Privacy Notice
This notice explains how personal data is handled in Vouch, the attendance system your university uses, and on the vouchapp.tech website, in line with the Nigeria Data Protection Act 2023 (NDPA) and the NDPC General Application and Implementation Directive 2025.
Who is responsible
Your university is the data controller. Connected Spaces Ltd (RC 8963106), which operates Vouch, processes data on the university's behalf and only on its instructions. For messages sent through the forms on the vouchapp.tech website, Connected Spaces Ltd is the data controller. Contact: [email protected].
What we process
- Students: name, matriculation or JAMB number, department, course registrations, the phone linked to your record, and your attendance records, including the time, proximity to the class and location at each check-in.
- Staff: name, work email, role, department, sign-in records, the classes you run and changes you make to attendance.
- Everyone: error reports when something goes wrong in the app or web admin: what failed, where, the phone model, system and app version, and your account ID. Names, email addresses and matriculation or JAMB numbers are removed from them before they are stored.
- Everyone who sends feedback: what you write and any screenshots you attach, with your name, role, university, phone model, system and app version, so your university's Vouch admins and Vouch's support team can answer you.
- Website visitors who use a form (beta place, demo or contact): your name, email address, and whatever else you choose to give us, such as your phone number, university, role and message.
We do not receive or store fingerprints or face data; these are checked only on your phone. We do not track your location outside check-in, and we do not use your data for advertising or sell it.
Why, and on what legal basis
To record attendance, prevent attendance fraud, keep accurate academic records and allow records to be checked or contested later. The legal bases are the performance of your contract with the university (education or employment) and the university's legitimate interests (NDPA s.25(1)(b)). We may also process data where the law requires it.
We use website form details only to reply to you and, if you ask, to arrange a demo or a beta place. The legal bases are steps you ask us to take before a possible contract and our legitimate interest in answering enquiries. We do not add you to a mailing list.
Automated decisions
The app may refuse or flag a check-in automatically when presence cannot be confirmed, and it calculates attendance percentages. These results do not decide grades, exam eligibility or discipline. You can ask for a person to review any automated result, and your lecturer can record your attendance manually.
Who can see it
You (your own records), your lecturers (their courses), authorised university staff, Connected Spaces Ltd staff where needed to run the service, and our service providers for hosting, network protection and encrypted backup storage, each bound by a data protection agreement. We disclose data to authorities only where the law requires it.
International transfers
Data is hosted in Finland (EU). Encrypted backups are kept in Nigeria and the United States. Transfers are made only as permitted by NDPA Part VIII.
How long we keep it
- Attendance and student records: while you are a student and for the period your university sets after you leave (5 years by default), so records can be checked or contested. They are then anonymised.
- Sign-in records: 6 months.
- Error reports: 90 days.
- Feedback and support tickets: one year after the ticket is closed.
- Website form messages: two years.
- Backups: 30 days. Technical logs: deleted on a rolling basis.
Security
We use appropriate technical and organisational measures, including encryption, access controls and audit trails, to protect your data (NDPA s.39). If a breach affects your data, your university will be informed promptly so it can meet its duties under NDPA s.40.
Your rights
You can ask to access, correct, delete or restrict your data, object to its processing, receive a copy in a portable format, and not be subject to solely automated decisions (NDPA ss.34–38). Some records may be kept where your university needs them for academic records or legal claims. Contact your university's registry or data protection officer, or [email protected]. We respond within 30 days.
You may also complain to the Nigeria Data Protection Commission at ndpc.gov.ng.
Students under 18
Data of students under 18 is processed for education under the university's responsibility (NDPA s.31(4)(b)), in the same way as for other students.
Cookies
Vouch uses no advertising or analytics cookies, only what is strictly necessary to keep the service secure and signed in. The vouchapp.tech website sets no cookies.
Changes
We will post updates here with a new version and date, and give notice in the app of significant changes.