Data Protection and Privacy Notice

IWA is a digital character-development platform providing learning experiences involving stories, choices, reflection, practice, and related activities.

Proposed Data Controller: Steward Fin. Limited.

Registered Address: Dr Obelawo Avenue, Zone E1, Ofatedo Osogbo, Nigeria.

Privacy/Data Protection Contact: IT Audit Team, IWA.

Privacy Email: ITAudit@useiwa.com.

IWA technology and platform operations are provided through Steward Fin. Limited. IWA content, including curriculum, stories, characters, learning materials, and related intellectual property, is owned by Peaches and Peaches Concepts.

Students using IWA; Parents/Guardians registering or managing a Student; Teachers and school administrators; Corporate/school users; IWA administrators and support personnel; visitors to the IWA website; and other individuals who provide personal data to IWA.

Where a Student is a child, IWA applies additional safeguards appropriate to children’s personal data in accordance with regional and international standards.

Adult Users (Parents/Guardians, Teachers, school administrators, and IWA personnel): First name and surname, email address, phone number where provided, country of residence, professional role, school or organisation association, account login credentials (passwords are stored only in protected, hashed form), notification preferences, subscription status, support requests, and responses to optional tester surveys.

Students: A first name or a parent-chosen nickname (parent-led), or a first name or school student number (school-led, chosen by the school); surnames are not collected. An IWA-generated username, a private PIN (stored only in hashed form, never readable by staff), an optional alias chosen by the Student, age band (10–12, 13–15, or 16–17), and school class where the Student is linked to a school.

Personalisation (“Make It Yours”): Up to three interest themes and one visual style chosen by the Student. IWA does not collect Student photographs, voice recordings, or camera/microphone access.

Learning Activity: Modules started and completed, dates and times, choices made in scenarios, active learning time (short on-screen intervals used only as totals and never shown as rankings), completion stars, reflections written by the Student and whether the Student chose to share them, practice and reinforcement activities, and developmental observations written by authorised Parents/Guardians or Teachers.

Technical and Security Information: Login and authentication records, security and access logs, and an audit history of administrative actions. Basic connection information such as IP address and browser type is processed by our hosting and service providers to deliver and secure the service.

We collect only information that is adequate, relevant, and reasonably necessary for the purposes for which it is processed.

We may use personal data to create and manage accounts and Student profiles; provide access to IWA; connect Students with authorised Parents/Guardians or schools; deliver and save learning, reflection, and developmental activity; provide feedback and reinforcement; administer subscriptions; provide support; secure the platform and prevent misuse; respond to safeguarding concerns; improve performance and functionality; meet legal and regulatory obligations; and communicate important service information.

Depending on the processing activity, IWA may rely on lawful bases recognised under applicable data protection law, including:

Consent: Given by an adult for themselves, or by a Parent/Guardian on behalf of a child when they confirm, at sign-up, that they are the child’s parent or guardian and authorise the child’s use of IWA (see useiwa.com/consent).

Performance of a Contract: To fulfil our operational commitments under our Terms of Service.

Legal Obligation: To satisfy statutory requirements under applicable Nigerian data protection law and other applicable mandates.

Legitimate Interests: For infrastructure security, operational debugging, and internal service improvements where permitted and balanced against user rights.

Vital Interests: To protect the immediate physical safety or well-being of a Student during a crisis event.

Where processing relies on consent, the relevant person may withdraw that consent at any time, subject to legal limitations. Parents/Guardians can withdraw consent by writing to iwaconcierge@useiwa.com.

IWA is designed to support Students, including children. Because children’s personal data requires particular care, IWA applies additional safeguards to its collection and use under a Privacy by Design approach.

Where IWA relies on consent to process a child’s personal data, the Parent/Guardian must provide the appropriate authorisation in accordance with applicable law. Privacy information presented directly to children is written in language they can reasonably understand.

IWA does not use a Student’s learning activity to assign an overall character score, rank, pass/fail status, or permanent character label. Developmental information supports learning and reflection rather than judging a child’s overall character.

IWA may collect answers to scenarios, selected choices, reflections, learning and practice activities, observations, reinforcement activities, and module completion information.

This information is used exclusively to understand participation and support the Student’s developmental journey. IWA does not use it to create a numerical character score or rank Students against one another.

IWA uses an AI service, accessed securely from our servers, to review the text of a Student’s written reflection. Only the reflection text and a one-time random reference are transmitted for safety review. The Student’s real name, username, school association, email addresses, and phone numbers are never transmitted, and any of these that a Student types into the reflection are automatically masked before review. The AI never knows who the Student is.

The review checks only whether the reflection contains content that may need a parent’s or teacher’s attention, such as signs of self-harm, bullying, violence, hateful, sexual, or abusive language. Where a safety concern is detected, the reflection is shared with the parent or teacher even if the Student did not tick “Share” (short or unwilling answers never override the Student’s choice), and Students are told this next to the share option.

Serious safety concerns are also sent promptly to IWA’s administrators and, for school Students, to the school’s Super Admins. Alerts do not contain the Student’s name; the name is shown only when an authorised adult opens the alert while signed in to IWA. Where the concern could involve harm at home, the Parent/Guardian is not automatically alerted; IWA’s administrators and, for school Students, the school’s Super Admins handle the concern. Students can read a child-friendly explanation at useiwa.com/what-adults-see.

AI-assisted processing never scores, grades, ranks, or diagnoses a Student, and never determines whether a Student has good or bad character. Names and aliases entered on IWA are also automatically checked against an inappropriate word list.

Within IWA, personal data is shared only with authorised Parents/Guardians, schools, Teachers, and administrators according to role-based access rules.

Cloud hosting provider: Secure hosting, database, and account sign-in infrastructure.

AI gateway provider: Routing for the anonymous reflection safety reviews described in Section 8.

Transactional email service: Service emails sent from notifications@useiwa.com (such as school invitations, PIN resets, and account notices).

TrustedSite: Security trust badge and automated security scanning of the public website.

Google Fonts: Typefaces used to display the website, loaded from Google’s servers.

We may also share information with professional advisers, or with regulatory and law-enforcement bodies where legally required. We do not sell personal data, and we do not share Students’ personal data with advertisers, tracking networks, or data brokers.

Some providers supporting IWA may process personal data outside Nigeria (such as hosting infrastructure or AI model providers). Where personal data is transferred across borders, IWA will apply the safeguards and lawful transfer mechanisms required under applicable data protection law.

IWA does not use Students’ reflections or personal data to train, retrain, or fine-tune artificial intelligence or machine learning models.

IWA retains personal data only for as long as is necessary to support the designated educational purpose or to comply with statutory legal requirements.

Inactivity: Inactive accounts are never deleted automatically. Records are kept while a child’s profile is active, and IWA administrators may set retention periods for specific record types.

On-Demand Deletion: Parents, guardians, or authorised school administrators can request account erasure at any time by contacting ITAudit@useiwa.com. On a valid request, the account is paused and the personal data is deleted or anonymised, except where preservation is required for legal defence or regulatory compliance.

We implement administrative, physical, and technical security measures designed to protect personal data against accidental loss, unauthorised access, alteration, or unlawful disclosure. No electronic system can guarantee absolute security.

Passwords and Student PIN codes are stored only in hashed form using cryptographic hashing.

Children’s identity details are stored separately from their reflections and activity, which are linked only by a random ID, and are never sent to the AI safety review.

IWA uses only the cookies and browser storage that are strictly necessary to keep you securely signed in and to operate the platform. IWA does not use advertising cookies, and does not run third-party analytics or behavioural tracking tools. If this changes, this notice will be updated and appropriate choices will be offered first.

Under applicable data protection law, adults, parents, and authorised institutional users have rights regarding their personal data, including the right to:

Access and request copies of the personal data held by the controller.

Rectify inaccurate, outdated, or incomplete data records.

Request erasure of personal data under specific statutory conditions.

Object to or restrict specific processing under lawful grounds.

Withdraw consent where consent is the lawful basis.

To exercise any of these rights, please submit a request to our IT Audit Team at ITAudit@useiwa.com. We may need to verify your identity or your authority to act for a Student.

If you are not satisfied with our response, you may have the right to complain to the Nigeria Data Protection Commission (www.ndpc.gov.ng) or another competent authority.

We may update this notice to reflect changes in our services, service providers, or regulatory requirements. Any changes will be published on this page with an updated “Last Updated” date. We encourage parents and educators to review this notice periodically.

This notice is the final published version. Any future amendments will be recorded under the “Last Updated” date at the top of this page.