Privacy Policy

Effective Date: November 13, 2026 · Last Updated: November 2026

Devwalls Security Limited (“Devwalls”, “we”, “us”) is committed to protecting your privacy and treating your personal data with utmost transparency and security. This Privacy Policy details how we collect, process, safeguard, and respect your information across Devwalls Academy.

1. Information We Collect

We collect information necessary to deliver authenticated cybersecurity training, record your flag submissions, and issue verifiable credentials:

Account Identity

Google profile identifier, legal name, email address, and profile picture obtained via Google OAuth 2.0.

Learning Telemetry

Room completion statuses, quiz answers, CTF flag hashes submitted, time spent per module, streak history, and XP totals.

Exam Records & Certs

Exam score percentage, question attempt timestamps, pass/fail status, and unique certificate verification identifiers.

Billing Metadata

Payment transaction reference IDs, Pro plan activation dates, and currency (NGN/USD). We never store raw payment card credentials.

2. How We Use Your Information

To authenticate you and sustain your authorized laboratory sessions.
To compute XP scores, maintain the student leaderboard, and track active streaks.
To grade certification examinations fairly and render public verification pages for employers.
To prevent platform abuse, automate rate-limiting, and safeguard sandbox infrastructure.
To deliver important educational announcements (system updates, new room releases).

3. Legal Basis for Processing (GDPR & NDPR)

Under the Nigeria Data Protection Act (NDPA) and European General Data Protection Regulation (GDPR), we process your personal data under the following lawful bases:

Contractual Necessity: Delivering course materials and issuing certificates requested by your account.
Legitimate Interests: Protecting platform security against cyber attacks, preventing cheating on exams, and monitoring laboratory capacity.
Consent: For optional marketing updates or non-essential cookies, which you may withdraw at any time.

Enterprise Security Standard

5. Data Security Standards

As a cybersecurity company, we apply defense-in-depth principles across all data pipelines:

All web traffic is encrypted using modern TLS 1.3 with HSTS enabled.
Database volumes are encrypted at rest using AES-256 with strict role-based access controls.
Authentication session tokens are cryptographically signed with high-entropy secrets and transported over HTTP-only, secure, SameSite cookies.
Ephemerally provisioned sandbox containers are physically and logically segregated from database backends.

6. Your Data Rights & Choices

Under the Nigeria Data Protection Act (NDPA 2023, Sections 34–37) and General Data Protection Regulation (GDPR, Articles 15–22), you hold enforceable statutory rights over your personal data:

Right to Erasure & Self-Service Account DeletionNDPA §34 · GDPR Art. 17

You can permanently delete your user account and purge all associated personal data at any time directly through your learner dashboard at Dashboard > Profile > Danger Zone (Delete Account). Upon confirmation, your profile, authentication records, room completions, quiz answers, CTF flags, XP events, and verifiable certificate lookup entries are immediately and irreversibly erased from our production databases. You may also email dpo@devwalls.com to request manual erasure.

Right to Withdraw Consent & Email UnsubscribeNDPA §35 · CAN-SPAM

You may opt out of non-essential communications (including weekly cyber intel digests, daily streak alerts, achievement badges, and platform updates) at any time through three methods:

Toggling the Marketing & Weekly Intel Emails switch in your Account Profile.
Clicking the Unsubscribe link found in the footer of any notification email.
Entering your registered email on our public Unsubscribe Portal.

*Note: Critical security alerts (unauthorized login warnings, session terminations) and statutory transaction invoices (Bachs payment confirmations) cannot be opted out of while an account remains active.

Certificate Name Privacy ControlNDPA §24

By default, you can toggle whether your legal name appears publicly on certificate verification queries at /verify/[code] or displays as “Verified Learner” to protect your identity from search engine scraping and automated directories.

Right of Access, Rectification & Cookie Preferences

You may request a machine-readable export of your learning telemetry or correct inaccurate profile information by contacting our privacy team. Manage cookie consents anytime via our Cookie Preferences.

7. Data Retention & Erasure Timelines

We retain personal data only for as long as necessary to provide training services and fulfill educational or legal obligations:

Active Accounts: Learning telemetry, flags, and certificates remain stored to ensure continuous verification by employers and LinkedIn integrations.
Upon Account Deletion: All user records, room progress, flags, XP metrics, and certificates are deleted immediately and permanently.
Financial Invoicing: Payment reference numbers and transaction logs required by Nigerian fiscal and audit laws are retained in isolated accounting ledgers disconnected from student learning profiles for the statutory audit period.
Security & Abuse Logs: Ephemeral server access logs are purged on a rolling 30-day retention schedule.

8. Data Protection Officer (DPO) Contact

To exercise any of your data rights or lodge a privacy inquiry:

Data Protection Officer: dpo@devwalls.com

Privacy Office: privacy@devwalls.com

Address: Devwalls Security Limited, Lagos, Nigeria