Privacy Notice

1. Responsible institution and scope

BuX is the Babcock Unified Experience platform and owns this document for platform governance. Babcock University determines the purposes and means of the institutional processing described here. Contracted technology providers that implement and support BuX act under the relevant agreement and the University’s documented instructions; where a provider acts independently, its role is recorded separately.

This notice covers applicants, students, alumni, academic and non-academic staff, parents, guardians, sponsors and authorised partners. Visitors, suppliers, contractors, donors, research participants and medical-service users are covered where their information enters an enabled BuX service. Specialist clinical, employment or research notices may provide additional detail.

2. Services covered

BuX connects admissions and registration; student profiles and identity; course selection and scheduling; attendance, LMS and assessments; results, academic approvals and graduation; BuFeePay billing, payments and clearance; accommodation and meals; student development and campus services; staff and management services; alumni engagement; communications and the BuX Support Centre.

3. Information collected

Not every category is collected about every person. Where information is required, the screen identifies the mandatory fields and explains the consequences of not supplying them. Please do not submit information about another person unless you are authorised or otherwise lawfully entitled to do so.

4. Sources and connected records

Information may come from you; authorised University units; admissions or examination sources such as JAMB where applicable; prior institutional systems; lecturers and service staff; authorised parents or sponsors; payment providers; and the technical operation of BuX.

A shared identifier may connect admission, learning, finance and service records for authorised workflows. Consolidation does not grant every unit access to every record. Parent and sponsor access is limited to the information they are lawfully entitled to receive.

5. How information is used

Features described in this notice apply only where they are enabled and relevant to the individual. We use personal data for these purposes:

• application and enrolled services;
• mandatory records and reporting;
• security and misuse prevention;
• routine institutional administration;
• optional marketing and tracking;
• emergency protection;
• research and specialist services.

6. Legal grounds for processing

The University records the lawful basis for each processing activity before it begins. The table below describes the lawful bases that may apply to each purpose; not every basis applies to every record. Sensitive information also requires an applicable additional condition and safeguards.

7. Sensitive information

Before biometric attendance, health or welfare processing is enabled, the University identifies the precise purpose, the additional legal condition, the retention period and the access restrictions, and completes an impact assessment where required. Consent is not treated as freely given merely because access to education depends on accepting a feature.

For location-supported attendance, location is collected only when needed for the stated attendance check, with a clear device prompt. Continuous location tracking is not introduced under this notice. Where you cannot use the standard method, an approved assistance or alternative verification route is provided.

8. Children and vulnerable individuals

This notice does not assume that minors are enrolled. If children or persons lacking capacity are included in a service, the University assesses the applicable legal requirements before collection, provides an appropriate notice and verifies any required representative consent or authority. A learner’s full records are not automatically disclosed to a parent, guardian or sponsor.

9. Sharing and international transfers

Authorised University units receive only the information needed for their role. Contracted hosting, support, communications, identity and payment providers may receive information necessary for their service. Regulators, accreditation bodies or competent authorities may receive information where lawfully required. The specific recipient, purpose and authority are recorded for each disclosure.

A provider may act as a processor or as an independent controller depending on its function. Payment, banking and other independently regulated services may issue their own notices. BuX does not sell learner data or use it for unrelated advertising under this notice.

Where a provider or remote support team processes information outside Nigeria, the University documents the destination, the lawful transfer mechanism and the safeguards. You may request information about relevant safeguards from the Data Protection Officer.

10. Security

The operating standard for BuX calls for role-based access, appropriate multi-factor authentication, encryption, monitoring, audit logging, controlled support access and incident response. No system can guarantee absolute security. Report suspected compromise promptly, using the contact details in the Terms of Use, and never send passwords or authentication codes.

Personal-data incidents will be assessed and notified to affected individuals and the regulator when legally required. Routine access by suppliers is authorised and auditable. Service records are not reused for unrelated model training or other independent purposes without separate assessment, authority and notice.

11. Automated rules and review

BuX may calculate attendance indicators, fees, clearance status or workflow eligibility using institutional rules. We explain the relevant rule and provide a route to challenge incorrect source data or an outcome. Academic, disciplinary and other consequential decisions follow the University’s authorised review and appeal process.

Solely automated decisions with legal or similarly significant effects are not introduced under a general terms acceptance. Before such decisions are enabled, the University confirms the lawful conditions, transparency and human-review safeguards.

12. Cookies and communications

The separate Cookie Policy explains browser technologies and optional choices. Essential academic, security and transaction notices are distinct from optional promotional messages. Where marketing relies on consent, a simple withdrawal method is provided without affecting necessary services.

13. Data retention

Personal data is kept only for justified operational, institutional or legal purposes. Account closure is not automatic erasure of academic or financial records. Restricted access, approved schedules and legal holds apply; data is deleted or irreversibly anonymised when its purpose and required retention end.

Final academic records, financial evidence, employment, clinical, research and disciplinary records are governed by separate approved schedules; a generic platform period does not override those schedules. The table below describes how long some operational records are kept.

A hold preserves information without extending ordinary user access. Deletion does not proceed where the hold system cannot be checked reliably. Deletion and hold rules are applied to restored data before it becomes accessible.

14. Individual privacy rights

Subject to the applicable conditions, you may request access, correction, erasure, restriction, objection or portability, withdraw consent and challenge qualifying automated decisions. Rights are not unlimited: any lawful restriction and the available complaint route are explained to you. Withdrawal does not invalidate earlier lawful processing based on consent.

We verify identity proportionately, minimise additional evidence and handle requests within applicable legal timelines. We do not require acceptance of optional cookies, payment of unrelated fees or withdrawal of a complaint in order to process a privacy request. We record and communicate any lawful extension or refusal.

15. Contact information

The data controller is Babcock University. If you cannot sign in, you can still contact the University using the details below. You may complain to the Nigeria Data Protection Commission through https://ndpc.gov.ng/ (opens in a new tab) without first completing an internal appeal.