Privacy Policy

Oxford School of Business & Management ("Oxford SBM", "we", "us", "our") is the data controller for personal data collected through oxford-sbm.com, the Oxford Learning platform, programme applications, consulting engagements, events and corporate training.

This policy explains what we collect, why we collect it, how long we keep it, who we share it with and the rights you have. It applies to prospective and enrolled learners, corporate clients and their delegates, event attendees, website visitors and anyone who contacts us.

• Identity and contact data: name, job title, organisation, email address, phone number and country.
• Enquiry data: details you submit when you request a proposal, book a consultation, make an enquiry, register for an event, request support or contact our media team.
• Account data: login email, authentication identifiers (including Google sign-in where you choose it) and profile preferences.
• Learning data: courses started, lesson progress, quiz and assessment results, discussion posts and credential status.
• Credential data: certificate numbers, verification codes, issue dates and the name printed on your credential.
• Transaction data: orders, invoices and payment status. Card details are processed directly by our payment providers (Stripe and Flutterwave); we never see or store full card numbers.
• Technical data: IP address (stored in hashed form for security), browser, device type, pages visited and referral source, collected through cookies where permitted.
• Correspondence: emails, messages and call notes relating to your enquiry or programme.

• Directly from you, through forms, account registration, learning activity and correspondence.
• From your employer or sponsoring organisation when they enrol you on a corporate programme or invite you to the organisation portal.
• Automatically, through cookies and similar technologies (see our Cookie Policy).
• From payment providers, which confirm whether a payment was successful.

• To respond to proposal requests, consultation bookings, enquiries and support requests. All such submissions are delivered to our team at info@oxford-sbm.com.
• To create and manage your account and deliver courses, assessments and credentials.
• To issue, host and allow third parties to verify your digital credentials.
• To process payments, issue receipts and invoices, and prevent fraud.
• To deliver corporate programmes and report progress to your sponsoring organisation where agreed.
• To send programme updates, insights and event invitations where you have opted in. You can unsubscribe at any time.
• To improve our website, courses and services through aggregated analysis.
• To keep our platform secure, and to meet legal, tax, accounting and regulatory obligations.

We rely on the following lawful bases under the Nigeria Data Protection Act 2023 (NDPA), the UK GDPR and the EU GDPR, as applicable:

• Contract: to provide programmes, credentials and services you or your organisation have requested.
• Legitimate interests: to respond to enquiries, secure our platform and improve our services, balanced against your rights.
• Consent: for marketing communications and non-essential cookies. You can withdraw consent at any time.
• Legal obligation: to keep financial records and respond to lawful requests from authorities.

We do not sell your personal data. We share it only where necessary with:

• Service providers who host our platform, store data, send email and process payments, under written data-protection terms.
• Your sponsoring organisation, limited to enrolment, progress and credential information for programmes they have commissioned.
• Anyone you give a credential link or verification code to, who can then confirm your credential is genuine.
• Professional advisers, auditors and authorities where required by law.

Some of our service providers store or process data outside Nigeria. Where this happens we use appropriate safeguards, such as contractual clauses approved under the NDPA, standard contractual clauses or adequacy decisions, to ensure your data receives equivalent protection.

• Enquiries and proposal requests: up to 24 months after our last contact, unless they lead to an engagement.
• Learner accounts and learning records: for as long as your account is active, and up to 3 years after closure.
• Credential records: retained for as long as the credential remains verifiable, so employers can continue to confirm it.
• Financial records: 7 years, to meet tax and accounting requirements.
• Marketing preferences: until you unsubscribe or ask us to delete them.

Subject to applicable law, you have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data erased where there is no longer a reason to keep it.
• Restrict or object to certain processing, including direct marketing.
• Receive your data in a portable format.
• Withdraw consent at any time, without affecting earlier processing.
• Lodge a complaint with the Nigeria Data Protection Commission (ndpc.gov.ng) or your local data protection authority.

To exercise any of these rights, email info@oxford-sbm.com. We will respond within 30 days, in line with the Nigeria Data Protection Act 2023 and the GDPR (extendable where a request is complex, in which case we will tell you why), and may ask you to confirm your identity. Requests are free of charge unless they are clearly excessive.

We use encryption in transit, role-based access controls, row-level database security, hashed IP addresses, audit logs and regular security reviews to protect your data. No online system is completely secure; if a breach is likely to put your rights at risk, we will notify you and the relevant authority as required by law.

Our services are designed for professionals and are not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us with data, contact us and we will delete it.

We may update this policy to reflect changes in our services or the law. The date at the top shows the latest version. Where changes are significant, we will let you know by email or a notice on the site.

Oxford School of Business & Management, TF7, 3rd Floor, Rhema Mall, Plot 267, Cadastral Zone B1, Ahmadu Bello Way, Kado, Abuja, Federal Capital Territory, Nigeria. Email: info@oxford-sbm.com. Phone: +234 (0) 904 665 7119.