UenoLabs Technologies ("UenoLabs," "we," "our," or "us") is committed to protecting the privacy and personal data of every individual who interacts with our platform, services, and digital properties. This Privacy Policy ("Policy") describes our practices regarding the collection, processing, storage, transfer, and protection of personal information.

By accessing or using the Ueno platform, our website, or any related services offered by UenoLabs Technologies, you acknowledge that you have read, understood, and agree to be bound by the terms of this Policy. If you do not agree with the terms set out herein, you must immediately cease use of our platform and services.

This Policy is intended to comply with applicable Nigerian data protection legislation, including the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation 2019 (NDPR), as well as internationally recognised principles of data protection and privacy.

UenoLabs Technologies is a technology company incorporated in Nigeria, operating at:

No 16 Ibusa Avenue Street, Independence Layout, Enugu State, Federal Republic of Nigeria.

We develop and operate Ueno — the Unified Educational Network Organizer — an AI-powered education infrastructure platform designed to improve speed, organization, and efficiency across academic environments in universities and tertiary institutions.

For the purposes of applicable data protection law, UenoLabs Technologies acts as a Data Controller in relation to personal information you provide directly to us. Where we process data on behalf of partner institutions, we may act as a Data Processor subject to a separate data processing agreement with the relevant institution.

This Policy applies to all personal data collected and processed by UenoLabs Technologies through the following channels:

• The Ueno mobile application and any associated software
• The UenoLabs Technologies website and all subdomains
• Online contact, demo request, and ambassador application forms
• Direct communications via email, phone, or other digital channels
• Institutional pilot deployments and on-campus integrations
• Events, demonstrations, presentations, and promotional activities

This Policy does not apply to the data practices of third-party platforms, services, or websites that we may link to. We encourage you to review the privacy policies of any third-party service you interact with.

We collect personal information in a variety of ways depending on how you interact with our services. The categories of data we collect include:

4.1 Information you provide directly

• Identity data: First name, last name, title, and other identifying information
• Contact data: Email address, telephone number, and mailing address
• Institutional data: Name of university or institution, faculty, department, academic level, and role within the institution
• Account credentials: Username and encrypted password for platform accounts
• Application data: Information submitted via pilot request or campus ambassador application forms
• Communications: The content of emails, messages, or enquiries sent to us

4.2 Information collected automatically

• Usage data: Pages visited, features accessed, interactions with platform elements, session duration, and navigation patterns
• Device and technical data: IP address, browser type and version, operating system, device identifiers, and network information
• Location data: Approximate location data derived from IP address or, where you grant permission, precise location data used for proximity-based attendance verification
• Log data: Server logs, error reports, and diagnostic information

4.3 Information received from institutions

When Ueno is deployed within a partner institution, that institution may provide us with enrolment data, academic records, attendance records, and other data necessary to operate the platform. In such cases, the institution acts as the primary data controller for its students and staff.

We use personal information collected for the following purposes:

We do not use your personal information for unsolicited marketing communications without your prior consent. Where we send product updates or relevant communications, we will always provide a clear mechanism to opt out.

Under the Nigeria Data Protection Act 2023 and applicable data protection principles, we rely on one or more of the following lawful bases when processing your personal information:

• Contractual necessity: Processing required to perform a contract with you, including the provision of our platform services and pilot deployments
• Legitimate interests: Processing necessary for our legitimate business interests, such as improving our services, fraud prevention, and security — where such interests are not overridden by your fundamental rights
• Legal obligation: Processing required to comply with a legal or regulatory obligation applicable to UenoLabs Technologies
• Consent: Where you have freely given specific, informed, and unambiguous consent to processing, including location-based proximity verification for attendance — you may withdraw consent at any time
• Vital interests: Processing necessary to protect the vital interests of an individual, in exceptional circumstances

UenoLabs Technologies does not sell, rent, or trade your personal data. We share data only in the following circumstances and only to the minimum extent necessary:

7.1 Partner institutions

Where Ueno is deployed through a university or institution, that institution receives attendance records, engagement data, and analytics reports relating to its enrolled students and academic staff. Such sharing is governed by a Data Processing Agreement with the institution and is limited to data necessary for academic administration.

7.2 Technology service providers

We engage trusted third-party service providers to assist with platform operations, including cloud hosting, email delivery, analytics tools, and development infrastructure. These providers process data only on our instructions and are contractually prohibited from using it for any other purpose.

7.3 Legal and regulatory disclosures

We may disclose personal data when required to do so by applicable law, court order, regulatory directive, or governmental authority. We will, where legally permissible, notify affected individuals of any such disclosure.

7.4 Business transfers

In the event of a merger, acquisition, restructuring, or sale of assets involving UenoLabs Technologies, personal data may be transferred to the successor entity. In such circumstances, we will provide notice through our platform or website and, where required, obtain relevant consents before any transfer takes effect.

7.5 With your explicit consent

We may share your information with any third party where you have given express prior consent to such sharing.

We retain personal information only for as long as is necessary to fulfil the purposes for which it was collected, unless a longer retention period is required by applicable law or legitimate business necessity.

Upon expiry of the applicable retention period, we will securely delete or anonymize your personal data in accordance with our internal data deletion procedures.

UenoLabs Technologies implements industry-standard technical and organizational measures to protect personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. Our security measures include, but are not limited to:

• Encryption of data in transit using Transport Layer Security (TLS)
• Encryption of sensitive data at rest using AES-256 or equivalent standards
• Access controls and role-based permissions limiting data access to authorized personnel only
• Regular security assessments, penetration testing, and vulnerability management
• Secure software development practices and code review processes
• Employee training on data protection and security protocols
• Incident response procedures for identifying and addressing data breaches

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission (NDPC) and, where required, the affected individuals, within the timeframes prescribed by applicable law.

The Ueno platform is designed for use within tertiary educational institutions and is intended for individuals who are 16 years of age or older. We do not knowingly collect personal data from children under the age of 16 without appropriate parental or guardian consent.

If we become aware that we have inadvertently collected personal data from a child under the age of 16 without required consent, we will take immediate steps to delete such information from our systems. If you believe that a child under 16 has provided us with personal data without appropriate consent, please contact us at hello@uenolabs.com.

Where Ueno is deployed in institutions with students below the age of 16, the deploying institution is responsible for ensuring appropriate parental consent mechanisms are in place prior to deployment.

Subject to applicable law and certain exceptions, you have the following rights in respect of your personal data:

• Right of access: The right to request a copy of the personal data we hold about you and to receive confirmation of how it is being used
• Right to rectification: The right to request correction of inaccurate or incomplete personal data
• Right to erasure: The right to request deletion of your personal data where it is no longer necessary, or where you withdraw consent and no other lawful basis applies
• Right to restriction: The right to request that we restrict processing of your personal data in certain circumstances
• Right to data portability: The right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller where technically feasible
• Right to object: The right to object to processing based on legitimate interests, including any direct marketing activities
• Right to withdraw consent: Where processing is based on your consent, the right to withdraw that consent at any time without affecting the lawfulness of prior processing
• Right to lodge a complaint: The right to submit a complaint to the Nigeria Data Protection Commission (NDPC) or any other competent supervisory authority if you believe your rights have been violated

To exercise any of the above rights, please submit a written request to us using the contact details set out in Section 16 of this Policy. We will respond to your request within 30 days. In complex cases, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reasons for it.

We may need to verify your identity before processing certain requests to protect the security of your personal data.

Our website uses cookies and similar tracking technologies to improve your browsing experience, analyze site traffic, and deliver relevant content. A cookie is a small data file stored on your device by your web browser.

We use the following types of cookies:

• Strictly necessary cookies: Essential for the website to function correctly. These cannot be disabled without affecting site functionality.
• Performance and analytics cookies: Used to collect anonymous information about how visitors use our website, helping us improve performance and content.
• Functional cookies: Used to remember your preferences and settings for an improved experience on return visits.
• Marketing cookies: Used to deliver relevant content. We do not currently use third-party advertising networks, but may do so in future with appropriate notice and consent mechanisms.

You may configure your browser to refuse or delete cookies. Note that disabling certain cookies may affect the functionality of our website. Where required by law, we will obtain your consent before placing non-essential cookies.

UenoLabs Technologies is based in Nigeria and primarily processes personal data within Nigeria. However, some of our third-party service providers may operate in or store data in other countries.

Where personal data is transferred outside Nigeria to a country that does not provide an equivalent level of data protection, we will ensure that appropriate safeguards are in place — such as standard contractual clauses, binding corporate rules, or other mechanisms recognized under Nigerian data protection law — to protect your information in accordance with this Policy.

By using our services, you acknowledge that your personal data may be transferred to and processed in countries outside Nigeria, subject to the safeguards described above.

Our website and platform may contain links to third-party websites, applications, or services. This Policy does not apply to such third-party services, and we are not responsible for their data practices. We encourage you to review the privacy policy of any third-party service before providing your personal information.

Where we integrate third-party tools — such as analytics platforms, form submission services, or communication tools — those services are governed by their respective privacy policies. We select third-party providers who maintain appropriate data protection standards and enter into data processing agreements where required by law.

UenoLabs Technologies reserves the right to amend, update, or revise this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, our business operations, or platform functionality.

When we make material changes to this Policy, we will:

• Update the "Last Updated" date at the top of this document
• Notify active users via email or in-platform notification where required
• Post a notice on our website homepage for a period of at least 30 days

Your continued use of our platform or services following the publication of any revised Policy constitutes your acceptance of the changes. If you do not agree with the revised Policy, you must discontinue use of our services and may request deletion of your personal data as set out in Section 11.

We encourage you to review this Policy periodically to stay informed about how we protect your information.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, you may contact us through any of the following channels:

If you are not satisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.