Privacy Policy

Last updated: September 2026

This Privacy Policy explains how xHSE Enterprises (“The HSE Exchange”, “we”, “us”) collects, uses, stores and shares personal data when you visit www.thehseexchange.com, register an account, purchase a course or contact us. We are the data controller for this data. This policy complies with the Nigeria Data Protection Act 2023 (“NDPA”) and the regulations issued under it.

1. Personal data we collect

Information you give us:

Account and enrolment details: name, email address, phone number, and, where relevant, your employer, job title, and location.
Payment details: transaction reference, amount, date and payment method. Card and bank details are entered directly with our payment provider and are never stored on our servers.
Learning records: courses enrolled in, lessons completed, quiz and assessment results, certificates issued, and the unique certificate number.
Communications: messages you send us by email, WhatsApp, the contact form or discussion areas, and any feedback or testimonials you provide.
Corporate information: where an employer enrols you, the name of that organisation and the contact person who arranged it.

Information collected automatically:

Technical data: IP address, browser type and version, device type, operating system and screen size.
Usage data: pages visited, time spent, video playback progress, login times and referring website.
Cookies and similar technologies, described in section 6.

2. How we use personal data and our lawful basis

To create and manage your account and deliver the courses you purchase (performance of a contract).
To process payments, issue receipts and prevent fraud (performance of a contract; legal obligation).
To track your progress, mark assessments and issue and verify certificates (performance of a contract).
To respond to your enquiries and provide support (performance of a contract; legitimate interest).
To send service messages about your account, courses and changes to our terms (performance of a contract).
To send news about new courses, offers and events, only where you have opted in, and you can opt out at any time (consent).
To analyse how the Site is used so that we can improve it (legitimate interest; consent for analytics cookies).
To comply with legal obligations, including tax, accounting and regulatory requirements (legal obligation).
To publish testimonials or case studies, only with your express permission (consent).

3. Certificate verification

Our certificate verification page allows anyone holding a certificate number to confirm that the certificate is genuine. The verification result shows the certificate holder’s name, the course title and the date of completion. No other personal data is displayed. By completing a course, you agree that this limited information may be shown to a person who enters your certificate number.

4. Who we share data with

We do not sell personal data. We share it only with service providers who need it to help us run the Site, each bound by contract to protect it:

Payment processing: Paystack, which processes your payment under its own privacy policy.
Web hosting and security: our hosting provider, Namecheap, and security services that protect the Site.
Video hosting: course videos are streamed from YouTube (Google), which may set its own cookies and collect playback data under its own policy.
Email delivery: FluentCRM for transactional and, where you have opted in, marketing email.
Your employer, where an organisation has enrolled you and needs to confirm completion, in which case we share enrolment status, completion date and certificate details only.
Regulators, courts or law enforcement where required by law.

5. International transfers

Some of our service providers store data outside Nigeria, including in the European Union and the United States. Where this happens, we rely on the provider’s contractual commitments and recognised safeguards to ensure that your data receives protection consistent with the NDPA.

6. Cookies

We use cookies and similar technologies. When you first visit the Site, a banner allows you to accept or reject each category:

Necessary cookies keep you logged in, remember your cookie choices and keep the Site secure. They cannot be switched off.
Analytical cookies help us understand how visitors use the Site. They are set only if you accept them.
Functional cookies support embedded video and other third-party features. They are set only if you accept them.

You can change your choices at any time using the cookie settings link in the footer, or through your browser settings. Blocking necessary cookies may prevent parts of the Site from working.

7. How long we keep data

Account and learning records: for as long as your account is active, and for 7 years after it closes so that certificates can continue to be verified and to meet legal requirements.
Payment records: 7 years, as required by Nigerian tax and accounting law.
Marketing consent: until you withdraw it.
Enquiries from people who do not become students: 12 months.
Technical logs: up to 90 days.

8. Security

The Site is served over HTTPS. Passwords are stored in hashed form and are never visible to us. Access to student data is limited to people who need it to run the Site. Payment data is handled entirely by our PCI-DSS-compliant payment provider. No system is completely secure, and if we become aware of a breach that is likely to affect your rights we will notify you and the Nigeria Data Protection Commission as required by the NDPA.

9. Your rights

Under the NDPA, you have the right to:

Access the personal data we hold about you and receive a copy;
Ask us to correct data that is inaccurate or incomplete;
Ask us to delete your data, subject to our need to keep certificate and financial records;
Object to or restrict certain processing, including direct marketing;
Withdraw consent where processing is based on consent;
Receive your data in a portable format; and
Lodge a complaint with the Nigeria Data Protection Commission (NDPC).

To exercise any of these rights, contact us at Support@thehseexchange.com. We will respond within 30 days. We may ask you to confirm your identity first.

10. Children

The Site and our courses are intended for professionals aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us with personal data, contact us, and we will delete it.

11. Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed. Material changes will be notified by email to registered students or by a notice on the Site.

12. Contact

Data protection enquiries: xHSE Enterprises, Plot 10, Road 10, Femi Olugbile Street, Lagos, Nigeria. Email: Support@thehseexchange.com.