Shanahan University, Onitsha (“Shanahan University”, “the University”, “we”, “us”) is committed to protecting the personal data of everyone who interacts with us: prospective students, enrolled students, parents and guardians, staff, alumni, partners and visitors to our websites.

This Data Policy explains what personal data we collect, why we collect it, how we use and safeguard it, and the rights available to you under the Nigeria Data Protection Act (NDPA) 2023 and the regulations issued by the Nigeria Data Protection Commission (NDPC).

Shanahan University, Onitsha is the data controller responsible for the personal data described in this policy. You can reach us at:

• Permanent Site: Shanahan University Avenue, Trans-Nkisi Layout, Onitsha, Anambra State, Nigeria
• Temporary Site: Basilica of the Most Holy Trinity, No. 1 Mission Road, P.O. Box 411, GRA, Onitsha
• Email: info@shanahanuni.edu.ng
• Telephone: +234 813 480 0030, +234 907 722 8877, +234 907 511 2111

This policy covers personal data processed by the University in the course of admissions, teaching and academic administration, student welfare, employment, alumni relations, fundraising, and the operation of our websites and online services. It applies whether you interact with us online, by telephone, by post, or in person on our campuses.

Where a University portal or a partner service operates under its own additional terms, those terms apply alongside this policy, not instead of it.

Prospective students and applicants: full name, date of birth, gender, nationality, state of origin and local government area, contact details, passport photograph, JAMB registration number and UTME results, O’Level results, previous institutions attended, programme of choice, parent or guardian details, and payment references for application and acceptance fees.

Enrolled students: matriculation number, academic records and results, registration and attendance records, accommodation details, fee and scholarship records, library borrowing history, disciplinary records where applicable, and information disclosed to the University clinic.

Staff and job applicants: curriculum vitae, qualifications and employment history, referee details, National Identification Number, payroll and bank details, pension and tax records, and next-of-kin information.

Website visitors: IP address, browser and device type, operating system, pages viewed, time spent, referring website, and cookie identifiers.

Enquirers and subscribers: name, email address, telephone number and the content of your message when you use our contact form, request information, or subscribe to University updates.

Some of the data we handle is treated as sensitive personal data under the NDPA and is subject to additional safeguards. This may include health and medical information provided to the University clinic or in support of accessibility and accommodation requests, religious affiliation in connection with chaplaincy and pastoral care, and biometric data where used to verify identity.

We collect sensitive personal data only where it is necessary, and we process it on the basis of your explicit consent or another lawful ground permitted by the NDPA. Access is restricted to the small number of staff who require it to carry out their duties.

• Directly from you: when you apply for admission or employment, register for a programme, complete a form on our website, subscribe to updates, contact us, or visit our campuses.
• Automatically: through cookies and similar technologies when you browse our websites and portals.
• From third parties: including the Joint Admissions and Matriculation Board (JAMB), WAEC and NECO for results verification, previous institutions, referees, sponsors and scholarship bodies including the Shanahan Educational Foundation, and payment processors confirming your transactions.

Our websites use cookies and similar technologies for the following purposes:

• Strictly necessary cookies: required for the site to function, including session management and secure sign-in to our portals. These cannot be switched off.
• Performance cookies: used by our caching system to serve pages quickly.
• Analytics cookies: we use Google Analytics to understand how visitors find and use our website so that we can improve it. This information is reported to us in aggregate.
• Functional and embedded content: pages that embed third-party content such as social media feeds, video players or maps may set cookies controlled by those providers.

You can control or delete cookies through your browser settings. Please note that blocking some cookies may affect how parts of our website work.

We do not sell your personal data. We share it only where necessary, and only with:

• Regulators and statutory bodies: the National Universities Commission, JAMB, the National Youth Service Corps, and the professional councils that accredit our programmes.
• Sponsors and scholarship providers: including the Shanahan Educational Foundation, in respect of students they support.
• Banks and payment processors: to collect and reconcile fees.
• Service providers: our website hosting, email, portal and IT support providers, who act on our instructions and under confidentiality obligations.
• Professional advisers: auditors and legal advisers, where required.
• Law enforcement and the courts: where we are legally required to disclose, or where disclosure is necessary to protect the rights and safety of our community.

We apply appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. These include encrypted connections (HTTPS) across our websites and portals, role-based access controls, password protection, regular backups, and confidentiality obligations binding our staff.

Some of our service providers, for example email, analytics and hosting services, may process data on servers located outside Nigeria. Where personal data is transferred abroad, we take steps to ensure it remains protected to a standard consistent with the NDPA.

If a data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission and, where required, you, in line with our obligations under the Act.

We keep personal data only for as long as is necessary for the purpose for which it was collected, and to meet our legal and regulatory obligations.

Subject to the conditions set out in the Nigeria Data Protection Act 2023, you have the right to:

1. Be informed about how your personal data is used, which is the purpose of this policy.
2. Access the personal data we hold about you, and obtain a copy of it.
3. Rectification: have inaccurate or incomplete data corrected.
4. Erasure: ask us to delete your data where there is no continuing lawful reason for us to keep it.
5. Restrict processing: ask us to pause the use of your data while a concern is being resolved.
6. Object to processing carried out on the basis of legitimate interest, and to direct marketing at any time.
7. Data portability: receive certain data in a structured, commonly used, machine-readable format.
8. Withdraw consent at any time where our processing relies on your consent. Withdrawal does not affect processing carried out before you withdrew.
9. Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.
10. Lodge a complaint with the Nigeria Data Protection Commission.

Please note that some of these rights are qualified. For example, we cannot delete a core academic record that we are required to retain, and we may be unable to comply with a request where doing so would prejudice a legal obligation.

To exercise any of the rights above, write to us at info@shanahanuni.edu.ng with the subject line “Data Protection Request”, telling us which right you wish to exercise and what data your request concerns.

We may ask you to verify your identity before we act, so that we do not disclose personal data to the wrong person. We aim to respond to all requests within 30 days. If your request is complex and we need more time, we will tell you and explain why.

If you are not satisfied with our response, you may complain to the Nigeria Data Protection Commission (NDPC), the national regulator responsible for enforcing the NDPA.

Some of our applicants are under 18 years of age at the point of application. Where we process the personal data of a person under 18 on the basis of consent, we require the consent of a parent or legal guardian, and we take care to present information about data use in language a young applicant can understand.

Parents and guardians may contact us at any time to ask what data we hold about their child and how it is used.

We review this Data Policy regularly and may update it to reflect changes in our practices, our services, or the law. The date at the top of this page shows when it was last reviewed. Where a change materially affects how we use your personal data, we will bring it to your attention through our website or by direct communication.