Attenova

Privacy Policy

Effective Date: August 14, 2026

Last Updated: August 14, 2026

1. Introduction

Attenova is a product and service operated by DWS CODES LTD ("Company," "we," "us," "our"). DWS CODES LTD is the registered company behind the Attenova platform and is responsible for the operation, processing, and governance of the Service described in this Privacy Policy.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application, web services, and related platforms (collectively, the "Service").

This Privacy Policy applies to all users, including students, lecturers, administrators, hostel managers, and portal users ("Users," "you," "your").

Please read this Privacy Policy carefully. By accessing or using Attenova, you acknowledge that you have read, understood, and agree to be bound by all the terms of this Privacy Policy.

---

2. Information We Collect

2.1 Information You Provide Directly

Account Registration Data:

• Email address
• Full name
• School/institution affiliation
• Role (student, lecturer, admin, hostel manager)
• Phone number (optional)
• Profile picture (optional)

Authentication & Verification:

• Password (encrypted and never stored in plain text)
• JWT tokens for session management
• Facial biometric data for liveness detection and identity verification during enrollment
• Firebase Cloud Messaging (FCM) tokens for push notifications

Attendance & Marking Data:

• Attendance records (date, time, class/chapel/hostel session attended)
• GPS coordinates and location data at time of attendance marking
• Marked as present/absent/late status
• Leave requests and approval/rejection notes
• Biometric markers (face verification data) associated with attendance

Communication & Requests:

• Leave/permission requests and supporting documentation
• Messages and notes submitted through the platform
• Email addresses for notifications
• Feedback and support requests

Payment Information:

• Semester payment records
• Payment status and history
• Transaction references (actual payment processing handled by third-party providers)

2.2 Information Collected Automatically

Device & App Usage:

• Device type, operating system, and version
• App version and build number
• Crash logs and error reports
• Device identifiers (IDFA, Android ID)
• Screen interactions and navigation patterns
• Session duration and frequency of app usage
• Network connectivity status

Location Data:

• GPS coordinates when marking attendance (required for class/chapel/hostel attendance verification)
• Location accuracy and timestamp
• This is collected ONLY when you actively mark attendance and with your explicit consent

Connectivity & Offline Data:

• Offline queue records (pending attendance submissions)
• Sync timestamps and status
• Network connection history (online/offline status)

---

3. How We Use Your Information

3.1 Primary Uses

1. Service Delivery & Attendance Management

• Recording and tracking attendance for classes, chapels, and hostel sessions
• Processing leave requests and permissions
• Verifying your identity through facial biometrics
• Enabling offline functionality with automatic sync

1. Communication

• Sending account notifications (approval/rejection of requests)
• Attendance confirmations and summaries
• Platform updates and security alerts
• System maintenance notifications

1. Authentication & Security

• Verifying your identity
• Preventing fraud and unauthorized access
• Securing your account and data
• Investigating suspicious activity

1. Analytics & Improvement

• Analyzing usage patterns to improve the Service
• Identifying and fixing technical issues
• Optimizing app performance and reliability
• Understanding feature adoption and user behavior

1. Compliance & Legal

• Complying with applicable laws and regulations
• Responding to lawful requests from authorities
• Enforcing our Terms & Conditions
• Protecting our legal rights and interests

3.2 Legitimate Interests

We process your information based on legitimate interests including:

• Improving security and preventing fraud
• Enhancing user experience and app performance
• Conducting business analytics
• Protecting our users and company

---

4. Sharing Your Information

4.1 Information We Do NOT Share

We do NOT sell, rent, or trade your personal information to third parties for marketing purposes. We maintain strict policies against unauthorized disclosure.

4.2 Information We MAY Share

Your information may be shared with:

Educational Institution Staff

• School administrators, lecturers, and hostel managers (limited to attendance/permission data relevant to their role)
• Dean's office and academic officials (as authorized by institution policy)
• Only information necessary for their job functions
• No location data shared with lecturers except real-time during their own class

Third-Party Service Providers

We share specific data with carefully selected providers:

1. Firebase (Google)

• What we share: Push notification tokens, app crashes, general analytics
• What Firebase processes: Notification delivery, crash report analysis
• What Firebase stores: Crash logs, analytics (does NOT include attendance or location)
• Retention: Per Google's Firebase policy
• Purpose: Push notifications for attendance alerts and app stability
• Your control: Disable notifications in Settings (unsubscribes from Firebase)

1. Paystack (Payment Processor)

• What we share: Payment amount, reference ID, transaction status (NOT card details)
• What Paystack handles: Credit card processing, payment authorization
• What Paystack stores: Transaction records (per PCI DSS compliance)
• Retention: Per Paystack's PCI DSS retention policy
• Purpose: Processing semester payments
• PCI Compliance: We do NOT store, process, or transmit card details; Paystack handles this securely

1. Google Maps & Google ML Kit

• What we share: Coordinates when displaying maps; face images for on-device processing only
• What Google processes: Map rendering (on-device); face detection (on-device, not sent to Google)
• What Google stores: Map tiles viewed (per Google Maps policy); NO facial data stored
• Retention: Per Google's privacy policy
• Purpose: Displaying class/chapel locations on maps; facial recognition on your device
• Note: Google ML Kit runs entirely on your phone; face images are NOT sent to Google

1. Cloud Hosting Providers

• What we share: Encrypted data backups and database records
• What they store: All application data (accounts, attendance, payments, location)
• Retention: Until deleted from our database
• Purpose: Data storage, backup, and business continuity
• Encryption: All data encrypted in transit and at rest

1. Email Service Providers

• What we share: Your email address and notification content
• What they process: Email delivery
• Retention: Per email provider's policy
• Purpose: Sending account notifications

All Service Providers are contractually required to:

• Protect your data with security measures meeting industry standards
• Use data ONLY for the purposes we specify
• NOT share your data with third parties without authorization
• Delete data upon request or contract termination

Legal Requirements

• Law enforcement and government authorities (when required by law)
• Courts or other legal proceedings
• Protecting against fraud or security threats
• We will provide notice unless legally prohibited

Business Transfers

• In case of merger, acquisition, or asset sale
• You will be notified and given the opportunity to opt-out

4.3 Public Information

Information you choose to make public (e.g., profile picture, display name) may be visible to other users on the platform.

---

5. Biometric Data & Facial Recognition

5.1 What Facial Biometric Data Is Collected

Attenova collects and processes facial biometric data for:

• Identity Verification: Confirming you are the account holder during enrollment
• Liveness Detection: Preventing spoofing and fraud (verifying a real person is marking attendance)
• Attendance Verification: Matching attendance submissions to confirmed identity

5.2 How We Process Facial Biometric Data

On Your Device (Client-Side Processing):

• Your face image is captured by the app camera
• Google ML Kit (on-device AI) analyzes your face to detect landmarks, eye state, and head position
• A liveness test with 4 randomized challenges is performed:
• Blink detection (proves eyes are open)
• Smile detection (natural facial movement)
• Turn left (head rotation)
• Turn right (head rotation)
• MobileFaceNet (machine learning model) converts your face to a 512-dimensional embedding vector (numbers, not an image)
• Raw facial images are NEVER stored on your device
• Result: Your face is represented as a mathematical pattern (embedding vector) + liveness result

On Our Server (Server-Side Validation):

• We receive only the embedding vector and liveness result (NOT the image)
• Our system independently re-validates your liveness score
• We compare your new embedding to previous enrollments
• If match score exceeds 95%, you're authenticated
• If liveness check fails, attendance is rejected
• We do NOT trust the client's "passed" result; we always re-validate on server

Data Minimization:

• We store only the mathematical embedding (512 floats), not the image
• This allows verification without storing visual data
• No photographs or images stored on server

5.3 Your Rights Regarding Biometric Data

• You retain full ownership and rights to your biometric data
• You may request deletion of your biometric data at any time
• We do NOT share your facial biometric data with third parties (not even Google)
• Biometric data is encrypted and stored securely
• You can withdraw biometric consent by:
• Deleting your account (all biometric data removed)
• Requesting specific biometric deletion via getattenova@gmail.com

5.4 Biometric Data Retention & Deletion Schedule

Student Facial Enrollment Data:

• Retained while your account is active
• Automatically deactivated when new enrollment created (old enrollments soft-deleted)
• Deleted within 30 days of:
• Account deletion request
• Graduation or withdrawal from institution
• Explicit deletion request to getattenova@gmail.com
• You can always request re-enrollment if needed

Hostel Manager Identity Photos (Special Case):

• Identity photos used during hostel manager registration are retained for 12 months after role termination
• This allows verification of who was manager during that period
• Automatically purged after 12 months
• Can be manually deleted upon request

5.5 Your Consent to Biometric Processing

By enrolling your face in Attenova, you explicitly consent to:

• Collection and storage of facial biometric embedding vectors
• Use of embeddings for attendance verification and liveness detection
• Processing of face images on your device and embeddings on our server
• Server re-validation of all biometric attendance attempts

You can withdraw this consent at any time by:

• Requesting biometric data deletion via Settings (in app)
• Emailing getattenova@gmail.com with your student/lecturer ID
• Deleting your account entirely

Consequences of Withdrawal:

• Future liveness-verified attendance will be rejected
• You may be unable to mark attendance if institution requires biometric verification
• Contact your institution's admin to discuss alternatives

---

6. GPS Location Data

6.1 Location Collection & Purpose

• GPS coordinates are collected ONLY when you actively mark attendance
• Collection is transparent and requires your active action (clicking "mark attendance")
• Location data is tied to your attendance record for verification purposes
• Exact coordinates are stored to enable:
• Dispute resolution (proving you were at venue)
• Map display for lecturers during live class
• System compliance auditing

Why Precise Coordinates?

• We could minimize data and store only "at venue (yes/no)" but we store exact coordinates for:
• Transparent audit trails
• Dispute resolution if attendance is challenged
• Institutional requirements for precise verification
• Real-time map display for lecturers during class

6.2 Location Privacy & Access Controls

What Lecturers Can See:

• Lecturers can view real-time map of student locations during their live class ONLY
• Lecturers can see historical attendance location data for students in their classes only
• Lecturers cannot access location data from classes they do not teach
• Real-time map is displayed to lecturer only; not recorded or shared

What Admins Can See:

• Admins can see attendance location data for all students in their school
• Admins cannot view real-time location maps
• Admins cannot see location data from other schools

What Superadmins Can See:

• Superadmins can see aggregate attendance statistics
• Superadmins cannot view individual student locations without audit justification

You Can Always See:

• Your own complete location history and attendance records
• When you marked each attendance and where

6.3 Location Data Retention

Retention Timeline:

• Location coordinates retained for current academic year only
• At end of academic year (September 30), all location data automatically purged
• Location data tied to attendance for disputes is retained for 12 months
• Historical location patterns cannot be reconstructed after purge

6.4 Location Permissions

On Android and iOS, the app requests "Precise Location" permission. You may:

• Grant permission to mark attendance
• Deny permission (attendance marking will fail)
• Revoke permission anytime in device settings (this prevents using the Service)

---

7. Data Security

7.1 Security Measures

We implement comprehensive security safeguards:

In Transit:

• SSL/TLS encryption for all network communications
• Secure HTTPS connections
• End-to-end encryption for sensitive data

At Rest:

• Database encryption (AES-256)
• Encrypted file storage
• Secure key management
• Regular security audits

Access Control:

• Role-based access control (RBAC)
• Authentication via JWT tokens
• Admin approval requirements for sensitive operations
• Audit logging of administrative actions

Application Security:

• Regular dependency updates
• Vulnerability scanning and penetration testing
• Secure coding practices
• Input validation and parameterized queries

7.2 Limitations

While we implement industry-standard security measures, no system is 100% secure. We cannot guarantee absolute security of your data. You are responsible for:

• Keeping your password confidential
• Not sharing your account credentials
• Logging out after using shared devices
• Reporting suspicious activity immediately

---

8. Data Retention

8.1 Retention Periods

Active Users:

• Account data: Retained for duration of account active status
• Attendance records: Retained as an institutional record; GPS coordinates on each

record are anonymized (cleared) at the end of the academic year — see Section 11.1

• Payment records: Retained for 7 years (per tax/legal requirements)
• Biometric data: Retained until account deletion

Inactive Users:

• Accounts inactive for 2+ years: May be flagged for review
• Accounts marked for deletion: processed after a grace period (14 days by default,

starting once your institution approves the request) — see Section 12.2 for the full

deletion request process

• Backup copies: Retained for 30 days after deletion

Event Data:

• Server error logs and access logs are retained for operational troubleshooting; we

are formalizing specific retention periods for these as part of the audit-logging

work described in Section 11.7

8.2 Backup & Archive

• Regular backups are maintained for disaster recovery
• Backup data is retained for 30 days after deletion
• Archive data may be retained indefinitely for legal/compliance purposes

---

9. Your Privacy Rights

9.1 GDPR Rights (EU/UK Users)

If you are located in the European Union or United Kingdom, you have:

Right of Access: Request access to your personal data

Right to Rectification: Correct inaccurate data

Right to Erasure: Request deletion of your data ("Right to be Forgotten")

Right to Restrict Processing: Limit how we use your data

Right to Data Portability: Receive your data in structured, machine-readable format

Right to Object: Object to certain processing activities

Right to Withdraw Consent: Withdraw previously given consent

To exercise these rights, contact us at: getattenova@gmail.com

Response Timeline: We will respond to requests within 30 days (extendable to 60-90 days for complex requests)

9.2 CCPA Rights (California Users)

California residents have additional rights under the California Consumer Privacy Act:

• Right to know what data is collected
• Right to know if data is sold or shared
• Right to delete data
• Right to opt-out of data sales/sharing
• Right to non-discrimination for exercising CCPA rights

9.3 Other Jurisdictions

Depending on your location, you may have additional privacy rights. Contact us for jurisdiction-specific information.

---

10. Children's Privacy

10.1 Age Requirement

Attenova is intended for use by students 18 years of age or older. If you are under 18, you may only use Attenova with parental/guardian consent.

10.2 Parent/Guardian Rights

If we discover a child under 18 is using the Service without parental consent, we will:

• Delete the child's account
• Remove all personal data associated with that account
• Notify the parent/guardian

Parents/guardians may contact us to request deletion of a child's account.

10.3 Biometric Data Consent for Minors

Attenova's account age requirement is 18 (Section 10.1). Because the Service does not

currently collect date of birth or perform automated age verification, biometric

enrollment does not go through a separate, automated parental-consent workflow at this

time.

If a student on your account is under 18:

• Your institution and parent/guardian are responsible for ensuring appropriate consent

is obtained before biometric enrollment, consistent with Section 10.1's general

parental-consent requirement for users under 18

• You (or your parent/guardian) may withdraw biometric consent at any time by

requesting deletion of biometric data — see Section 5.3 and Section 5.5

Withdrawing Consent:

• You (or, for a minor, your parent/guardian) can withdraw biometric consent at any

time via Settings in the app, or by emailing getattenova@gmail.com

• Withdrawing consent deletes the associated biometric data
• The student cannot mark liveness-verified attendance after withdrawal

If your institution requires a formal, verified parental-consent workflow for

biometric enrollment, contact getattenova@gmail.com — this is a feature we can prioritize

building for institutions that need it.

---

11. Data Retention & Deletion Schedule

This section outlines how long we retain each category of data and when it is automatically deleted:

11.1 Attendance Records

11.2 Biometric Data

11.3 Account Data

11.4 Payment Data

11.5 Offline Data

Offline attendance capture works by recording your submission on-device with a unique

request ID, then syncing it to the same tables used for regular attendance once you're

back online — there is no separate server-side "offline queue" table or retention

schedule distinct from the attendance record itself.

Offline Queue Security Note: If your device is lost or stolen while you have unsynced

offline attendance data, the local queue may contain pending submissions (session

reference, GPS location, face match/liveness result). It does not contain your

authentication token or other profile data — those are never written to local storage;

your session token is attached only at the moment a queued item is actually sent. The

local queue is not separately encrypted beyond the operating system's standard

app-storage protections.

Risk Mitigation: We recommend enabling device lock. To reduce the risk of your

unsynced data being submitted under someone else's session on a shared device, the app

blocks logging out while you have unsynced offline data or no internet connection.

11.6 Notification & Analytics Data

11.7 Institutional Audit Logs

Current status: structured, queryable audit logging (who accessed whose data, permission changes, attendance modifications, security events) is planned but not yet implemented as a standalone system. Administrative actions that change data (permission reviews, attendance corrections, account approvals) are recorded as part of the relevant record itself (e.g. who reviewed a request and when), but there is not yet a separate, centralized audit-log retention/deletion schedule to report here. This section will be updated with specific retention periods once that system is built.

---

12. Your Data Subject Rights

12.1 Right to Access (Subject Access Request - SAR)

You have the right to know what personal data we hold about you.

How to Request:

1. Email getattenova@gmail.com with subject line "Data Subject Access Request"
2. Include your full name, student/lecturer ID, and email address
3. Include proof of identity (national ID, passport, or student ID photo)
4. Include statement: "I request access to all personal data held about me"

Our Response:

• We will verify your identity within 3 business days
• Once verified, we will compile your data within 20 days
• We will provide a complete export in CSV and PDF formats containing:
• All profile information
• Complete attendance history with locations and face scores
• All payment records
• All permission/leave requests
• All communication records
• Identity documents and enrollment images
• Metadata (timestamps, access logs)

What Happens to Your Request:

• Request tracked with unique reference ID
• Confirmation email sent within 1 business day
• Data export sent via secure link (48-hour expiry)
• You can request paper copies for additional fee

12.2 Right to Deletion (Right to Be Forgotten)

You have the right to request deletion of your personal data under certain circumstances.

When You Can Request Deletion:

• Account closure: Delete entire account and associated data
• Specific data: Delete biometric data, location data, or profile information
• End of purpose: Delete data no longer needed for original purpose
• Withdrawal of consent: Delete data collected with your consent

What WILL Be Deleted:

• Account profile (email, name, phone, password)
• Biometric enrollment data (embeddings, identity photos)
• Location coordinates
• Offline queue data
• Notification preferences
• Profile picture
• Session and authentication data

What WILL NOT Be Deleted (Legal/Contractual Requirements):

• Payment transaction records (7-year tax/legal requirement)
• Attendance records (institutional records, you retain access)
• Audit logs (legal compliance)
• Archived data (necessary for disputes)

How to Request:

1. Email getattenova@gmail.com with subject "Data Deletion Request"
2. Specify what data: "Delete entire account" or "Delete only [specific data]"
3. Include your ID for verification
4. Type or voice: "I request deletion of my personal data"

Our Response:

• Deletion requests processed within 30 days of verification
• Confirmation email sent when deletion complete
• Some data may remain in archives for legal purposes (you'll be informed)

12.3 Right to Data Portability

You have the right to receive your data in a machine-readable format and transfer it to another service.

What We'll Export:

• All your personal data in CSV/JSON format
• Attendance history with all details
• Payment records
• Biometric enrollment metadata (not visual data)
• All uploaded documents

How to Request:

1. Email getattenova@gmail.com: "I request data portability"
2. Specify format: CSV, JSON, or XML
3. Include your student/lecturer ID

Our Response:

• Data packaged within 20 days
• Secure download link provided (48-hour expiry)
• No fee charged for first request annually

12.4 Right to Correct (Right to Rectification)

You have the right to correct inaccurate personal data.

How to Request:

• Update directly in app: Profile settings, email, phone
• Email getattenova@gmail.com for attendance disputes or historical corrections
• Include proof of correction needed (e.g., transcript showing enrollment date)

Our Response:

• Corrections processed within 5 business days
• Previous version retained for audit purposes
• Confirmation email sent once complete

12.5 Right to Restrict Processing

You have the right to request we stop processing your data temporarily.

When This Applies:

• You dispute accuracy of data (while we investigate)
• Processing is unlawful but you want to restrict instead of delete
• We no longer need the data but you need us to keep it

How to Request:

• Email getattenova@gmail.com: "I request restriction of processing"
• Explain reason (dispute, legality concern, or other)

Our Response:

• Restriction in place within 5 days
• Data retained but processing paused
• Restriction ends after 30 days unless you request extension

12.6 Right to Object

You have the right to object to certain processing.

You Can Object to:

• Marketing communications (we don't send these)
• Analytics processing (we'll anonymize your data)
• Profiling (create categories based on behavior)
• Processing based on our legitimate interests

How to Request:

• In app: Settings > Privacy > Opt-out of Analytics
• Email getattenova@gmail.com with "Objection to Processing"

Our Response:

• Objection processed within 5 days
• Confirmation email sent
• Processing stopped for specified purpose

12.7 Right to Not Be Subject to Automated Decision-Making

You have the right to not be subject to automated decisions that produce legal effects about you.

Current Status:

• Attenova does NOT make automated decisions about you
• All significant decisions (attendance rejection, account suspension) are reviewed by human staff
• If this changes in future, we will update this policy

---

13. Breach Notification & Security Incident Response

13.1 What Is a Data Breach?

A data breach occurs when unauthorized parties gain access to your personal data through:

• Hacking or cyberattack
• Accidental disclosure by employee
• Loss of device containing data
• Third-party provider incident
• Phishing or social engineering

13.2 Our Breach Response Procedure

Immediate Action (Within 24 hours of discovery):

1. Isolate affected systems
2. Assess scope (how much data? which users?)
3. Preserve evidence for investigation
4. Notify our legal and security teams
5. Engage cybersecurity experts

Investigation (Within 3-7 days):

1. Determine root cause
2. Identify all affected data and users
3. Assess risk level to users
4. Implement fixes to prevent recurrence

Notification to Users (Within 30 days of discovery):

• Email to every affected user with:
• What happened (explanation of breach)
• When it happened (date range)
• What data was affected (biometric? location? payment?)
• What we're doing (remediation steps)
• What you should do (check account, enable 2FA, monitor payments)
• Who to contact (dedicated support email)

13.3 Notification to Authorities

We will notify authorities if required by law:

• Regulatory bodies (NITDA, FCA, etc.)
• Your institution (school administration)
• Payment processors (Paystack, if payment data affected)

Notification includes:

• Description of breach
• Categories of personal data affected
• Approximate number of users affected
• Likely consequences
• Measures taken to address breach

13.4 Your Rights After a Breach

If your data is breached, you have the right to:

• Free credit monitoring (if payment data involved)
• Account freeze (temporarily block account from access)
• Identity theft insurance (underwritten by us)
• Legal assistance (consultation with privacy lawyer)
• Compensation claim (where permitted by law)

Contact getattenova@gmail.com immediately if breach-related and we'll provide these services at no cost.

---

14. Contact Us

For Privacy Concerns or Requests:

• Email: getattenova@gmail.com
• Mailing Address: Attenova, Nigeria
• Response Time: Within 30 business days for formal requests; within 3 business days for urgent issues

Quick Help:

• Data access request (SAR): getattenova@gmail.com
• Data deletion request: getattenova@gmail.com
• Breach notification: getattenova@gmail.com
• Biometric consent withdrawal: getattenova@gmail.com
• Parental consent (for minors): getattenova@gmail.com
• General privacy questions: getattenova@gmail.com

---

15. Policy Updates

We may update this Privacy Policy to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes:

• We will notify you via email or in-app notification
• Your continued use of the Service constitutes acceptance
• For significant changes, we may require explicit consent
• Previous versions available upon request

The "Last Updated" date at the top indicates when this policy was last modified.

16. International Data Transfers

If you access Attenova from outside the country where our servers are located, your data will be transferred to and processed in the country where our servers operate. By using Attenova, you consent to such transfers.

We implement appropriate safeguards for international data transfers, including:

• Standard Contractual Clauses (for EU data transfers)
• Privacy Shield or equivalent mechanisms
• Encryption and security protocols

---

17. Third-Party Links & Services

Attenova may contain links to third-party websites and services. We are not responsible for their privacy practices. Please review their privacy policies before providing your information.

---

18. Dispute Resolution

Any disputes regarding this Privacy Policy or our privacy practices will be governed by the laws of Nigeria. You agree to submit to the exclusive jurisdiction of courts in Nigeria.

---

By using Attenova, you acknowledge that you have read, understood, and agree to this Privacy Policy.