institution chooses the method and the product shows the method used.

• Runners. For work with executable components, we run it in an isolated execution environment. The outputs, test results and runtime behaviour are collected and may produce a deterministic test result.
• AI-assisted marking. We may pass your submission, or the results of executing it, to a language model that reads it against the activity's rubric. It returns a proposed score, confidence information and written notes. In the general marking workflow this is a suggestion that a person must accept or change. A lab may instead use it as one input in a configured result alongside tests, peer correction or teacher review.

Assessment inputs and outputs, including your submission, execution results, proposed or accepted scores, confidence information and notes, may be stored against your submission. Where configured results disagree, the workflow may flag the submission for another corrector or an authorised member of staff.

Only a result accepted or resolved under the activity's configured assessment workflow forms part of your result record. Aggregated and anonymised assessment data may be used to improve accuracy and fairness. We do not use individual assessment data to train publicly available AI models.

Automated Decisions and Human Review

Some activities use deterministic tests or a configured assessment workflow before a person reviews the result. AI suggestions in the general marking workflow do not become a result until a person accepts or changes them. Where an institution configures software to publish or use an assessment result without prior human review, we treat that as an automated decision and provide the safeguards below.

You have the right to ask that a human being review any automated decision that affects you. In practice that means:

• You can contest the outcome. Raise a dispute within 7 days of the grade appearing in your account, using the process in the Terms of Service under "Grading Disputes." A member of staff, not a model, reviews it.
• You can ask how the decision was reached. We will tell you what inputs the assessment ran against (which repository, which commit, which rubric), what the model returned, and what confidence it reported.
• You can ask for it to be re-run. Where a technical fault is the cause (the wrong commit, a failed runner, a truncated submission), we re-grade rather than ask you to appeal a result we already know is wrong.

Where your school is the controller, your school decides what an automated score means for your official record, and a human review by us goes to the school's staff rather than overriding their academic judgement. We do not use automated decision-making to profile you for advertising, and we do not make solely automated decisions about you on the basis of special categories of personal data.

Peer Evaluation Sessions

Peer evaluation is one assessment mode among several, and it is optional. An institution switches it on or off like any other feature, and an individual is never required to use it. This section applies only where an activity you take part in is assessed this way. If it is not, nothing here describes data we hold about you.

Where it is used, a peer evaluation is a live session in which another Whollify user opens your submission, examines your work, asks you questions, and scores it against the rubric the activity was set with. Sessions take place in video rooms Whollify operates. You may evaluate work of a kind you have passed yourself.

What is retained from a session is:

• The rubric scoring and the evaluator's written comments.
• The participation record: who evaluated whom, when the session started and ended, and whether both parties attended.
• The rating you give your evaluator in return, which feeds evaluator quality checks.

We do not currently record the audio or video of evaluation sessions. The live stream is not captured, stored or reviewed by us. If we introduce recording, we will update this Policy and notify affected users before the feature is switched on, and sessions will carry an in-session notice while recording is active.

We may review the retained records above (scores, comments, timing and attendance) to resolve a grading dispute, investigate suspected misconduct, or check that evaluators are applying rubrics consistently. Your evaluator's display name is visible to you during the session; their email and legal name are not disclosed to you.

Where your school is the controller, it may configure additional monitoring within its own tenant and is responsible for telling its students what it has enabled. If you have concerns about a specific session, contact support@whollify.com.

Calls

Voice and video calls, live lessons and meetings take place on media servers Whollify operates. The live audio and video pass through those servers to the other participants and are not stored. We keep a record of who joined, when, and for how long, which may form an attendance register where the call is a lesson or a meeting.

Google Account Data

You can sign in with Google and, separately, connect your Google Calendar and Google Tasks. Each is its own consent, asked for only when you turn that feature on, and you can see and end every connection in your settings.

• Sign in with Google: your name, email address and profile picture, used to create and sign in to your account.
• Google Calendar (read): your calendar list, your primary calendar's time zone and the events on the calendars you choose, kept up to date so they appear in your Whollify calendar. Only you see their details. Where you use booking pages or scheduling, other people see only that a time is busy, never what it is.
• Google Calendar (write): only if you turn on sending Whollify events to Google, we create, update and delete those events in the calendar you choose, with a Google Meet link where the event is online. We do not change events Whollify did not create.
• Google Tasks: two-way sync of your task lists, so tasks appear as to-dos in Whollify and changes made in either place reach the other.

We do not sell this data, use it for advertising, or let anyone read it to serve you ads, and no person at Whollify reads it except with your permission, for security, or where the law requires. Google calendar events are never sent to an AI model. A task imported from Google becomes one of your to-dos, and if you ask the AI assistant about your to-dos it can read it to answer you, as described under AI Features; it is never used to train AI models.

When you disconnect, we delete the access we were given and the copies of your Google calendars and events. Tasks already imported stay in Whollify as your own to-dos until you delete them, and stop syncing. You can also remove Whollify's access at any time from your Google Account.

Whollify's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

AI Features

Whollify includes an AI assistant available throughout the platform, a tutor inside courses, and AI help in documents, research, messages and the calendar. When you use one of these, the content needed for that request (your question, and the documents, messages or records you or the feature point it at) is sent to an AI model provider to produce the answer. The assistant can only see what your account can see, and anything it proposes to change on your behalf is shown to you to confirm first.

We keep your conversations so that you can return to them, and a record of each AI request for usage limits, billing and safety. We do not use your content to train AI models, and we do not allow our providers to. A school can switch AI features off for its members. The providers we use are listed on our sub-processors page.

Research

Research is the feature of Whollify used to supervise and carry out research projects, and to write academic documents such as theses, dissertations, journal articles, research papers, and literature reviews. It runs on the same account as the rest of the platform, but it processes categories of data the rest of the platform does not. This section describes the additional data Research collects and how it is processed. Where this section and the general terms above differ, this section governs your use of Research.

Information Research Collects

• Project content: the title, document type, research question, and citation style of each project you create, and the text of the documents and drafts you write in the editor.
• Research sources: academic papers you add to a project, whether discovered through our integrated search, added by identifier (e.g. DOI), or uploaded by you as PDF or DOCX files, together with their metadata, extracted full text, and the search queries you run.
• Writing-style samples: if you choose to set up a writing-style profile, the writing samples you upload (as text, PDF, or DOCX). These are optional and are used only to help the assistant match your voice.
• Generated and derived content: AI-generated drafts and suggestions, document version history, citation relationships, extracted claims and concepts, and the vector embeddings we compute from your papers and writing to power semantic search and relevance.
• Usage data: AI calls, token consumption, papers processed, and active project counts, which we track to enforce plan limits and for billing.

How Your Content Is Processed

To provide the service, your project content and sources are processed by AI and document-processing providers. Uploaded PDFs may be sent to a document-parsing provider to extract their text; your text, papers, and writing samples are sent to language-model and embedding providers to generate drafts, suggestions, analysis, and embeddings; and, where you enable web or open-access search, your queries are sent to the relevant search providers. We send only the content necessary to perform the requested operation, and we do not use your documents, sources, or writing samples to train publicly available AI models. The specific providers are listed on our sub-processors page.

Storage and Access

Your projects, papers, drafts, and embeddings are associated with your account and are private to you and any collaborators you explicitly invite to a project. Retention, your data subject rights, security, and the international-transfer terms described elsewhere in this Privacy Policy apply equally to data you create in Research.

How We Use Your Information

We use the collected data for various purposes:

• To provide and maintain our Service
• To personalize your learning experience
• To notify you about changes to our Service
• To allow you to participate in interactive features of our Service when you choose to do so
• To provide customer support
• To gather analysis or valuable information so that we can improve our Service
• To monitor the usage of our Service
• To detect, prevent and address technical issues
• To process payments and prevent fraudulent transactions
• To send you transactional emails, such as deadline reminders, account confirmations, and evaluation notifications
• To send you marketing emails, such as product updates, feature announcements, and promotions. You may opt out of marketing emails at any time by clicking the unsubscribe link in any such email or by contacting us at support@whollify.com. Opting out of marketing emails does not affect transactional emails required to operate your account. We do not send marketing email to users we know to be under 18.

Our Legal Bases for Processing

Under the NDPA, and for users in the EEA and the UK under the GDPR and UK GDPR, we must have a lawful basis for each purpose we process your data for. Ours are:

• Performance of a contract. Running your account, delivering courses, accepting submissions, grading them, scheduling and hosting evaluations, keeping your records, and taking payment. Without this processing there is no Service to provide.
• Legitimate interests. Securing the platform, preventing fraud and abuse, investigating misconduct, understanding which features are used and where they fail, and improving grading accuracy. We balance these against your rights, and you may object. See Your Data Subject Rights.
• Consent. Optional analytics and marketing cookies on our public website, marketing email, and optional features such as the writing-style profile in Research. You may withdraw consent at any time, and withdrawing it is as easy as giving it.
• Legal obligation. Tax and accounting records, responding to lawful requests from authorities, and retaining what we are required to retain.
• Instructions of a controller. Where your school is the controller, we process your academic data on its documented instructions rather than on a basis of our own. The school is responsible for establishing that basis.

Cookies and Similar Technologies

We use cookies and similar technologies in two different places, and they behave differently.

On the Whollify platform (where you sign in and do your work) we set only the cookies sign-in needs: a session cookie, a refresh cookie that keeps you signed in for up to 30 days if you choose to stay signed in, and, if you use two-step verification, a cookie that remembers a trusted device for 30 days. Single sign-on with your school also uses a short-lived session and security cookie. All of these are first-party, secure and inaccessible to scripts. The platform also keeps your profile, display preferences, and offline copies of documents you have open in your browser's own storage on your device, so that it loads quickly and works without a connection; signing out clears your profile from it. Third-party content is blocked behind a choice until you ask to open it. For example, a video embedded in a course shows a placeholder until you choose to load it; at that point your browser connects to the provider and that provider may set its own cookies. A payment checkout and the bot check on a sign-in form are also loaded only when the relevant action requires them and may set the provider's own cookies.

On our public website (whollify.com) we additionally load product analytics, but only if you accept analytics cookies in the banner. Our content delivery network may also count page views without cookies or any identifier stored on your device.

Changing your mind. You can reopen the cookie banner and change or withdraw your choices at any time using the Cookie preferences link in the footer of every page. Withdrawing analytics consent stops further collection immediately; it does not delete events already recorded, which you can ask us to erase under Your Data Subject Rights.

Our public pricing page asks our own servers which country you are connecting from, so that it can show you prices in naira or in dollars. The answer is a two-letter country code, we use it to pick a currency, and we do not store it. No third party is involved and your IP address is not shared with one. You can override the result yourself with the currency switch on that page.

We do not respond to browser "Do Not Track" signals, because there is no common standard for how a service should interpret one. The cookie banner is the control that works.

Data Retention

We retain your Personal Data for as long as your account remains active. If you delete your account, it is closed immediately and can be restored for 30 days, in case the deletion was a mistake. After that your personal data is permanently deleted or anonymised, except for the records listed below that we or your school are required to keep.

Specific periods worth knowing:

• Academic records in a school tenant: retained for as long as the institution requires, which is set by the institution and its regulator, not by us. This can be considerably longer than two years and can outlast your account.
• Payment and tax records: retained for the period Nigerian tax law requires, regardless of account deletion.
• Usage and analytics data: retained in identifiable form for no more than 12 months, then deleted or aggregated.
• Security logs (sign-ins, sessions, permission changes): up to 18 months.
• AI request records: 180 days. Conversations you keep stay until you delete them or your account.
• Attendance registers: 7 years by default, because schools are commonly required to keep them; your school may set a different period.
• Backups: deleted data may persist in encrypted backups for up to 90 days before those backups rotate out.

We may retain information that is otherwise deleted in de-identified and aggregated form, which is no longer personal data and is not re-identified.

Data Security

We implement appropriate technical and organizational measures designed to protect your personal data: encryption in transit and at rest, role-based access control, tenant isolation between institutions, audited administrative access, and least-privilege access for our own staff. Our security page describes these in more detail.

No method of transmission over the Internet, and no method of electronic storage, is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security. You are responsible for keeping your password confidential and for signing out of shared devices.

Personal Data Breaches

If a personal data breach occurs, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and the relevant supervisory authority where the GDPR or UK GDPR applies. Where the breach is likely to result in a high risk to your rights and freedoms, we will notify you directly and without undue delay, describing what happened, what data was involved, what we are doing about it, and what you can do to protect yourself.

Where we act as a processor for a school, we notify that school without undue delay after becoming aware of a breach affecting its tenant, and support it in meeting its own notification obligations. The school, as controller, decides what its students are told.

Disclosure of Data

Business Transaction

If we are involved in a merger, acquisition or asset sale, your Personal Data may be transferred. We will provide notice before your Personal Data is transferred and becomes subject to a different Privacy Policy.

Legal Requirements

We may disclose your Personal Data in the good faith belief that such action is necessary to:

• Comply with a legal obligation
• Protect and defend the rights or property of Sierra Africa
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of users of the Service or the public
• Protect against legal liability

We do not sell your personal data, and we do not share it with third parties for their own direct marketing purposes.

Your Data Subject Rights

Under the NDPA, and if you are in the EEA or the UK under the GDPR and UK GDPR, you have the following rights:

• Right of access: to request a copy of the personal data we hold about you.
• Right to be informed: to know which third parties receive your data and why.
• Right to rectification: to have inaccurate data corrected and incomplete data completed.
• Right to erasure: to have your personal data deleted, subject to records we are required to keep.
• Right to restrict processing: to have processing paused while a dispute about accuracy or legitimacy is resolved.
• Right to object: to object to processing based on our legitimate interests, and to object to direct marketing at any time and without qualification.
• Right to data portability: to receive your data in a structured, commonly used, machine-readable format, or have it sent to another organisation where technically feasible.
• Right to withdraw consent: where we rely on consent, to withdraw it at any time without affecting processing already carried out.
• Right to human review: to contest a decision made solely by automated means. See Automated Decisions and Human Review.
• Right to delete your account: available in the platform's account settings, without needing to contact us. If your account is managed by your school, the school deletes it, and we will help you ask.
• Right to a copy of your data: you can download your account data from the platform's account settings at any time.

To exercise these rights, use the tools in the Whollify platform or email support@whollify.com. We aim to respond within 1 business day, and in any event within the 30 days the law allows. We will tell you if we need a reasonable extension. We may ask you to verify your identity first, and we may refuse requests that are manifestly unfounded or excessive, that would breach the rights of others, or that concern records a school or the law requires us to keep. Where we refuse, we tell you why.

If you are unhappy with how we have handled your data, we would like the chance to put it right first. You also have the right to complain to a supervisory authority: in Nigeria, the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng; in the EEA, your national data protection authority; in the UK, the Information Commissioner's Office at ico.org.uk.

Service Providers and Sub-Processors

Sierra Africa uses third-party companies to operate, host, and improve the Service. Where those companies process your personal data on our behalf, they are sub-processors under applicable data protection law. We enter into data processing agreements with each of them and require them to protect your data to at least the standard set out in this Policy. Even where a sub-processor only stores data without using it for its own purposes, storage is processing and is disclosed.

The current list of who they are, what they do, and where they are located is maintained at whollify.com/sub-processors. We keep it there rather than here because it changes more often than this document does.

Notice of change. Before we add a new sub-processor that will process personal data, we update that page. Institutional customers may subscribe to change notifications by emailing support@whollify.com and will receive at least 30 days' notice, during which they may object on reasonable data protection grounds.

Children and Young People

Whollify is available to users aged 13 and above. We do not knowingly create accounts for, or collect personal data from, children under 13. If you believe a child under 13 has given us personal data, contact support@whollify.com and we will delete it.

Users aged 13 to 17. A parent or legal guardian must consent to the account before it is used, and a young person under 18 cannot agree to our Terms of Service on their own behalf. How that consent is obtained depends on how you joined:

• Through a school. Your institution is the controller and is responsible for obtaining and recording guardian consent, or for identifying another lawful basis available to it as an education provider, before enrolling a pupil. We rely on the school's confirmation that it has done so, which a school gives when it sets up its workspace and warrants in its agreement with us.
• On your own. We ask for your date of birth when you sign up. If you are under 13 we do not create the account. If you are 13 to 17 we ask for a parent or guardian's details and email them a link; the account stays on hold until they approve it.

For users we know to be under 18 we do not send marketing email, do not use their data for marketing profiling, and do not make their profile discoverable outside their institution. A parent or guardian may exercise any of the rights in Your Data Subject Rights on the young person's behalf by writing to support@whollify.com.

Where the GDPR applies, the age of digital consent varies between 13 and 16 by member state. We do not apply a different minimum age by country: a parent or legal guardian must consent for every user under 18, wherever they are, which meets or exceeds the standard each member state sets.

Links to Other Websites

Our Service may contain links to other websites that are not operated by us. If you click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.

International Data Transfers

Sierra Africa is established in Nigeria, but the Service does not run solely in Nigeria. Your personal data is transferred to, stored in, and processed in other countries, principally the European Union and the United States. That is where our hosting, infrastructure and AI providers operate. The sub-processors page states the location of each one.

We rely on the following to make those transfers lawful:

• Contractual safeguards. Every sub-processor is under a written data processing agreement that imposes obligations equivalent to those in the NDPA, and, where personal data of EEA or UK residents is involved, the European Commission's Standard Contractual Clauses (with the UK International Data Transfer Addendum where applicable).
• Necessity for the contract. Under NDPA s.43, certain transfers are permitted where they are necessary to perform the contract we have with you, as is the case for hosting the platform you are using.
• Adequacy, where it exists. Transfers within the EEA rely on the destination being covered by the same regime.

You should be aware that in some destination countries, courts, law enforcement and regulatory authorities may be entitled to access personal data, and that the legal protections may differ from those in your own country. You may request a copy of the safeguards we rely on for a particular transfer by writing to support@whollify.com.

If You Are in the EEA or the UK

Where you are in the European Economic Area or the United Kingdom, the GDPR and UK GDPR apply to our processing of your personal data in addition to the NDPA. The legal bases we rely on are set out under Our Legal Bases for Processing, and your rights (access, rectification, erasure, restriction, objection, portability, withdrawal of consent, and human review of automated decisions) are set out under Your Data Subject Rights. Those rights are exercisable against us directly, by writing to support@whollify.com.

Transfers of your data outside the EEA or the UK are made under the Standard Contractual Clauses and, for the UK, the International Data Transfer Addendum, as described under International Data Transfers. You may ask us for a copy of the clauses in place for any specific provider.

You have the right to lodge a complaint with the supervisory authority in the country where you live or work, or where you believe an infringement occurred. In the UK that is the Information Commissioner's Office. We ask that you contact us first, so that we have a chance to resolve it.

California Privacy Rights

If you are a California resident, you may request to know what personal information we collect about you, the sources it comes from, the purposes we collect it for, and the categories of third parties we share it with; and you may request that we delete it. You may exercise these rights up to twice in any 12-month period, free of charge, and we will not discriminate against you for exercising them.

We do not sell or share your personal information as those terms are defined under the California Consumer Privacy Act, and we have not done so in the preceding 12 months. We do not disclose personal information to third parties for their own direct marketing purposes within the meaning of California Civil Code s.1798.83. To make a request, email support@whollify.com.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of changes by posting the new Policy on this page and updating the "Last updated" date at the top. Where a change materially affects how we use your data, we will give you notice by email to the address on your account, or through the platform, before it takes effect.

Changes are effective when posted, except where we have said a later date applies. You are advised to review this Policy periodically.

Contact Us

Sierra Africa Limited is the data controller for the purposes described in this Policy, except where a school is the controller as described under Schools and Institutional Tenants. Contact us at:

• Sierra Africa Limited
• 8 Levante Estate, Adesham Street
• Bogije, Lagos State, Nigeria
• Data protection enquiries: support@whollify.com
• General support: support@whollify.com
• Institutional and procurement enquiries: hello@whollify.com

Our Data Protection Officer can be reached at the data protection address above. If you are writing about a specific data subject request, please say which right you are exercising so we can route it correctly.