Regional privacy addenda

1. How these addenda work

Last updated: 10 October 2026.

Our privacy notice and data processing agreement are written to the UK GDPR standard and apply everywhere. The sections below add what is different in each region. Where local law gives you more protection, it applies. These summaries are general and do not replace your own legal advice. In our legal documents, "Oxonia Academy", "Oxonia", "we" and "us" mean Oxford City Academy for Education and Development (OAED), of which Oxonia Academy is part. Its registered office is [Registered office address].

In every region the roles are the same: a university is the controller (or its local equivalent) for student and staff data, and we are its processor. We are the controller for our website, marketing and event leads. To use any right, see Data requests or email privacy@oxonia.ai.

2. European Union

The EU GDPR applies when we offer our Services to people in the EU. Our representative in the EU under Article 27 is [EU representative: name and address]. You can contact them, or us at privacy@oxonia.ai, about any data protection matter.

Transfers of personal data from the EU to us in the UK rely on the European Commission's adequacy decision for the UK, or on the EU standard contractual clauses if that decision is not available. Onward transfers to other countries use the safeguards in our privacy notice. You can complain to the supervisory authority in the EU country where you live or work, or where the issue happened.

3. Nigeria

The Nigeria Data Protection Act 2023 (NDPA) and the regulations and directives of the Nigeria Data Protection Commission (NDPC) apply to data about people in Nigeria. You have rights to information, access, correction, deletion, restriction, portability, objection and withdrawal of consent, and not to be subject to decisions based solely on automated processing.

Personal data leaves Nigeria only where the NDPA allows, for example to a country with adequate protection or under appropriate safeguards such as contractual clauses. We help universities meet their duty to report personal data breaches to the NDPC within 72 hours. Our NDPC registration status is [NDPC registration status]. You can complain to the NDPC at ndpc.gov.ng.

4. Ghana

Ghana's Data Protection Act 2012 (Act 843) applies to data about people processed in Ghana. You have rights to access your data, to have it corrected or deleted, and to object to processing, including for direct marketing. Our registration with the Data Protection Commission is [Ghana Data Protection Commission registration status]. You can complain to the Data Protection Commission at dataprotection.org.gh.

5. Kenya

Kenya's Data Protection Act 2019 and its regulations apply to data about people in Kenya. You have rights to be informed, to access, correct and delete your data, to object, and to data portability. Transfers out of Kenya are made only with appropriate safeguards, and sensitive personal data only with your consent where the Act requires it.

As a processor, we notify the university of a personal data breach within 48 hours, so that it can notify the Office of the Data Protection Commissioner (ODPC) within 72 hours. Our ODPC registration status is [ODPC registration status]. You can complain to the ODPC at odpc.go.ke.

6. South Africa

The Protection of Personal Information Act 2013 (POPIA) applies to information processed in South Africa. The university is the responsible party and we are its operator. You have rights to access and correct your information, to object, and to complain. Information about anyone under 18 is protected as children's information, and universities must have a lawful justification, such as the consent of a competent person, before processing it.

We tell the university of any security compromise as soon as reasonably possible so that it can notify the Information Regulator and the people affected. Transfers out of South Africa meet section 72 of POPIA. You can complain to the Information Regulator at inforegulator.org.za.

7. Malaysia

Malaysia's Personal Data Protection Act 2010, as amended by the Personal Data Protection (Amendment) Act 2024, applies to personal data processed in commercial transactions. Under the amended Act, processors such as us must keep data secure, data users must notify the Personal Data Protection Commissioner of serious breaches and in some cases tell the people affected, and you have a right to data portability, as well as rights of access, correction and withdrawal of consent.

Transfers out of Malaysia are made only where the destination has laws substantially similar to the Act, or where the data will be protected to an equivalent standard. You can complain to the Personal Data Protection Commissioner at pdp.gov.my.

8. Turkey

Turkey's Law No. 6698 on the Protection of Personal Data (KVKK) applies to data about people in Turkey. Under Article 11 you may ask whether your data is processed, get information about it, learn the purpose and who receives it, ask for correction or deletion, object to results of solely automated analysis that affect you, and claim compensation for unlawful processing. We reply to applications within 30 days, free of charge.

Transfers abroad follow Article 9 of the KVKK as amended in 2024, for example under an adequacy decision or standard contractual clauses notified to the Personal Data Protection Authority. Our VERBIS registration and data controller representative in Turkey, where required, are [VERBIS registration and Turkish representative details]. You can complain to the Personal Data Protection Board at kvkk.gov.tr after first applying to us.

9. United Arab Emirates and Saudi Arabia

United Arab Emirates. The Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) applies to data about people in the UAE, outside the financial free zones, which have their own laws, such as the DIFC and ADGM data protection laws. You have rights to information, access, correction, deletion, restriction, objection and portability, and to object to decisions based solely on automated processing.

Saudi Arabia. The Personal Data Protection Law (PDPL) and its implementing regulations apply to data about people in Saudi Arabia, overseen by the Saudi Data and Artificial Intelligence Authority (SDAIA). You have rights to be informed, to access and get a copy of your data, to have it corrected, and to have it destroyed when no longer needed. Transfers out of Saudi Arabia follow the PDPL transfer regulations, and we help universities report breaches to SDAIA within 72 hours.

Qatar, Bahrain, Oman and Kuwait have their own data protection laws, and we apply the same standards there. Questions: privacy@oxonia.ai.