Africa Privacy Supplement
Last updated: August 22, 2026
Overview
Africa is not a single privacy regime. This supplement covers our initial priority markets: Nigeria, South Africa, and Kenya. It supplements the General Privacy Policy. We will add countries as our customer footprint expands.
For school deployments, see also the Schools & Institutions Privacy Notice.
Nigeria, Nigeria Data Protection Act 2023 (NDPA)
- Regulator: Nigeria Data Protection Commission (NDPC)
- Reach: May apply when processing personal data of data subjects in Nigeria, including by organizations outside Nigeria
- Focus for Omnix360: Lawful basis, data subject rights, contracts with processors, cross-border transfers, care with children’s data
- Requests: connect@thegrowwise.com; complaints may also be directed to the NDPC where applicable
South Africa, Protection of Personal Information Act (POPIA)
- Regulator: Information Regulator
- Children: Processing personal information of a child (under 18) is restricted. Processing generally requires consent of a competent person (parent/guardian) and, in some cases, prior authorization from the Regulator
- Transfers: Cross-border transfers require an adequate level of protection or another POPIA-permitted mechanism (section 72)
- Focus for Omnix360: Lawful processing conditions, children’s data, Institutional agreements, transfer safeguards
- Requests: connect@thegrowwise.com
Kenya: Data Protection Act, 2019
- Regulator: Office of the Data Protection Commissioner (ODPC)
- Focus for Omnix360: Consent and processing principles, data subject rights, registration obligations where applicable, cross-border transfers
- Requests: connect@thegrowwise.com
Shared commitments across these markets
- We do not sell student education records
- We do not use student education records for behavioral targeted advertising
- International hosting and subprocessors are described in the General Privacy Policy and Subprocessor List