Privacy Policy

1. About This Policy and Our Legal Basis

MindBrood Initiative ("we," "us," or "our"), registered in the Federal Republic of Nigeria, operates the Societrics suite of assessment and analytics platforms. This Privacy Policy explains how we collect, use, store, share, and protect your personal data, and sets out your rights in respect of that data.

This policy is issued in compliance with the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Regulation 2019 (NDPR) where applicable, and other relevant Nigerian and international data protection frameworks. MindBrood Initiative is registered as a data controller with a licensed Data Protection Compliance Organisation (DPCO) as required under the NDPA.

By accessing or using any Societrics service, you acknowledge that you have read and understood this policy. If you are accessing the platform on behalf of a minor, you accept additional obligations set out in Section 9 below.

2. Information We Collect

2.1 Information You Provide Directly

Account information: name, email address, profile photo (via Google Sign-In or email registration)
Personality assessment responses: your answers to VCTR Framework questionnaires across all assessment tiers (Foundation, Intermediate, Professional, Legacy)
Community health assessment responses: your responses to the pH Instrument (WSI Fundamentals and TPC Modifier items) — these may be submitted anonymously (see Section 2.4)
Organisation data: organisation name, member lists, department structures, and location provided by administrators
Demographic information: age range, gender, occupational role, state and LGA (for pH assessments), country, and community tenure — collected to enable demographic disaggregation in research outputs
Communication data: support requests, feedback, and correspondence with our team

2.2 Information Collected Automatically

Usage data: features accessed, time spent on each screen, assessment completion patterns
Device information: browser type, operating system, screen resolution, device identifiers
Log data: IP addresses, access times, error logs, and referring URLs
Location data: general geographic location (country and state level) inferred from IP address or provided in demographics
Offline activity: assessment responses stored locally via your browser's localStorage when internet connectivity is unavailable, and synchronised to our servers when connectivity is restored

2.3 Information from Third Parties

Google Sign-In: basic profile information (name, email, profile photo) that you authorise Google to share with us
Organisation administrators: member information they enter when enrolling users in organisational accounts, including for school-based deployments
Field enumerators: in field-based pH deployments, trained enumerators may enter assessment responses on behalf of community members following verbal consent procedures

2.4 Anonymous pH Assessment Submissions

The Societrics pH Instrument at ph.societrics.org accepts submissions from users who have not created an account. Anonymous submissions are assigned a session identifier that does not identify you personally. Anonymous submissions are stored with only the demographic information you voluntarily provide (state, LGA, age range, gender, role) and cannot be linked to you after submission. You cannot exercise individual data rights (access, rectification, erasure) in respect of anonymous submissions because we have no means of identifying which submission is yours.

3. How We Use Your Information

3.1 Platform Services

Provide, deliver, and maintain the personality assessment and community health assessment services
Generate your personalised VCTR profile, pH scores, and related insights
Enable organisational team analytics and administrator dashboards
Store your assessment history and track progress over time (authenticated users only)
Send service communications, including assessment results, account alerts, and policy updates
Maintain platform security, detect fraud, and prevent abuse
Comply with our legal obligations under Nigerian and applicable international law

3.2 Research and National Personality Index (NPI)

A core purpose of the Societrics platform is the construction and ongoing maintenance of the National Personality Index (NPI) — an aggregate, anonymised population-level index that maps the distribution of VCTR personality archetypes across geographic areas, demographic groups, and educational cohorts in Nigeria and, progressively, across Africa.

The NPI is constructed exclusively from anonymised and aggregated assessment data. No individual user can be identified from any NPI output. Your individual VCTR profile is never published, shared with research partners, or included in public-facing research outputs in identifiable form. The NPI represents population-level patterns, not individual data.

We use your anonymised assessment data to:

Contribute to the NPI aggregate calculations (archetype distribution by geography, gender, age, and school type)
Produce community-level pH health indices published in research reports and policy briefs
Conduct joint research with institutional partners (such as NERDC) under formal data sharing agreements
Improve the accuracy, reliability, and validity of our assessment instruments
Develop and validate new measurement tools and framework extensions

You may opt out of your data being used for research purposes beyond service delivery by contacting privacy@societrics.org. Opting out does not affect your ability to use the platform services, but may limit the scope of the insights generated from your data.

4. Legal Basis for Processing

Under the NDPA 2023 and applicable data protection law, we process your data on the following legal bases:

Consent: when you agree to specific data uses, including research participation, optional analytics, and marketing communications. Consent may be withdrawn at any time.
Contract: to provide the services you have requested and maintain your account.
Legitimate interests: to improve and secure our platform, conduct research that serves the public interest, and develop the NPI as a national educational and social intelligence resource — where these interests do not override your fundamental rights.
Legal obligation: to comply with Nigerian law, court orders, and regulatory requirements.
Vital interests: in exceptional circumstances, to protect your life or the life of another person.

For data relating to minors, we rely on parental or guardian consent. See Section 9 for details.

5. Data Sharing and Disclosure

5.1 We Share Data With:

Organisation administrators: aggregate and individual member data within their organisation, subject to their organisation's data governance and the member's consent at enrolment
Service providers: cloud infrastructure providers (Google Firebase / Google Cloud), email service providers, and payment processors — all operating under strict data processing agreements
Research and institutional partners: only anonymised, aggregated data tables — never individual-identifiable records — shared under formal Data Processing Agreements (DPAs) that restrict further disclosure
Legal authorities: when required to comply with a court order, subpoena, or other legal process under Nigerian or applicable international law

5.2 We Do NOT:

Sell your personal data to any third party under any circumstances
Share your individual VCTR profile, NPI position, or pH assessment responses without your explicit consent
Use your data for targeted commercial advertising
Transfer individual personal data to countries without an adequate data protection framework unless appropriate safeguards (standard contractual clauses, adequacy decisions) are in place
Provide individual assessment data to employers, government agencies, or law enforcement beyond what is required by law

6. Data Retention

Account data: retained for the duration of your account, plus 30 days after deletion to allow for recovery, then permanently deleted
Individual assessment data: retained for 3 years from the date of submission, or until you request deletion, whichever is earlier
Anonymised aggregate research data (NPI, pH indices): retained indefinitely in aggregated, non-identifiable form for longitudinal research purposes — this data cannot be used to identify you
Anonymous pH submissions: retained indefinitely in aggregate form; individual session records retained for 12 months then deleted
Organisational analytics data: retained for 2 years from the end of the organisation's subscription, then deleted
Legal and compliance records: retained for the period required by applicable Nigerian law

You may request earlier deletion of your individual data at any time, subject to legal retention requirements. Deletion of individual data does not affect anonymised aggregate data already incorporated into NPI or pH indices.

7. Data Security

We implement appropriate technical and organisational security measures, including:

Encryption in transit (TLS/HTTPS) and at rest for all personal data stored in our systems
Firebase Authentication with role-based access controls restricting access to personal data to authorised personnel only
Firestore Security Rules enforcing that individual assessment records are write-only at the client level — no individual record is readable from the client interface
Offline data persistence through browser localStorage with automatic secure sync when connectivity is restored
Regular security assessments and vulnerability reviews
Staff training, confidentiality obligations, and data handling procedures
Incident response and breach notification procedures consistent with NDPA requirements

No system is 100% secure. In the event of a data breach that affects your personal data, we will notify you and the relevant regulatory authority within the timeframe required by the NDPA 2023.

8. Your Rights

Under the NDPA 2023 and applicable data protection law, you have the following rights:

Right of access: obtain a copy of your personal data held by us
Right to rectification: correct inaccurate or incomplete personal data
Right to erasure: request deletion of your personal data where there is no lawful basis for continued retention
Right to data portability: receive your personal data in a structured, commonly used, machine-readable format
Right to restriction: request that we limit processing of your data in certain circumstances
Right to object: object to processing based on legitimate interests, including use of your data in research activities
Right to withdraw consent: revoke previously given consent at any time without affecting the lawfulness of processing carried out before withdrawal
Right to lodge a complaint: complain to the Nigeria Data Protection Commission (NDPC) or other relevant supervisory authority

To exercise any of these rights, contact us at privacy@societrics.org. We will respond within 30 days. Note that rights cannot be exercised in respect of anonymous submissions where we are unable to identify you.

9. Children's and Young Persons' Data

Important — Please Read Carefully

The Societrics Advisory platform is used in educational settings including secondary schools, where users may be under 18 years of age. Additional protections apply to the data of young users.

9.1 Age Categories and Requirements

Under 13 (Foundation Tier): Processing of data from users under 13 is permitted only where a school or educational institution has obtained documented parental or guardian consent on behalf of the user, under a formal Data Processing Agreement between MindBrood Initiative and the institution. Individual self-registration by users under 13 is not permitted without institutional oversight.
Ages 13–17 (Foundation and Intermediate Tiers): Users aged 13–17 may register with parental or guardian consent. Schools enrolling students in this age range accept responsibility for obtaining and documenting consent as part of their institutional agreement with MindBrood Initiative.
Ages 18 and above: Standard terms apply.

9.2 What Data We Collect from Young Users

For users under 18, we collect only the minimum data necessary for the educational service:

VCTR assessment responses (age-appropriate tier only)
School-provided identifier (where the school manages account creation)
Demographic information limited to: age range, gender, class level, and school location

We do not collect unnecessary personal data from users under 18, including detailed profile photos, personal communications, or contact information beyond what the school provides.

9.3 How Young Users' Data Is Used

Assessment results are provided to the student and, where enrolled by a school, to authorised school counsellors and administrators
Anonymised, aggregate data from young users contributes to the NPI and educational research under the same protections as adult data
Individual data from users under 18 is never shared with employers, commercial organisations, or any party other than the school and the student's parent/guardian
We do not use data from users under 18 for any commercial purpose, including advertising or product development unrelated to the educational service

9.4 Parental Rights

Parents or guardians of users under 18 may contact us at privacy@societrics.org to: access the data held about their child; request correction of inaccurate data; request deletion of their child's data; or withdraw consent for continued data processing. We will respond within 14 days.

Please refer to our Children and Young Persons Data Policy for the full framework applicable to school and institutional deployments.

10. International Data Transfers

Your data is processed primarily in Nigeria and may also be processed on Google Cloud infrastructure in the EU (London region, europe-west2) and other regions where Google Firebase operates. We ensure appropriate safeguards are in place for any international transfers, including:

Standard contractual clauses with Google Cloud and other processors
Data processing agreements with all third-party service providers
Compliance with NDPA 2023 requirements for cross-border data transfers

11. Cookies and Local Storage

We use essential cookies for authentication and session management only. We do not use third-party advertising or tracking cookies.

We use your browser's localStorage to preserve your assessment progress when internet connectivity is interrupted. This data is stored on your device only and is synchronised to our servers when connectivity is restored. You can clear localStorage through your browser settings, which will delete unsynchronised assessment progress.

For full details, see our Cookie Policy.

12. Sensitive Data — Personality and Behavioural Data

VCTR personality profiles and pH community health assessments constitute behavioural and psychological data. While this data is not classified as a "special category" under the NDPA in the same way as health records or biometric data, we recognise that personality profiling data warrants heightened protection. Specifically:

Your VCTR archetype is for self-development and research purposes only. It is not a psychological diagnosis, a clinical assessment, or a measure of intelligence.
Personality data must not be used as a sole or primary basis for employment, admission, housing, credit, or any other consequential decision. Our Terms of Service expressly prohibit this.
We apply the same security standards to personality assessment data as we would to sensitive personal data.

13. Governing Law

This Privacy Policy is governed by the laws of the Federal Republic of Nigeria, including the Nigeria Data Protection Act 2023 and associated regulations. Any disputes arising under this policy shall be resolved in the courts of the Federal Capital Territory (FCT), Abuja, Nigeria, or through the dispute resolution mechanisms of the Nigeria Data Protection Commission (NDPC).

14. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or platform notification at least 14 days before changes take effect. The "Last Updated" date at the top of this page indicates when it was most recently revised. Continued use of the platform after the effective date of any changes constitutes acceptance of the revised policy.

15. Contact and Data Protection

For privacy-related inquiries, to exercise your rights, or to make a complaint:

MindBrood Initiative — Data Protection
Email: privacy@societrics.org
General: research@societrics.org
Website: societrics.org
Address: Abuja, Federal Capital Territory, Nigeria

To lodge a complaint with the Nigerian supervisory authority:
Nigeria Data Protection Commission (NDPC)
Website: ndpc.gov.ng

Your data helps build a deeper understanding of Nigeria's communities and student generation. We are committed to earning that trust through transparency, security, and responsible stewardship.