GDPR Compliance Addendum / Considerations for Citadel-i-Projects

Effective Date: January 9, 2026

Citadel-i-Projects is based in Nigeria and primarily serves users in Nigeria and other regions. However, the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) may apply to our processing of personal data if we offer educational services (tutoring, exam preparation, and counseling) to individuals located in the European Union (EU) or the European Economic Area (EEA), even if we have no physical establishment in the EU.

This addendum outlines key GDPR compliance considerations and supplements our main Privacy Policy. If GDPR applies to your data, you benefit from its protections in addition to the rights described in our Privacy Policy and under applicable local law (such as the Nigeria Data Protection Act).

When Does GDPR Apply to Citadel-i-Projects?

GDPR has extraterritorial effect (Article 3(2)). It applies to our processing of personal data of individuals in the EU/EEA when we:

• Offer goods or services to them (even free services like registration for tutoring sessions, counseling, or exam resources), or
• Monitor their behavior (e.g., through cookies, analytics, or usage tracking on our Website).

Indicators that may trigger GDPR include:

• Website accessible in EU countries without geo-blocking
• Content or marketing targeted at EU users (e.g., references to EU exams, currencies, languages)
• Accepting registrations/payments from EU-based students or teachers

If you are located in the EU/EEA and use our services, GDPR likely applies to your data. We do not specifically target the EU market, but we do not block EU access either. We therefore take a cautious approach and provide GDPR-aligned information.

Key GDPR Principles We Follow

We adhere to the core GDPR principles (Article 5):

• Lawfulness, fairness, and transparency — We process data on lawful bases only.
• Purpose limitation — Data is collected for specific, explicit purposes.
• Data minimization — We collect only what is necessary.
• Accuracy — We take reasonable steps to keep data accurate.
• Storage limitation — Data is kept no longer than necessary.
• Integrity and confidentiality — Appropriate security measures are in place.
• Accountability — We document our compliance efforts.

Lawful Bases for Processing (Article 6)

We rely on the following lawful bases depending on the context:

• Contract — To provide tutoring, exam preparation, counseling, and account services.
• Consent — For certain marketing communications, optional features, or non-essential cookies.
• Legitimate interests — For security, fraud prevention, service improvement, and analytics (balanced against your rights).

For special categories of data (e.g., health data related to educational accommodations), we rely on explicit consent or other permitted bases under Article 9.

Information Provided Under Articles 13 & 14

In addition to our Privacy Policy, when GDPR applies we provide (or make available):

• Identity and contact details of the controller (Citadel-i-Projects).
• Purposes of processing and legal basis.
• Legitimate interests (where applicable).
• Recipients or categories of recipients.
• Retention periods or criteria.
• Your GDPR rights (see below).
• Right to withdraw consent (where processing is based on consent).
• Right to lodge a complaint with a supervisory authority.
• Whether data is transferred internationally and safeguards used.
• Whether automated decision-making/profiling occurs (we do not currently use significant automated decision-making with legal effects).

Your GDPR Rights (Chapter III)

If GDPR applies, you have the following rights (subject to legal exceptions):

• Access — Obtain confirmation of processing and a copy of your data.
• Rectification — Correct inaccurate or incomplete data.
• Erasure (“right to be forgotten”) — Request deletion in certain circumstances.
• Restriction — Limit processing in specific situations.
• Data portability — Receive your data in a structured, machine-readable format and transmit it to another controller.
• Object — Object to processing based on legitimate interests or for direct marketing.
• Object to automated decision-making — Including profiling (not applicable in our case currently).
• Withdraw consent — At any time, where processing is based on consent.

To exercise these rights, contact us at the details below. We respond within one month (extendable by two months for complex cases).

International Data Transfers (Chapter V)

As we operate from Nigeria (no EU adequacy decision currently in place for Nigeria), any transfer of EU/EEA personal data outside the EEA requires safeguards. We use:

• Standard Contractual Clauses (SCCs) approved by the European Commission, or
• Other appropriate safeguards permitted under Articles 46–49.

We do not transfer data to countries without adequate protection unless safeguards or derogations apply.

Children’s Data (Article 8)

For information society services, consent for children under 16 requires verifiable parental consent (some EU countries allow 13+). We take extra care with users under 18, requiring parental/guardian involvement where appropriate.

Data Protection by Design & Default (Article 25)

We implement privacy-friendly measures from the start (e.g., data minimization, pseudonymization where possible, strong security defaults).

Data Processors (Article 28)

We use processors (e.g., cloud hosting, payment providers) bound by GDPR-compliant agreements.

Contact for GDPR Matters

Data Controller: Citadel-i-Projects
Email: privacy@citadelprojects.com (or insert your dedicated privacy email)
Address: [Your Lagos address]

If we appoint a EU Representative (Article 27) or Data Protection Officer (Article 37), we will update this notice.

For complaints, you may contact your local EU supervisory authority (e.g., via https://edpb.europa.eu/about-edpb/board/members_en).

This addendum is not legal advice. For personalized guidance, consult a data protection lawyer familiar with both Nigerian and EU law. We regularly review our practices to align with evolving requirements.