QUIZATHON: SHAREHOLDER EDITION, 2026

Privacy Notice

In short: We collect only what we need to register you, deliver the free Investment course, run and proctor the Quizathon, verify that you are an eligible student, and transfer prize shares to winners. We do not sell your data. We will only send you marketing messages if you tick the separate box that asks for it. If you are under 18, we need your parent or guardian’s consent before you can take part.

1. Who we are

The Dangote Refinery Students’ Quizathon (the “Quizathon”) is organised by FlexiSAF Edusoft Limited (RC 1049465) through Distinction Labs, operator of the Distinction learning platform (distinction.app) (“FlexiSAF”, “we”, “us”), in collaboration with the Aliko Dangote Foundation (“ADF”).

For the purposes of the Nigeria Data Protection Act 2023 (“NDPA”) and the NDPA General Application and Implementation Directive 2025 (“GAID”):

• FlexiSAF is the data controller for registration, the course, the Quizathon, scoring and ranking.

• FlexiSAF and ADF are joint controllers for winner verification and prize award.

Registered address: 3 Egbedi Close Off Ladoke Akintola Boulevard, Garki Abuja. Data Protection Officer: Raji Bashir, dpo@flexisaf.com, +234 8035892220.

2. Information we collect

We do not ask for bank account passwords, card details, PINs or payment of any kind. Nobody acting for the Quizathon will ever ask you to pay to enter, to “unlock” a prize, or to buy shares.

3. Why we use your information, and our lawful basis

Your marketing consent is never a condition of entry. Saying no will not affect your eligibility or your score.

4. Participants under 18

Under the NDPA, anyone under 18 is a child. If you are under 18:

• your parent or legal guardian must give consent on the registration form before your account is activated;

• we may contact your parent or guardian to confirm that consent and may ask for reasonable evidence of their identity and relationship to you;

• if you win, prize shares will be transferred into a CSCS account opened for you through your parent or guardian, in line with stockbroker account-opening rules for minors;

• we will not send you marketing messages, and we will not publish your full name, photograph or institution without your parent or guardian’s permission.

If we learn that we hold a child’s data without valid parental consent, we will suspend the account and delete the data unless the consent is provided promptly.

5. Who we share your information with

We share only what each party needs, under written agreements that require them to protect it:

• Aliko Dangote Foundation: winners’ identity, institution, score and prize details, to co-fund and award the prize shares.

• Your institution and COMDICT-NTI (Committee of Directors of ICT of Nigerian Tertiary Institutions): your name, institution and registration number, solely to confirm you are a current student.

• Stockbroker, registrar and issuing house: winners’ KYC and CSCS details, solely to transfer prize shares.

• Service providers that host and support the platform, send emails or SMS, and provide analytics (AWS Cloud, Multitexter SMS service and Google Analytics).

• Regulators, law enforcement or courts, where the law requires it.

We do not sell or rent your personal data, and we do not share it with Dangote Petroleum Refinery for marketing.

6. Winners’ lists and publicity

To keep the competition transparent, we may publish a winners’ list showing first name, last initial, institution and rank. We will not publish phone numbers, email addresses, student numbers or ID documents. Photographs, videos or testimonials will only be used with your separate consent (and your parent or guardian’s, if you are under 18).

7. Transfers outside Nigeria

Some of our service providers store or process data outside Nigeria. Where that happens, we transfer data only as permitted by Part VIII of the NDPA and the GAID: to countries or organisations with adequate protection, under appropriate contractual safeguards, or on another lawful basis. You can ask the DPO for details of the safeguards used.

8. How long we keep your information

9. How we protect your information

We use encryption in transit, access controls limited to staff who need the data, logging and regular review of our security measures. Verification documents and KYC data are held in restricted storage. If a personal data breach is likely to result in a risk to your rights, we will notify the Nigeria Data Protection Commission within 72 hours and inform you without undue delay where the risk is high, as the NDPA requires.

10. Your rights

Under the NDPA you have the right to:

• be informed about how your data is used and get a copy of it;

• have inaccurate data corrected and, in certain cases, deleted;

• restrict or object to processing, including at any time to direct marketing;

• withdraw consent at any time (this does not affect processing already carried out);

• receive your data in a portable format;

• not be subject to a decision based solely on automated processing that significantly affects you. Final disqualification decisions are always reviewed by a person.

To exercise a right, email dpo@flexisaf.com. We will respond within the time the law requires. If you are not satisfied, you may complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

Please note that withdrawing consent or asking us to delete data before the prize stage is complete may mean we can no longer verify your eligibility or transfer prize shares to you.

11. Cookies

The landing page uses strictly necessary cookies to work. Analytics cookies (Google Analytics) are set only if you accept them in the cookie banner, and you can change your choice at any time via the Cookie settings page of your internet browser.

12. Changes to this notice

We may update this notice. Material changes will be posted on this page and, where appropriate, notified to you by email. The version and effective date are shown at the top.

13. Contact

Data Protection Officer, FlexiSAF Edusoft Limited, 3 Egbedi Close, Off Ladoke Akintola Boulevard, Garki Abuja. Email: dpo@flexisaf.com. Phone: +234 8035892220.