Terms and Conditions of Use

Version: 1.0 · Effective date: 1st November, 2026Last updated: 1st November, 2026Platform: NYSC Ops Command Center Dashboard and Field AppGoverning jurisdiction: Federal Republic of Nigeria

1. ACCEPTANCE AND APPLICATION

These Terms and Conditions govern access to and use of NYSC Ops, a restricted-access digital operations platform intended to support the administration, monitoring and verification of monthly clearance activities under the National Youth Service Corps (“NYSC”) programme in Nigeria.

The Platform consists of:

• the Ops Server and associated application programming interfaces;
• the Command Center Dashboard used by authorised administrative personnel;
• the Field App used by registered corps members; and
• associated authentication, clearance, notification, scheduling, audit and emergency-response functions.

These Terms apply to every person accessing or using the Platform, including corps members, LGA Supervisors, State Coordinators, Zonal Inspectors, Administrators and Super Administrators.

By accessing or using the Platform, a user acknowledges that they have been given access to these Terms and the accompanying Privacy Statement.

Where a user is required to acknowledge these Terms electronically, the Platform should record the version presented, the date and time of acknowledgement, the user identifier and the method of acknowledgement.

Nothing in these Terms creates a contract of employment, changes a corps member’s statutory status, alters NYSC service conditions, or overrides a lawful NYSC directive. Where an applicable statute, regulation or binding institutional instruction conflicts with these Terms, the applicable legal requirement shall prevail to the extent of the conflict.

2. DEFINITIONS

For these Terms:

“Administrator” means a user assigned administrative privileges to manage or monitor Platform operations.

“Applicable Law” means the laws of the Federal Republic of Nigeria in force from time to time, including the Nigeria Data Protection Act 2023 (“NDPA”), the Cybercrimes (Prohibition, Prevention, etc.) Act 2015, the National Youth Service Corps Act, and any regulation, directive or binding instruction made under them.

“Audit Trail” means the chronological record of administrative and security-relevant actions recorded by the Platform.

“Biometric Verification” means the process of comparing a facial representation or encoding against a reference record to assess identity.

“Clearance” means the monthly verification process used to assess whether a corps member has completed the prescribed digital clearance requirements.

“Clearance Record” means the record generated from a clearance submission, including the relevant identity snapshot, time, location, verification results and status.

“Clearance Session” means an authorised, time-bounded window during which clearance submissions may be accepted.

“Corps Member” means a person registered on the Platform for the purpose of NYSC clearance administration.

“Data Controller” means the organisation or public authority responsible for determining the purposes and essential means of processing personal data.

“Data Processor” means an organisation or person processing personal data on behalf of a Data Controller.

“Data Protection Officer” means the person or office designated by the Data Controller to oversee compliance with Applicable Law on data protection and to act as the contact point for privacy requests and complaints.

“Device Binding” means the association of a corps member’s account with an authorised mobile device.

“Field App” means the mobile application used by corps members to authenticate and submit clearance records.

“Geofence” means the geographic boundary used by the Platform to assess whether submitted coordinates fall within an assigned Nigerian state boundary.

“Clearance Month” means a calendar month, from its first day to its last day.

“LGA” means a Local Government Area of the Federal Republic of Nigeria.

“LGA Supervisor”, “State Coordinator” and “Zonal Inspector” each means an NYSC officer or other official assigned to the corresponding role, and to the geographic scope, recorded for that user on the Platform.

“Liveness Check” means a challenge-response procedure intended to assess whether a person presenting for biometric verification is physically present.

“Nigeria Data Protection Commission” or “NDPC” means the regulator established under the NDPA.

“Personal Data” means information relating to an identified or identifiable natural person.

“Platform” means the NYSC Ops software, associated services and infrastructure described in these Terms.

“Platform Operator” means EIB Stratoc Limited (RC 1952655), which operates the Platform on behalf of, or under arrangements with, the Responsible Institution.

“PPA” means a corps member’s Place of Primary Assignment.

“Privacy Statement” means the privacy statement issued by the Data Controller for the Platform, as amended from time to time, setting out how Personal Data is collected, used, retained, shared and protected.

“Responsible Institution” means the National Youth Service Corps, which has institutional responsibility for the operation of the Platform and for decisions made through or with the assistance of it.

“SOS Alert” means an emergency distress signal submitted through the Field App.

“Super Administrator” means a user with the highest configured level of administrative privileges.

“User” means any person authorised to access or use the Platform.

3. ELIGIBILITY AND RESTRICTED ACCESS

3.1. NYSC Ops is not a publicly accessible application. Access is restricted to individuals whose accounts have been explicitly provisioned through the authorised account-administration process.

3.2. A corps member may use the Field App only where their account has been registered or provisioned for the relevant clearance programme.

3.3. An administrative user may use the Command Center Dashboard only where an authorised Super Administrator or other duly empowered officer has assigned the account and appropriate permissions.

3.4. Users must provide accurate information when required for registration, account verification or account maintenance.

3.5. Users must not create or use another person’s account, impersonate an officer or corps member, circumvent access restrictions, or obtain access through another person’s credentials.

3.6. Access is personal to the authorised user and may not be sold, transferred, lent, sublicensed or shared.

3.7. The Platform may refuse, restrict, suspend or revoke access where there is a legitimate security, operational or legal reason, subject to applicable law and any required procedural safeguards.

3.8. Access to the Platform does not confer authority to make decisions outside the user’s official functions or assigned geographic scope.

4. ACCOUNT REGISTRATION AND INFORMATION ACCURACY

4.1. Users must ensure that information submitted for registration and clearance is accurate and complete to the extent required by the Platform.

4.2. Corps members are responsible for notifying the designated NYSC administrative office of relevant changes to their approved service information, including an authorised change of state, LGA or PPA where applicable.

4.3. Administrative users must ensure that records they create or amend are accurate, authorized and consistent with official source information.

4.4. Users must not knowingly submit false identity information, manipulate clearance records, misrepresent their assigned location or attempt to obtain an unauthorized clearance result.

4.5. Where a record is inaccurate, the user should submit a correction request through the approved administrative or privacy request channel.

4.6. A correction request does not automatically entitle a user to alter an immutable historical event. The Platform may preserve the original audit entry while recording a verified correction or review outcome.

4.7. The Platform may request additional information reasonably necessary to verify an account or resolve a discrepancy. Any additional collection of personal data must remain lawful, necessary and proportionate.

5. AUTHENTICATION AND ACCOUNT SECURITY

5.1. Users must complete the authentication procedure applicable to their user category.

5.2. Corps members may be required to complete a facial liveness challenge during authentication or clearance.

5.3. Administrative users must authenticate using the credentials and any additional security controls required for their accounts.

5.4. Users must keep passwords, authentication tokens, recovery credentials and other access mechanisms confidential.

5.5. Users must not disclose credentials to another person, store them insecurely, or permit an unauthorised person to operate their account.

5.6. Users must promptly report suspected credential compromise, unauthorised access, device theft or suspicious activity through the designated security channel.

5.7. The Platform may terminate sessions, revoke refresh tokens, require reauthentication or temporarily restrict an account where reasonably necessary to protect security.

5.8. Administrative accounts may be subject to additional controls, including multifactor authentication, periodic credential changes where justified, session expiry and access reviews.

5.9. Users must not attempt to bypass authentication, defeat liveness checks, manipulate authentication tokens, reverse-engineer access controls or exploit application vulnerabilities.

5.10. The Platform may log authentication events and other relevant security information for access control, investigation and accountability, in accordance with the Privacy Statement.

6. DEVICE BINDING AND DEVICE RESETS

6.1. The Field App is designed to bind a corps member’s account to a registered mobile device during initial authentication.

6.2. A login attempt from a different device may be rejected until an authorised administrator approves a device reset or re-registration.

6.3. Corps members must use the approved process to request a device reset where a device is lost, damaged, replaced or no longer available.

6.4. An administrator must verify the legitimacy of a reset request before changing the device binding.

6.5. Administrative device resets must be logged in the Audit Trail.

6.6. A device reset does not, by itself, delete the existing clearance records or authorise the creation of duplicate monthly submissions.

6.7. Users must not attempt to evade device binding by cloning identifiers, manipulating device fingerprints, modifying application code or using unauthorised tools.

6.8. The Platform shall apply a reasonable exception process where device binding prevents legitimate access because of theft, technical failure or another circumstance beyond the user’s control.

7. BIOMETRIC VERIFICATION

7.1. The Field App uses facial information to support identity verification and clearance administration.

7.2. During onboarding, the Platform may capture a reference facial photograph and generate a facial encoding for subsequent comparison.

7.3. During authentication, the Field App may require a liveness challenge, such as blinking or turning the head in a specified direction.

7.4. During a clearance submission, the Platform may process a biometric comparison result and retain a clearance selfie thumbnail for audit purposes.

7.5. Users must not attempt to defeat biometric verification using photographs, recordings, masks, manipulated images, synthetic identities, injected camera feeds or other methods intended to misrepresent identity.

7.6. Biometric verification is a technical control and may produce incorrect results. A failed check shall not, without further assessment, be treated as conclusive evidence of impersonation or misconduct.

7.7. Where a corps member reasonably disputes a biometric result, they may request review through the designated NYSC administrative process.

7.8. The Platform shall handle reference photographs, facial encodings and related information in accordance with the Privacy Statement and applicable Nigerian data-protection law.

7.9. Biometric data shall not be repurposed for unrelated facial surveillance, advertising, commercial profiling or other incompatible purposes.

7.10. The processing of biometric information must have a documented lawful basis and satisfy any additional requirements applicable to sensitive personal data.

7.11. Where a corps member cannot reasonably complete facial capture, a liveness challenge or a biometric comparison (for example because of injury, disability, a change in facial appearance, religious or cultural dress, or a device limitation), the Responsible Institution shall provide a documented alternative verification method. A corps member shall not be disadvantaged solely because of that inability.

7.12. Biometric data used to uniquely identify a person is sensitive personal data under the NDPA. Before biometric processing begins, the Data Controller shall complete a data protection impact assessment where Applicable Law requires one, and shall keep it under review.

7.13. Reference photographs, facial encodings and clearance selfie thumbnails shall be retained only for the periods stated in the retention schedule referred to in clause 19.11. When a corps member’s service record is closed, they shall be deleted or irreversibly anonymised, subject to any legal retention obligation.

8. CLEARANCE SESSIONS AND SUBMISSIONS

8.1. An authorised Administrator or Super Administrator may open or close a clearance session in accordance with approved NYSC operational procedures.

8.2. A clearance session may be configured for a specified Clearance Month or other authorised period.

8.3. A corps member may submit clearance only while the relevant session is open and their account is eligible to participate.

8.4. A clearance submission may require:

• successful completion of the required authentication or liveness challenge;
• capture of a usable GPS location;
• transmission of the relevant biometric and device information;
• successful server-side processing; and
• completion of the applicable geofence and biometric checks.

8.5. The Platform is designed to reject duplicate submissions within the same Clearance Month, subject to the configured session rules.

8.6. A successful upload or receipt confirmation does not necessarily mean that clearance has been granted. The status shown by the Platform shall be determined by the applicable verification workflow.

8.7. The Platform may display a status such as CLEARED, FLAGGED, pending or another configured status.

8.8. A corps member must not manipulate timestamps, GPS information, device data or application requests to obtain an unauthorised result.

8.9. Where a submission fails because of network interruption, device malfunction, GPS unavailability or another technical problem, the corps member should follow the published troubleshooting or exception process.

8.10. The Platform shall not represent a technical failure as proof of intentional non-compliance without an appropriate assessment.

8.11. A clearance result may be subject to review, correction or administrative action where authorised and permitted by applicable rules.

8.12. A corps member on approved leave of absence, authorised travel, medical excuse, official secondment or other approved absence shall not be flagged or treated as non-compliant for a Clearance Month to the extent that the Approved Absence has been recorded by the Responsible Institution. A corps member should have an Approved Absence recorded through the designated administrative channel before it begins or, where that is not practicable, as soon as possible afterwards.

8.13. Unless the Platform states otherwise, clearance session times and Clearance Month boundaries are applied in West Africa Time (UTC+01:00), and the Platform’s server time is the authoritative time for deciding whether a submission was made within a session.

9. GEOLOCATION AND GEOFENCE CHECKS

9.1. The Field App may request foreground location access when a clearance submission is made.

9.2. Submitted coordinates and their accuracy radius may be compared with the assigned-state boundary maintained by the Platform.

9.3. A submission falling outside the relevant geofence may be marked FLAGGED or otherwise referred for review.

9.4. GPS accuracy can be affected by device hardware, environmental conditions, satellite reception, location settings and other factors. A geofence result is therefore an operational indicator rather than an infallible determination of a person’s physical presence.

9.5. Corps members must not knowingly falsify or manipulate location information.

9.6. Users must not use the Platform to track unrelated movements or access location records outside their authorised duties.

9.7. The Platform is designed not to conduct continuous background location tracking. Position logs are intended to be generated only during active clearance sessions or other specifically authorised functions.

9.8. Where a legitimate location discrepancy occurs, the affected corps member may request review through the approved administrative channel.

9.9. Any adverse consequence arising from a location flag must comply with applicable NYSC rules, procedural fairness and any required human-review process.

9.10. A location outside the assigned state shall not, on its own, be treated as a breach where the corps member is on an Approved Absence.

10. CLEARANCE RESULTS AND ADMINISTRATIVE REVIEW

10.1. Clearance results are generated through the Platform’s configured verification rules and are made available to authorised users.

10.2. A result may be influenced by biometric matching, geofence checks, the status of the clearance session, duplicate-submission controls and other configured validation rules.

10.3. Users acknowledge that technical systems may experience errors, delays or interruptions.

10.4. An automated flag is not, by itself, a finding of fraud, misconduct, absence or breach of an NYSC directive.

10.5. Where a clearance outcome may affect a corps member’s rights, status or service-related entitlements, the responsible authority shall follow the applicable administrative procedure and provide human review where required by law.

10.6. An authorised administrator may correct or amend a clearance status only within the administrator’s approved permissions and for a legitimate operational reason.

10.7. Manual changes to clearance status must be recorded in the Audit Trail, including the actor, timestamp, target record, nature of the change and relevant details.

10.8. Users must not request, make or facilitate an unauthorised clearance alteration.

10.9. A corps member may request clarification of a clearance result through the designated administrative channel.

10.10. Nothing in these Terms guarantees that a clearance submission will be accepted or that an individual will receive a particular outcome.

10.11. A corps member shall not be subject to a decision that has a legal or similarly significant effect on them and is based solely on automated processing (including a biometric mismatch or a geofence flag), except as permitted by Applicable Law and with safeguards that include the right to obtain human intervention, to express their view and to contest the decision.

10.12. The Responsible Institution shall acknowledge a request for review made under clause 7.7, 9.8 or 10.11 within three (3) working days of receipt and shall endeavour to decide it within ten (10) working days, informing the corps member of the outcome and of any further route of review.

11. SOS ALERTS AND EMERGENCY RESPONSE

11.1. Where enabled, the SOS function allows a corps member to transmit an emergency alert through the Field App.

11.2. An SOS alert may transmit the user’s location, timestamp, device information and other relevant event information.

11.3. The Platform may display the alert to authorised personnel and record acknowledgement, escalation and response information.

11.4. The SOS function is intended to support an emergency-response workflow. It is not a substitute for emergency services, direct contact with an appropriate authority or other available means of obtaining urgent assistance.

11.5. Users must not knowingly submit false SOS alerts, repeatedly trigger the function to disrupt operations, or use it to harass another person.

11.6. An alert may be investigated where there is a legitimate basis to suspect misuse, subject to applicable law and procedural safeguards.

11.7. Where the Platform supports remote audio capture following an SOS event, the feature may be used only under the approved emergency-response protocol and by personnel with the required authority.

11.8. Remote audio capture must be necessary and proportionate to the emergency-response purpose, and must comply with applicable law, the Privacy Statement and any approved institutional safeguards.

11.9. Access to emergency recordings shall be restricted, monitored and logged. Recordings shall not be used for unrelated surveillance, personal purposes or unauthorised disclosure.

11.10. Audio capture must not be treated as a general power to activate a device’s microphone outside the approved and disclosed circumstances.

11.11. The Platform’s availability, network conditions, device permissions or technical faults may affect the transmission or receipt of an alert. Users should not assume that an alert has reached an appropriate responder unless the system provides a reliable acknowledgement.

11.12. Corps members shall be told, in the Field App at onboarding and before the SOS function is first enabled for them, what the SOS function transmits and whether remote audio capture is supported. Emergency recordings shall be retained only for as long as necessary for the emergency response and any resulting investigation or proceedings, and shall then be deleted in line with the retention schedule.

12. OBLIGATIONS OF CORPS MEMBERS

Every corps member using the Field App must:

• use only their authorised account and registered device;
• provide accurate information required for clearance;
• complete the prescribed authentication and clearance process honestly;
• keep the application updated where an approved update is required;
• maintain reasonable control over their device and account credentials;
• avoid unauthorised manipulation of biometric, location or device information;
• report lost devices, suspected compromise and relevant account discrepancies promptly;
• use the SOS function responsibly;
• respect the confidentiality of other corps members’ information;
• comply with lawful NYSC operational instructions and applicable law; and

k. use the designated process to raise disputes, technical complaints or privacy requests.

A corps member shall not be required by these Terms to waive a statutory right, accept unlawful processing or forgo a remedy available under applicable law.

13. OBLIGATIONS OF ADMINISTRATIVE USERS

Administrative users must:

13.1. Use the Platform solely for authorised official duties.

13.2. Access only the records reasonably necessary for their assigned functions.

13.3. Observe role-based and geographic restrictions.

13.4. Maintain the confidentiality of corps member information and administrative records.

13.5. Verify the authority for account creation, device resets, status changes and other privileged actions.

13.6. Ensure that announcements and instructions are accurate, authorised and directed to the appropriate recipients.

13.7. Avoid unauthorised exports, screenshots, downloads or external disclosures of restricted information.

13.8. Refrain from using personal data for private, political, commercial, retaliatory or discriminatory purposes.

13.9. Report suspected unauthorised access, data breaches and misuse of the Platform.

13.10. Cooperate with authorised audits, investigations and access reviews.

13.11. Avoid making disciplinary or adverse determinations solely on the basis of a technical flag where human assessment or procedural safeguards are required.

13.12. Ensure that manual changes and privileged actions are properly documented.

13.13. Comply with confidentiality undertakings, internal security procedures and any separate acceptable-use policy issued by the responsible institution.

14. ROLES AND ACCESS CONTROL

14.1. The Platform’s role-based access model is intended to limit access according to operational responsibilities and geographic assignment.

14.2. LGA Supervisors may receive read-only access to records within their assigned LGA.

14.3. State Coordinators may receive access to relevant records and clearance functions within their assigned state.

14.4. Zonal Inspectors may receive read and limited edit access within their assigned zone.

14.5. Administrators may receive broader access for approved operational functions.

14.6. Super Administrators may receive system-wide privileges, including account management and clearance-session configuration.

14.7. These role descriptions are subject to the deployed permission matrix and approved institutional instructions. A role title does not authorise access beyond the permissions actually assigned.

14.8. Privileged access may be reviewed, modified, suspended or revoked where necessary for security, reassignment, the end of an official role or another legitimate reason.

14.9. Every administrative user must report any apparent privilege escalation, access-control defect or exposure of information outside their assigned scope.

14.10. The responsible institution should periodically review whether the privileges assigned to each account remain necessary and appropriate.

15. AUDIT TRAILS AND RECORD INTEGRITY

15.1. The Platform records administrative actions to support security, accountability, operational monitoring and investigation.

15.2. Logged actions may include account creation and deletion, role changes, device resets, clearance-session management, manual clearance changes, geofence audits and announcement administration.

15.3. Audit entries may include the actor’s email address, role, IP address, timestamp, action, target and relevant details.

15.4. Audit entries are designed not to be deletable through the ordinary application interface.

15.5. Audit immutability does not authorise unlimited retention or unrestricted access. Audit records remain subject to the applicable Privacy Statement, retention schedule and data-protection law.

15.6. Users must not attempt to delete, alter, suppress, falsify or circumvent audit records.

15.7. Where an entry is inaccurate or disputed, an authorised correction or supplementary record may be added through an approved process that preserves the integrity of the original event where legally necessary.

15.8. Audit information may be reviewed by authorised personnel for legitimate security, compliance, administrative or investigative purposes.

16. REAL-TIME DASHBOARD AND NOTIFICATIONS

16.1. The Command Center Dashboard may display real-time operational information through authenticated server connections.

16.2. Such information may include clearance counts, individual submission events, online/offline presence, SOS events, clearance-session changes and announcements.

16.3. Real-time information is intended to be scoped to the authorised user’s role and geographic assignment.

16.4. Users must not attempt to subscribe to, intercept, reproduce or access real-time events outside their authorised scope.

16.5. Push notifications may be delivered through Firebase Cloud Messaging or another configured notification service.

16.6. A push notification is an operational communication mechanism and does not necessarily constitute proof that the recipient has read or acted upon the underlying information.

16.7. Notification delivery may be affected by network availability, device settings, application restrictions or third-party service interruptions.

16.8. Sensitive information displayed in notifications should be minimised to the extent practicable, especially where notifications may appear on a locked screen.

17. ANNOUNCEMENTS AND OFFICIAL COMMUNICATIONS

17.1. Authorised administrators may create and distribute announcements to designated states, LGAs or other approved recipient groups.

17.2. Announcements must be relevant to legitimate operational or administrative purposes.

17.3. Users must not use announcement functionality to disseminate unlawful, threatening, discriminatory, misleading or unauthorised content.

17.4. Announcements must not contain personal data unless the disclosure is authorised, necessary and proportionate to the purpose.

17.5. The Platform may record the announcement’s author, timestamp, priority, content and intended recipient scope.

17.6. An announcement does not override applicable law or a binding directive issued by a competent authority.

18. PROHIBITED CONDUCT

Users must not:

• access the Platform without authorisation;
• impersonate another user;
• share or trade access credentials;
• introduce malware or malicious code;
• attempt to interfere with server availability or system integrity;
• conduct unauthorised vulnerability testing or penetration testing;
• scrape, bulk-export or harvest personal data without permission;
• manipulate GPS information, biometric inputs, timestamps or clearance statuses;
• circumvent device binding, session controls or authentication requirements;
• exploit application programming interfaces or WebSocket connections to access restricted information;

k. interfere with audit records;

l. use personal data for stalking, harassment, blackmail, discrimination or other unlawful purposes;

m. disclose restricted information to unauthorised persons;

n. misuse the SOS function or emergency recordings; or

o. use the Platform for any unlawful purpose.

Nothing in this clause prohibits a disclosure, report or activity protected by applicable law, including a lawful report to a competent regulator or authority.

Certain prohibited conduct, including unauthorised access to a computer system, interference with data or systems and unlawful interception, may constitute an offence under the Cybercrimes (Prohibition, Prevention, etc.) Act 2015 or other Applicable Law and may be referred to the appropriate law-enforcement agency.

19. PRIVACY, PERSONAL DATA AND COOKIES

19.1. The processing of personal data through NYSC Ops is governed by the accompanying Privacy Statement and applicable Nigerian data-protection law.

19.2. Users must review the Privacy Statement to understand the Platform’s processing of identity information, biometric data, location information, device identifiers, clearance records, audit logs and SOS information.

19.3. Personal data shall be accessed and used only for an authorised purpose and within the user’s assigned permissions.

19.4. The Platform may use strictly necessary browser cookies, local storage, session storage, authentication tokens and similar technologies to maintain sessions, protect accounts and support essential functionality.

19.5. The precise technologies deployed shall be documented in the Platform’s cookie and storage inventory.

19.6. Optional analytics or preference technologies may be used only where they have been implemented, appropriately disclosed and processed on a lawful basis. Where consent is required, the relevant consent must be obtained before the technology is activated.

19.7. The Platform is not designed to use advertising cookies or cross-site behavioural advertising trackers.

19.8. Users may manage browser cookies through their browser settings and mobile permissions through their device settings. Disabling necessary technologies may prevent login or other essential functions.

19.9. These Terms do not constitute blanket consent to all processing activities. Any consent required for a particular activity must be obtained through an appropriate, separate and legally valid mechanism.

19.10. Nothing in these Terms limits a user’s statutory data-protection rights.

19.11. The Data Controller shall maintain a written retention schedule stating, for each category of Personal Data processed on the Platform (including reference photographs, facial encodings, clearance selfie thumbnails, location records, clearance records, audit logs, SOS records and emergency recordings), the retention period and the reason for it. Personal Data shall be deleted or anonymised when it is no longer needed, subject to legal retention obligations.

19.12. The Data Controller shall maintain a personal data breach response procedure. Where a breach is likely to result in a risk to the rights and freedoms of individuals, the Data Controller shall notify the NDPC within seventy-two (72) hours of becoming aware of it, and shall notify affected individuals without undue delay where the breach is likely to result in a high risk to them, as the NDPA requires. A Data Processor shall notify the Data Controller of any breach without undue delay and in any event within twenty-four (24) hours.

19.13. The Data Controller and any Data Processor shall be identified in the Privacy Statement. Where the Platform Operator processes Personal Data on behalf of the Responsible Institution, it shall do so only on documented instructions and under a written data-processing agreement that meets the requirements of the NDPA.

19.14. Where it qualifies as a data controller or data processor of major importance, the Data Controller or Data Processor (as applicable) shall register with the NDPC and comply with the NDPA’s compliance audit and filing requirements.

20. INTELLECTUAL PROPERTY AND PLATFORM MATERIALS

20.1. Subject to applicable third-party rights, the software, interface design, documentation, branding, source code, configuration, graphics and other materials associated with the Platform are owned by or licensed to the relevant rights holder.

20.2. Access to the Platform grants a user a limited, personal, non-transferable and revocable permission to use the functions made available to that user for authorised purposes.

20.3. No ownership of the Platform’s intellectual property is transferred to a user by granting access.

20.4. Users must not reproduce, distribute, sell, sublicense, modify, reverse-engineer or commercially exploit the Platform except to the extent expressly authorised in writing or permitted by applicable law.

20.5. Nothing in these Terms restricts rights that cannot lawfully be excluded, including any mandatory rights relating to interoperability, research or other legally protected activity.

20.6. Ownership of data and records supplied by NYSC, a corps member or another lawful source shall be determined by the applicable law and relevant agreements. These Terms do not automatically transfer ownership of personal data to the Platform operator.

21. THIRD-PARTY SERVICES AND INFRASTRUCTURE

21.1. The Platform may depend on third-party infrastructure and services, including hosting, databases, cloud storage and push-notification delivery.

21.2. These services include Amazon Web Services (London region, United Kingdom) for hosting, Amazon RDS for PostgreSQL, Amazon S3, Firebase Cloud Messaging and Send Byte for transactional email, as set out in the Privacy Statement.

21.3. The availability and operation of third-party services may affect the Platform’s performance.

21.4. The responsible institution shall assess relevant providers, establish appropriate contractual safeguards and verify applicable data-location and international-transfer arrangements.

21.5. Users must not interpret the use of a third-party service as permission for that provider to use personal data for unrelated purposes.

21.6. Where a third party independently processes personal data under its own privacy notice, that notice may apply to the relevant independent processing. The Platform’s own controller and processor obligations remain subject to applicable law.

21.7. Where Personal Data is hosted in, or accessed from, a country outside Nigeria (including through the services named in clause 21.2), the transfer shall take place only on a basis permitted by the NDPA, shall be documented, and shall be disclosed in the Privacy Statement.

22. PLATFORM AVAILABILITY, MAINTENANCE AND TECHNICAL LIMITATIONS

22.1. The Platform is designed to support operational clearance activities, but uninterrupted availability cannot be guaranteed.

22.2. Access may be affected by scheduled maintenance, emergency maintenance, network failures, power interruptions, cloud-service outages, application defects, security incidents or other circumstances beyond reasonable control.

22.3. We may modify, update, repair or temporarily suspend a function where reasonably necessary for maintenance, security, compliance or operational continuity.

22.4. Where practicable, material scheduled interruptions should be communicated to affected users through an authorised channel.

22.5. Users are responsible for following the published procedures for reporting technical problems.

22.6. A user should not be penalised solely because of a verified technical failure without the appropriate assessment required by applicable rules.

22.7. The Platform may display estimated, delayed or incomplete real-time information during an outage or processing delay. Users should verify material decisions through the approved operational process.

22.8. No provision of these Terms authorises the Platform operator to alter official NYSC eligibility requirements or service rules without the necessary institutional authority.

22.9. Neither the Platform Operator nor the Responsible Institution is liable for a failure or delay to the extent that it is caused by events beyond reasonable control, including natural disaster, power or telecommunications failure, civil disturbance, government action or an outage of a third-party service, provided that reasonable steps were taken to limit the effect.

22.10. Where the Platform is unavailable for a material part of a clearance session, the Responsible Institution shall extend the affected session or publish an alternative means of clearance, and a corps member shall not be treated as non-compliant for the affected period.

23. SUSPENSION, RESTRICTION AND TERMINATION

23.1. Access may be suspended, restricted or revoked where:

• an account is no longer authorised;
• credentials or devices are compromised;
• a user breaches these Terms or applicable security rules;
• there is a credible risk to personal data or system integrity;
• an authorised institution directs that access be changed; or
• suspension is otherwise necessary and lawful.

23.2. Where practicable and consistent with security or legal obligations, the affected user should receive notice of the restriction and information about the available review process.

23.3. Immediate temporary suspension may be appropriate where delay would create a material security, safety or operational risk.

23.4. Suspension shall be limited to the scope and duration reasonably necessary to address the relevant concern, subject to applicable law.

23.5. Where a user disputes a suspension, the user may request review through the designated administrative channel.

23.6. Ending access does not automatically delete the user’s personal data, historical clearance records or audit entries. Such records shall be handled in accordance with the Privacy Statement, the retention schedule and applicable legal obligations.

23.7. The deletion of an application account must not be used to conceal a relevant administrative action or circumvent lawful recordkeeping requirements.

23.8. A corps member’s access ends on completion of service, discharge or another lawful end of their engagement with NYSC, and an administrative user’s access ends when their official role ends. The account shall then be deactivated within five (5) working days.

24. DISCLAIMER AND LIMITATION OF LIABILITY

24.1. The Platform provides digital tools to support clearance administration, identity verification, location checking, operational monitoring and emergency-response workflows.

24.2. Unless expressly stated in a binding agreement, the Platform does not guarantee that every biometric match, GPS result, status flag, notification or real-time event will be accurate, complete or uninterrupted.

24.3. Technical results must be interpreted in light of known limitations and any relevant review procedure.

24.4. Nothing in these Terms excludes or limits liability to the extent that such exclusion or limitation is prohibited by applicable law.

24.5. Nothing in these Terms excludes liability for fraud, wilful misconduct, unlawful processing, or other liability that cannot lawfully be excluded.

24.6. Any limitation of liability applicable to a technology provider or platform operator must be separately agreed where necessary and must not be drafted to remove a statutory obligation of the Data Controller, Data Processor or another responsible party.

24.7. Nothing in these Terms limits a corps member’s statutory rights, an administrative user’s applicable employment or service rights, or any remedy available under Nigerian law.

24.8. The responsible institution remains accountable for official administrative decisions made through or with the assistance of the Platform to the extent required by law.

25. INDEMNITY

25.1. A user who unlawfully accesses, manipulates or discloses personal data, intentionally compromises the Platform or otherwise causes legally recoverable loss through a proven breach of these Terms may be subject to remedies available under applicable law.

25.2. Any indemnity imposed on a user shall be limited to losses properly attributable to the user’s unlawful conduct or breach, subject to applicable law.

25.3. Nothing in this clause creates an automatic obligation to indemnify the Platform operator for losses arising from the operator’s own unlawful conduct, negligence where liability cannot be excluded, data-protection violations or other non-excludable liability.

25.4. No indemnity shall prevent a user from exercising a statutory right or making a protected report to a competent authority.

26. PRIVACY REQUESTS AND COMPLAINTS

26.1. Users may exercise applicable data-protection rights in accordance with the Privacy Statement.

26.2. Requests for access, correction, restriction, erasure, portability, objection to processing, withdrawal of consent or review of automated outcomes should be submitted through the designated privacy or administrative channel.

26.3. The absence of an in-app export or erasure feature does not, by itself, remove any right available under applicable law. Requests may be handled through the approved alternative process.

26.4. The responsible institution shall assess requests individually and apply any relevant lawful retention, confidentiality, security or other statutory limitation.

26.5. Users may raise concerns about misuse of information, unauthorised access or improper administrative conduct through the designated complaint process.

26.6. Nothing in these Terms prevents a user from lodging a complaint with the Nigeria Data Protection Commission or pursuing any other remedy available under Nigerian law.

26.7. The Data Controller shall respond to a request under this clause without undue delay and in any event within one (1) month of receipt, subject to any extension permitted by Applicable Law. Where a request is refused in whole or in part, the Data Controller shall give reasons and inform the requester of the right to complain to the NDPC.

27. CHANGES TO THESE TERMS

27.1. These Terms may be amended to reflect changes in the Platform, security requirements, institutional procedures or applicable law.

27.2. Material changes shall be communicated through an appropriate official channel.

27.3. Where a change requires renewed acknowledgement, consultation, consent or another legal step, that step shall be completed before the change is implemented to the extent required by law.

27.4. Each version shall carry a version number, effective date and revision date.

27.5. Earlier versions should be retained for accountability and to establish which Terms applied at a relevant time.

27.6. Continued access shall not be treated as consent to processing that requires separate consent or as a waiver of statutory rights.

27.7. Notices to users may be given through the Platform, the Field App, official NYSC channels or the contact details held for the user. Users are responsible for keeping their contact details up to date.

28. GOVERNING LAW AND DISPUTE RESOLUTION

28.1. These Terms shall be governed by the laws of the Federal Republic of Nigeria.

28.2. A dispute concerning account access, a clearance result or an administrative record should first be referred to the appropriate NYSC administrative office where an internal review procedure is available.

28.3. A privacy complaint may be referred to the designated Data Protection Officer or privacy office.

28.4. The use of an internal review procedure does not prevent a user from approaching a competent regulator or court where permitted by law.

28.5. Any contractual dispute-resolution provision must preserve the jurisdiction of competent Nigerian courts and any non-waivable statutory rights.

28.6. No provision of these Terms shall be interpreted as requiring a user to waive a mandatory legal remedy.

28.7. Where a dispute is not resolved within thirty (30) days of the request for review, the user may escalate it in writing to the Director, Corps Mobilisation, NYSC National Directorate, who shall respond within a reasonable time.

28.8. Subject to clause 28.4, the courts of the Federal Republic of Nigeria that have jurisdiction under Applicable Law shall have jurisdiction over any dispute arising out of or in connection with these Terms.

29. SEVERABILITY

If any provision of these Terms is found invalid, unlawful or unenforceable by a competent authority, the provision shall be modified to the minimum extent necessary to make it lawful and enforceable, where legally permissible.

The remaining provisions shall continue in effect to the extent that they can operate independently and consistently with applicable law.

30. NO WAIVER

A failure or delay in exercising a right under these Terms does not constitute a waiver of that right.

Any waiver must be lawful and, where appropriate, documented by the party authorised to grant it.

31. ENTIRE TERMS AND PRIORITY OF DOCUMENTS

These Terms, together with the Privacy Statement and any applicable acceptable-use, security or administrative policy, form the principal user-facing rules for the Platform.

They do not replace:

• the Nigeria Data Protection Act 2023 or applicable directives;
• binding NYSC statutes, regulations or lawful administrative instructions;
• employment, service or other contractual obligations applicable to a user;
• any separate agreement governing the relationship between the responsible institution and a technology provider; or
• mandatory legal rights and obligations.

Where the documents conflict, applicable law shall prevail. Any remaining inconsistency shall be resolved by the responsible institution in accordance with its lawful authority and the purpose of the relevant document.

32. OFFICIAL CONTACT AND SUPPORT

For assistance concerning access, device binding, clearance submissions, account security or administrative review, contact:

NYSC Ops Support: support@nysc.online

Administrative office: IT Administrative Unit, EIB Stratoc Limited

Support telephone: +234 707 506 3732

For privacy requests or complaints:

Data Controller: National Youth Service Corps, Plot 416, Tigris Crescent, Off Aguiyi Ironsi Street, Maitama, Abuja

Data Protection Officer: Data Protection Officer, NYSC National Directorate

Privacy email: elujulo@eibstratoc.com

Postal address: Plot 416, Tigris Crescent, Off Aguiyi Ironsi Street, Maitama, Abuja

Platform Operator: EIB Stratoc Limited (RC 1952655), Plot 859 Bintu Shettima Road, Idu Industrial Area, Idu, Abuja, FCT

Regulator: Nigeria Data Protection Commission (www.ndpc.gov.ng)

Users should not submit passwords, authentication tokens or unnecessary biometric information through ordinary support email.

33. ACKNOWLEDGEMENT

By accessing or using NYSC Ops, the user acknowledges that they have been provided with access to these Terms and the accompanying Privacy Statement and agrees to comply with the rules applicable to their authorised role.

Where electronic acknowledgement is required, the Platform should record the relevant version, date and time, user identifier and acknowledgement method.

Acknowledgement of these Terms does not constitute blanket consent to the processing of personal data, a waiver of statutory rights or acceptance of an unlawful administrative decision.