Privacy policy

For the people in a workspace (staff and learners), the organization that runs the workspace is the data controller: it decides who is invited and what training they take. LMS processes that data on the organization's behalf. Questions about your training record are best sent to your organization first.

For running and securing the service, LMS, Lagos, Nigeria, is the data controller.

• Account: your name, email address, password (stored only as a one-way hash), profile photo if you add one, and your notification choices.
• Workspace role: your role, department, job title and the groups you are in, as set by your organization.
• Learning record: courses assigned to you, progress, time spent learning each day, quiz answers and scores, notes you write, work you hand in and the feedback on it, and certificates issued to you.
• Exam monitoring, where your organization turns it on for a quiz: how often you left the quiz page during an attempt.
• Messages: notifications and announcements sent to you, and emails we send on your organization's behalf.
• Security and audit: when you sign in, your device's browser name and IP address, and a log of important changes made in the workspace and who made them.

• To provide the service your organization uses: showing your training, recording completion, issuing certificates anyone can verify, and sending reminders. (Performing our contract with your organization.)
• To keep the service secure and working, to prevent misuse, and to fix problems. (Our legitimate interest in running a safe service.)
• To keep the official record of training and certification your organization is required to hold. (Your organization's legal obligations and public duties.)

People in your organization with the right role (administrators, your manager, course instructors) see your training record. Anyone you give a certificate link to can see that certificate. We also use these service providers, under contracts that require them to protect the data:

• Our hosting and database provider, which stores everything.
• Our email provider, which delivers invitations, reminders and notices.
• OpenAI, only when your organization uses AI features: course documents to draft courses and questions, and a learner's question plus the matching course passages for the study mate. We don't send names or email addresses, and OpenAI doesn't use this data to train its models.

We don't sell personal data or use it for advertising.

Some of these providers process data outside Nigeria. Where they do, we rely on the safeguards the Nigeria Data Protection Act allows, such as contractual clauses and the provider's own protections.

• Training records and certificates are kept while the workspace exists, because organizations need them to show training was done.
• When a person is removed from a workspace, their record there stays with the organization. When someone deletes their account, we remove their name, email and photo; the organization keeps the anonymous training record.
• When an organization asks us to delete its workspace, we delete it within 30 days. Backups are overwritten within a further 30 days.

We use only the cookies needed to keep you signed in securely. We don't use advertising or tracking cookies. Your browser also remembers small preferences on your device, such as light or dark mode.

Data travels encrypted. Passwords are stored as one-way hashes. Each organization's data is kept apart from every other organization's, and access within a workspace follows the roles your organization sets. Important changes are logged.

You can ask for a copy of your data, ask us to correct or delete it, object to how it is used, or ask for it in a form you can take elsewhere. You can change your name, photo and notification choices, and delete your account, yourself on your account page.

For data in a workspace, start with your organization; we'll help them respond. Otherwise write to privacy@lms.example. We reply within 30 days. You can also complain to the Nigeria Data Protection Commission.

The LMS is for workplaces and isn't meant for anyone under 16.

We'll update this page when what we collect or who we share it with changes, and tell workspace owners about significant changes. See also our terms of service.