Effective date: 22 July 2026
Bayero University Kano, acting through its Centre for Distance Learning (the “Institution”, “we”, “us” or “our”), respects your privacy and is committed to protecting your personal data. This Privacy Notice explains how we collect, use, disclose, retain and protect personal data when students, applicants, staff and other authorised users interact with our admissions, administration and learning services through Klastra.
The Institution is the Data Controller for the personal data described in this notice. We determine why personal data is processed and how that processing is carried out.
This notice should be read together with any programme-specific, employment, admissions or other privacy information provided by the Institution.
Klastra is the software platform used by the Institution to manage admissions, student and staff records, learning activities, assessments, results, payments and related institutional processes.
Klastra was built and initially deployed by Voostech. The platform is delivered to the Institution without student or staff records. Following deployment, the Institution’s authorised personnel populate and administer the system on infrastructure controlled by the Institution.
Voostech does not have routine access to personal data stored in the Institution’s production deployment. If the Institution separately authorises Voostech or another provider to access personal data for support, maintenance, migration or another service, that access will be limited to the authorised purpose and governed by appropriate confidentiality, security and data-protection obligations.
This notice applies to:
Depending on your relationship with the Institution and the services you use, we may process:
We may obtain personal data:
The Institution may process personal data to:
The lawful basis depends on the purpose and circumstances. We may process personal data where:
Where we rely on consent, you may withdraw it at any time. Withdrawal will not affect processing that was lawful before the withdrawal. We do not rely on consent where processing is mandatory and another lawful basis is more appropriate.
Where necessary and lawfully permitted, personal data may be disclosed to:
We do not sell personal data.
Where personal data is transferred outside Nigeria, the Institution will apply safeguards required by applicable data-protection law. These may include an approved transfer mechanism, contractual protection and an assessment of the destination and recipient.
The Institution retains personal data only for as long as reasonably needed for the purpose for which it was collected and to meet academic, financial, legal, accreditation, security and regulatory obligations.
Different records require different retention periods. Permanent or long-term academic records, such as final results and transcripts, may need to be retained for significantly longer than support requests, temporary uploads, application drafts or routine technical logs. When personal data is no longer required, it will be securely deleted, anonymised or archived in accordance with the Institution’s approved records-retention schedule.
The Institution applies reasonable and appropriate administrative, physical and technical measures to protect personal data. Depending on the deployment, these measures may include role-based access, authentication controls, encryption, activity logging, backups, staff confidentiality obligations, security monitoring and incident-response procedures.
Access is limited to authorised persons who require personal data for approved institutional duties. Users are responsible for protecting their passwords, signing out of shared devices and promptly reporting suspected unauthorised access.
The Institution maintains procedures for assessing and responding to suspected personal data breaches. Where a breach is likely to create a risk to affected individuals, the Institution will notify the Nigeria Data Protection Commission within the period required by applicable law. Where a breach is likely to result in a high risk to an individual, the Institution will also communicate relevant information to that individual as required by law.
Subject to applicable law and lawful limitations, you may have the right to:
To exercise a right, contact the Privacy Office using the details below. We may need to verify your identity. Some requests may be limited where retention or continued processing is required by law, academic-record obligations, the rights of another person or another lawful ground.
Where the Institution provides services to a child or another person who requires legally recognised assistance, it will apply appropriate safeguards. These may include age verification, guardian or representative involvement, accessible notices and additional controls over sensitive information, as required by law and institutional policy.
Klastra uses essential cookies and similar technologies to authenticate users, maintain sessions, remember necessary preferences and protect the platform. These technologies are required for the service to operate securely.
We may update this Privacy Notice when our processing activities, institutional services or legal obligations change. The current version will be published on this page with its effective date. Where a change materially affects how personal data is processed, the Institution will take reasonable steps to bring it to the attention of affected users.
Data Controller
Bayero University Kano
Centre for Distance Learning
PMB 3011, Kano State, Nigeria
Privacy Office
Email: cdl@buk.edu.ng
Telephone: 07085753547, 08140036765
Please contact us first if you have a concern about how your personal data is handled so that we can investigate and respond. You also have the right to submit a complaint to the Nigeria Data Protection Commission through its official channels.