PRIVACY POLICY FOR DEEP ACADEMY
(UK GDPR, NDPR, POPIA, & Ghana Act 843 Compliant)
Last Updated: August 2026
Effective Date: August 2026
Jurisdiction: United Kingdom (Global Applicability)
1. Introduction & Scope
Deep Academy (operated by DeepPaya Digital Services Limited, hereinafter “we”, “us”, “our”) is committed to protecting the privacy and security of your personal data.
This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our Learning Management System (LMS), or enrol in our courses.
| Purpose | Lawful Basis |
| To enrol you in courses and issue certificates | Contractual Necessity (to fulfil our agreement) |
| To process your tuition payments | Contractual Necessity |
| To send you course updates, reminders, and support emails | Legitimate Interest (to ensure you complete your learning) |
| To improve our courses using analytics | Legitimate Interest (to enhance our educational content) |
| To market related courses to you | Consent (you can opt out anytime via email or dashboard) |
| To verify your identity for UK visa applications (if applicable) | Legal Obligation (compliance with UK Home Office requirements upon request) |
| To transfer your data across borders (e.g., from Africa to the UK) | Explicit Consent (obtained during account registration) |
Geographic Scope: This policy applies to all users globally. However, we have included specific provisions for residents of Nigeria, South Africa, Ghana, and other African nations, in full compliance with their respective data protection regulations, particularly for students preparing to relocate to the United Kingdom.
2. Who We Are (Data Controller)
- Legal Entity: DeepPaya Digital Services Limited (UK Registered Company)
- Company Number: [Insert UK Company Number]
- Registered Address: [Insert Registered UK Office Address]
- Data Protection Officer (DPO): We have appointed a UK-based DPO. You can contact them at: dpo@deepacademy.co.uk
3. What Personal Data We Collect
We collect the following categories of data to provide you with educational services and certification:
- Identity Data: Full name, date of birth, gender, and passport number (only collected if you request a physical certificate with travel-valid identification).
- Contact Data: Email address, phone number, billing address, and country of residence.
- Financial Data: Payment card details (processed securely via Stripe/Paystack—we do not store your full card number).
- Educational & Assessment Data: Course enrollment history, video viewing progress, quiz/exam scores, assignment submissions, and forum activity.
- Visa/Immigration Data: If you are preparing to come to the UK, we may collect your UKVI (UK Visas and Immigration) reference number or current visa status, solely for the purpose of verifying your eligibility for certain UK-specific career pathways.
- Technical Data: IP address, browser type, device type, operating system, and cookies (as per our Cookies Policy).
4. How We Use Your Data (Lawful Basis)
We process your data under the following lawful bases, as required by UK GDPR and equivalent African laws:
5. How We Share Your Data
We do not sell your personal data. We only share it with trusted partners under strict contractual agreements:
- Payment Processors: Stripe (USA) & Paystack (Nigeria) – for transaction processing.
- Cloud Storage & LMS Providers: Amazon Web Services (AWS) – UK data centre.
- Certification Issuers: Third-party accrediting bodies (e.g., CPD UK) – to validate your certificate.
- UK Government Agencies: We will only share your data with UKVI or the Home Office if you explicitly request us to provide proof of your educational credentials for a visa application, or if we are legally compelled to do so by a court order.
We do NOT share your data with recruitment agencies or employers without your explicit written consent.
6. International Data Transfers (Crucial for African Users)
Your data is primarily stored on secure servers located in the United Kingdom (AWS London Region). Because you may reside in Africa, your data crosses international borders.
To ensure this transfer is legal under UK GDPR, NDPR (Nigeria), POPIA (South Africa), and Ghana Act 843, we rely on:
- UK & EU Standard Contractual Clauses (SCCs): We have signed legally binding contracts with all our third-party processors that contain these clauses, ensuring your data receives the same level of protection in the UK as it would in your home country.
- Adequacy Decisions: Where applicable, we align with adequacy frameworks.
- Explicit Consent: For African users, we obtain explicit, freely given consent to transfer your data to the UK before you even complete registration.
7. Specific Provisions for Nigerian, Ghanaian, South African & Other African Nationals
A. Nigeria (NDPR Compliance)
- We have designated a local Nigerian representative for data protection matters: [Insert Nigerian Address/Contact].
- We comply with the Nigeria Data Protection Regulation (NDPR) by ensuring that we collect data only for specified, explicit, and legitimate purposes.
- You have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your data has been mishandled.
B. South Africa (POPIA Compliance)
- We process your data in full compliance with the Protection of Personal Information Act (POPIA).
- We ensure that all cross-border transfers of your data are safeguarded by appropriate legal mechanisms (as outlined in Section 72 of POPIA).
- You have the right to request the deletion of your personal data at any time, subject to our contractual retention obligations (e.g., for certificate validation).
C. Ghana (Act 843 Compliance)
- We adhere to the principles of the Data Protection Act, 2012 (Act 843) regarding the fair and lawful processing of personal data.
- We have secured your explicit consent for the processing of your special categories of data (e.g., passport information), and we process it solely for the purpose of preparing you for UK immigration procedures.
D. Other African Nations
- We apply the highest standard of data protection to all users from other African jurisdictions (e.g., Kenya, Rwanda, Egypt).
- We use data minimization principles—we only collect what is strictly necessary to deliver your course and certification.
8. Special Section: Preparing to Come to the UK (Visa & Immigration)
Deep Academy provides globally recognized UK-accredited courses. Many of our African students purchase these courses as part of their preparation for UK study visas, Skilled Worker Visas, or Graduate Visas.
- Purpose of Collection: We collect your educational records, assessment scores, and identification data solely to issue official certificates that you can present to UKVI (UK Visas and Immigration) to prove your UK educational qualifications.
- Data Sharing with UKVI: We will not share your data with the UK Home Office unless you explicitly request us to do so (e.g., by emailing us a request to verify your certificate to a specific visa caseworker).
- Disclaimer: Deep Academy is NOT a registered immigration advisory service. We do not guarantee visa approval. We provide the educational evidence required for your application, but the outcome of your visa application lies entirely with the UK Home Office.
- Storage: If you are preparing for a visa, we will retain your identity documents (e.g., passport scan) securely for a period of 3 years to assist with any future UK border audits.
9. Your Data Protection Rights
Under UK GDPR, NDPR, POPIA, and Ghana Act 843, you have the following rights:
- Right to Access: Request a copy of all personal data we hold about you.
- Right to Rectification: Correct any inaccurate or incomplete data.
- Right to Erasure (Right to be Forgotten): Request that we delete your data, provided we are not legally required to keep it (e.g., for tax records or certificate validation).
- Right to Restrict Processing: Ask us to limit how we use your data.
- Right to Data Portability: Receive your data in a machine-readable format.
- Right to Object: Object to our use of your data for marketing or profiling.
- Right to Withdraw Consent: Withdraw your consent for cross-border data transfers or marketing at any time.
To exercise these rights, email dpo@deepacademy.co.uk with the subject line “DSAR – [Your Full Name]”. We will respond within 30 days as per UK statutory timelines.
10. Data Retention Periods
We retain your data only for as long as necessary:
- Course Progress & Payment Data: 7 years (to satisfy UK tax and HMRC audit requirements).
- Certification Records: Indefinitely (because employers and UKVI may need to verify your certificate 10 or 20 years later).
- Marketing Consent Data: Until you unsubscribe.
- Visa/Passport Scans: 3 years after your last interaction with us.
11. Data Security
We implement robust technical and organisational measures, including:
- 256-bit SSL/TLS encryption for all data in transit.
- AES-256 encryption for data at rest on our AWS servers.
- Multi-Factor Authentication (MFA) for all administrative access.
- Regular penetration testing and vulnerability scanning.
Despite these measures, no internet transmission is 100% secure. We cannot guarantee absolute security, but we commit to immediately notifying you and the relevant regulators (ICO, NDPC, SA Information Regulator) within 72 hours of a confirmed data breach, as required by law.
12. Third-Party Links
Our Platform may contain links to Deep MarketHub (our e-commerce sister site) or external partner universities. We are not responsible for the privacy practices of these external sites. We encourage you to read their privacy policies before providing them with your data.
13. Children’s Privacy
We do not knowingly collect data from anyone under the age of 18. If we learn that we have inadvertently collected data from a minor, we will delete it immediately. If you are a parent or guardian and believe your child has provided data to us, contact dpo@deepacademy.co.uk.
14. Updates to This Policy
We may update this Privacy Policy to reflect changes in UK, Nigerian, South African, or Ghanaian laws. We will notify you of significant changes via email or a prominent pop-up on our website. Your continued use of the Platform after the “Last Updated” date constitutes acceptance of the updated terms.
15. Contact & Regulators
For all privacy inquiries, complaints, or to exercise your rights:
- UK (ICO): DeepPaya Digital Services Ltd (DPO: dpo@deepacademy.co.uk) | [Insert UK Address]
- Nigeria (NDPC): Our local Nigerian representative can be contacted at: [Insert Nigerian Address/Phone].
- South Africa (Information Regulator): You have the right to lodge a complaint with the SA Information Regulator at: inforegulator.org.za.
- Ghana (Data Protection Commission): You may lodge a complaint with the Ghana DPC at: dataprotection.org.gh.
Signed for and on behalf of DeepPaya Digital Services Limited:
David Nkanta
CEO, DeepPaya Digital Services Limited
Date: August 2026