Privacy Policy

1. Who we are

Haske is an online Islamic school offering live one-to-one classes in Quran, Hadith, and Arabic to the Nigerian Muslim community, accessible at haskehq.com. Haske is a product operated by Flexigrid Solutions Ltd (“we”, “us”, “our”, or “Haske”), a company registered in Nigeria with registration number RC 8642152, at Plot 1366, Edmund Madani Crescent, Abuja, FCT, Nigeria.

For the purposes of the Nigeria Data Protection Act 2023 (the “NDPA”), we are the data controller of the personal data described in this Policy — meaning we determine how and why your personal data is processed — and we process personal data in accordance with the NDPA. Flexigrid Solutions Ltd is registered with the Nigeria Data Protection Commission (the “NDPC”) as a data controller of major importance, registration number NDPC/DCP/14276.

This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and the rights you have over your data. It applies to everyone who uses Haske — guardians and their children, teachers, publishers, and reviewers.

2. A note for parents and guardians (plain language)

Because Haske teaches children, we have written this section in plain language so that both parents and older children can understand it. The rest of this Policy gives the full detail.

• A child cannot open a Haske account on their own. A parent or guardian opens the account and adds their child as a “learner”.
• We ask the parent or guardian to give consent before we collect any information about their child, and we keep a record of that consent.
• The parent or guardian stays in control — they book the classes, make payments, receive the class links, and can ask us to correct or delete their child’s information at any time.
• We only collect the information we need to run the classes. We do not sell anyone’s data, and we do not show advertising.

3. The personal data we collect

We collect the following categories of personal data, depending on who you are and how you use Haske.

4. How we collect your data

We collect personal data:

• directly from you — when you register, add a learner, apply to teach or publish, complete your profile, make a booking or payment, sign an agreement, or contact us;
• from a guardian — in the case of a child’s information, which is provided by the parent or guardian who holds the account; and
• automatically — limited technical information when you use the site, as described in Section 8.

5. Why we process your data, and our lawful bases

Under the NDPA we must have a lawful basis for processing personal data. We rely on the following:

6. Children’s data

Haske is designed so that a child is never the account holder. We treat everyone under 18 as a child for the purposes of the NDPA.

• The guardian is the account holder. A parent or guardian registers, and is the person we contract with, bill, and communicate with.
• A child is a “learner” record under the guardian’s account, not an independent login. The guardian provides the child’s name and date of birth and manages the child’s classes.
• We obtain and record parental consent before processing a child’s data. We record an explicit consent action together with the version of this Policy consented to, the date and time, and the method. We never assume or pre-tick consent.
• A person who registers and indicates they are under 18 is directed to have a parent or guardian create the account instead.

A parent or guardian may review, correct, or request deletion of their child’s personal data at any time using the contact details in Section 13. Where we later make material changes to how we handle children’s data, we will seek renewed consent as appropriate.

7. Who we share your data with

We do not sell your personal data, and we do not share it for advertising. We share it only with the service providers (“data processors”) that are necessary to operate Haske, and only to the extent needed. Each processes data on our instructions.

We may also disclose personal data where we are required to do so by law, or to establish, exercise, or defend legal claims.

8. Cookies and similar technologies

We use a small number of first-party cookies. We do not use third-party advertising or analytics trackers.

• Essential cookies keep you signed in and keep the service secure. The service cannot function without them.
• Attribution cookies. When you browse our free articles, we store a pseudonymous visitor identifier. If you later read an article and go on to book a trial class and register, we link the article you read to that booking, so we can understand which content leads people to our teachers. This means a previously anonymous reader becomes identifiable to us at the point of booking. These cookies last for up to 30 days.

9. Transfers outside Nigeria

Some of the service providers in Section 7 (for example, our file storage, email, and video providers, including LiveKit, which carries live class video) operate on infrastructure that may be located outside Nigeria. Where your personal data is transferred outside Nigeria, we take steps consistent with the NDPA to ensure it remains protected, including relying on providers that offer an adequate level of protection or contractual safeguards. By using Haske you understand that your data may be processed outside Nigeria for these purposes.

10. How long we keep your data

We keep personal data only for as long as we need it for the purposes set out in this Policy, and to meet our legal obligations. In general:

• Account and learner data — for as long as your account is active, and for a reasonable period after the account is closed, as required to meet our legal and operational obligations.
• Financial and transaction records — retained for as long as required by applicable Nigerian tax and financial law, even after an account is closed.
• Signed agreements and parental-consent records — retained as evidence for as long as necessary to establish, exercise, or defend legal claims.
• Backups — personal data may persist in secure backups for up to 7 days after deletion, until the backup cycle rotates.

11. Your rights

Under the NDPA you have the right to:

• access the personal data we hold about you;
• correct data that is inaccurate or incomplete;
• request deletion of your personal data (“erasure”), subject to the exceptions below;
• object to or restrict certain processing;
• withdraw consent where we rely on it (this does not affect processing already carried out);
• data portability — to receive certain data in a usable format; and
• lodge a complaint with the NDPC.

A guardian may exercise these rights on behalf of their child.

Please note that some data cannot always be fully erased. Where we are legally required to keep certain records (for example, financial and transaction records), we will remove or de-identify your personal information while retaining the minimum records the law requires. We will tell you when this applies to a request.

12. Exercising your rights, and how we protect your data

Making a request

You can request erasure of your account from within the Haske app, or exercise any of your rights by contacting us using the details in Section 13. An administrator reviews and actions erasure requests. We aim to respond within a reasonable time and in accordance with the timeframes required by the NDPA.

How we protect your data

• Passwords are stored only in hashed form; we never hold them in plain text.
• Full bank account numbers are held by our payment processor, not by us — we keep only a secure token and the last four digits.
• Access to personal data is restricted to the roles that need it, and sensitive operations run on our secured servers.
• Data is encrypted in transit, and we take reasonable technical and organisational measures to protect it.

13. Contact us about your data

If you have any question about this Policy, or wish to exercise any of your rights, please contact us:

Flexigrid Solutions LtdEmail: info@flexigridsolutions.comAddress: Plot 1366, Edmund Madani Crescent, Abuja, FCT, Nigeria

You also have the right to lodge a complaint directly with the Nigeria Data Protection Commission if you believe your personal data has been handled unlawfully.

14. Changes to this Policy

We may update this Policy from time to time. When we do, we will change the “Last updated” date and version above, and, where a change materially affects how we handle personal data — particularly children’s data — we will take appropriate steps to notify you and, where required, seek renewed consent. The version recorded against your consent tells you which version of this Policy you agreed to.