Data Protection Impact Assessment (DPIA)

SuperMind Global Limited

Operator of the SuperMind Education Platform

📅 Version 1.1 — Last Updated: 29 August 2026

📧 support@supermindeducation.com | 🌍 supermindeducation.com

This Data Protection Impact Assessment (DPIA) is an internal and institutional document prepared to assess and document how SuperMind Global Limited (“SuperMind”, “we”, “our”, or “us”), through its SuperMind Education platform, processes, stores, secures, retains, and protects personal data and mitigates associated privacy and security risks.

SuperMind Global Limited operates a global data-protection framework designed around principles of privacy, security, data minimisation, purpose limitation, access control, appropriate retention, transparency, accountability, and protection of data-subject rights. These principles are applied across the SuperMind Education platform regardless of the country or region from which the platform is accessed, subject to applicable legal requirements.

In addition to this global framework, SuperMind Global Limited seeks to comply with applicable data-protection, privacy, student-record, and children's privacy requirements in each jurisdiction where those requirements apply. These may include, where applicable, the General Data Protection Regulation (GDPR), the Family Educational Rights and Privacy Act (FERPA), the Children's Online Privacy Protection Act (COPPA), and other applicable national, regional, state, and institutional requirements.

This DPIA is intended to provide schools, universities, regulators, auditors, partners, investors, and other relevant stakeholders with clear information about the nature and purpose of SuperMind's data processing, the categories of personal data processed, data flows, retention practices, security safeguards, access controls, data-subject protections, and measures used to identify and mitigate privacy risks associated with the SuperMind Education platform.

1. Executive Summary

SuperMind Global Limited, through its SuperMind Education platform, provides AI-powered educational services used by students, instructors, schools, partners, and institutions. Depending on the services being used, the platform may process personal and educational data, including student identities, academic records, examination scripts, AI-assisted assessment results, wallet transactions, and instructor information.

This DPIA describes what data we process, why we process it, how it flows through the system, what risks are involved, and which safeguards we have implemented to reduce those risks to an acceptable level. The purpose is to ensure that our processing follows SuperMind's global data-protection principles and applicable legal requirements, particularly where children's data, student records, and examination records are involved.

2. System Overview

SuperMind Education provides a unified digital environment for learning, assessment, communication, and educational activities, including:

• AI-assisted exam grading, including handwritten examination scripts
• Student and instructor dashboards
• Lesson uploads, including videos, notes, and educational materials
• Classroom forums and announcement tools
• Academic timetables and scheduling features
• Partner advertisement and impression tracking systems
• Wallet and coin systems for permitted in-platform payments
• Payment processing through Flutterwave

The platform may be used by primary, secondary, tertiary, vocational, and other educational institutions and may operate across multiple countries and regions, subject to applicable laws and institutional requirements.

3. Purpose of This DPIA

This DPIA has been prepared because certain SuperMind Education processing activities may involve data that requires additional privacy and security safeguards, including:

• Children's and students' personal data
• Exam scripts, grades, scores, and academic profiles
• Payment-related records and wallet balances
• Files and educational content processed through cloud infrastructure
• Data processed using AI systems for grading and related educational functions

Depending on the jurisdiction, context, scale, and nature of the processing, some of these activities may be considered higher-risk processing or may be subject to additional safeguards under applicable privacy, student-record, or children's privacy requirements.

This DPIA helps SuperMind Global Limited to:

• Identify and document potential privacy and security risks
• Describe measures implemented to mitigate those risks
• Demonstrate accountability to institutions, users, partners, auditors, and regulators
• Ensure that personal-data processing is fair, lawful, transparent, necessary, and proportionate

4. Description of Data Processing

4.1 Categories of Data Collected

A. Personal Identification Data

• Full name
• Email address
• Phone number
• Password, stored using secure password hashing
• Country, state, and city, where required or provided
• School, university, faculty, department, programme, class, level, or related educational information, where applicable
• Student examination or registration number, where applicable
• Profile photo or avatar, where voluntarily provided or required for a particular service

B. Educational & Academic Data

• Uploaded examination scripts and answer sheets
• AI-assisted grading outputs and scoring breakdowns
• Grades, scores, and relevant performance information
• Academic timetables and course schedules
• Lesson content, notes, videos, and teaching materials
• Instructor feedback and comments on student work
• Assignment submissions, where the relevant feature is used

C. Usage & Interaction Data

• Forum posts, educational discussions, comments, and replies
• Likes, reactions, and other engagement signals
• Lesson, video, and educational resource interactions
• Login and navigation information used for functionality, security, and service improvement

D. Technical & Device Data

• IP address
• Approximate location derived from IP address, where applicable
• Browser type and version
• Device type and operating system
• Login timestamps and session identifiers
• Cookies and similar technologies used for authentication, security, and permitted analytics

E. Payment & Wallet Data (via Flutterwave)

Financial transactions such as wallet top-ups, coin purchases, subscriptions, and applicable partner payments may be processed by Flutterwave or another authorised payment provider made available through the platform.

SuperMind Global Limited does not intentionally store users' full payment-card numbers, card security codes (CVV), or other complete card credentials when those details are entered directly into the payment provider's secure payment environment.

SuperMind may receive and store transaction-related information necessary to operate the platform, including:

• Transaction reference
• Payment status
• Transaction amount
• Currency
• Date and time of payment
• Wallet and coin balances associated with a user's SuperMind account

4.2 How Data Flows Through the System

• Users register or create accounts → required identification and profile data is transmitted to and stored within SuperMind's authorised infrastructure.
• Students and instructors upload examination scripts, assignments, lessons, or educational materials → files are transmitted through SuperMind's infrastructure and processed as necessary to provide the requested service.
• AI-assisted grading processes submitted examination content → relevant grading outputs, scores, feedback, examination identifiers, and related results may be written to the SuperMind database.
• Users purchase coins, subscriptions, or other eligible services → payment processing is performed by Flutterwave or another authorised payment provider, while relevant transaction references and statuses are returned to SuperMind.
• Users interact through forums, announcements, assignments, timetables, and dashboards → relevant interaction data is processed to deliver these functions and maintain the service.
• Students may access authorised examination results and related information through their accounts where the relevant result is associated with their verified educational identifiers.
• Instructors may access examination and assessment information necessary to perform grading and manage their educational activities, subject to applicable access controls.
• Institutions may access authorised educational reports where such institutional access is provided and appropriately authorised.

5. Global Data-Protection Principles

SuperMind Global Limited applies a common set of data-protection principles across the SuperMind Education platform. These principles are intended to provide a consistent baseline of protection while also allowing additional safeguards to be applied where required by local law, institutional policy, or contractual obligation.

• Lawfulness, fairness, and transparency: Personal data should be processed for legitimate and clearly communicated purposes.
• Purpose limitation: Personal data should only be used for purposes connected to the operation, security, improvement, and authorised use of the platform.
• Data minimisation: SuperMind seeks to collect and retain only information reasonably necessary for the relevant service or legal requirement.
• Accuracy: Reasonable measures are used to enable correction of inaccurate personal information and educational identifiers.
• Storage limitation: Personal data should not be retained longer than reasonably necessary for the purpose for which it was processed, subject to legal, institutional, security, dispute-resolution, and contractual requirements.
• Integrity and confidentiality: Appropriate technical and organisational safeguards are used to protect personal information against unauthorised access, disclosure, alteration, loss, or destruction.
• Access control: Access to personal and educational information is restricted according to account type, authorisation, role, and service requirements.
• Accountability: SuperMind seeks to document relevant processing activities, safeguards, retention practices, and risk-management measures.
• Privacy by design and by default: Privacy and security considerations are incorporated into platform design and development where reasonably practicable.

6. Data Retention and Deletion

SuperMind Global Limited seeks to retain personal information only for the period reasonably necessary to provide the relevant service, maintain security and operational integrity, satisfy applicable legal or contractual requirements, resolve disputes, or protect legitimate interests.

Different categories of data may have different retention periods based on their purpose and sensitivity. Where data is no longer reasonably required, SuperMind may delete, anonymise, aggregate, or otherwise securely dispose of the information in accordance with applicable requirements and technical capabilities.

6.1 Examination Scripts and Images

Examination script images uploaded for AI-assisted grading are intended to be retained only for the period required to complete grading, instructor review, student review where applicable, dispute resolution, and related educational functions.

Unless a different retention period is required by an institution, applicable law, an active dispute, a security investigation, or another legitimate operational requirement, SuperMind may automatically delete examination script images after the applicable review and retention period has expired.

Deletion of examination script images does not necessarily require deletion of the associated grading result where the score, feedback, examination number, rubric information, or other result data must remain available for authorised educational purposes.

7. Security Measures

SuperMind Global Limited uses technical and organisational safeguards designed to protect personal and educational information against unauthorised access, accidental loss, misuse, disclosure, alteration, or destruction.

Depending on the relevant system and service, safeguards may include:

• Secure authentication and session management
• Password hashing
• Role-based and account-based access controls
• Transport encryption for supported network communications
• Restricted database and infrastructure access
• Logging and security monitoring where appropriate
• Input validation and application-level security controls
• Data minimisation and retention controls
• Backups and service-recovery measures where appropriate
• Separation of user roles and permissions
• Regular review and improvement of platform security controls

8. AI-Assisted Processing

SuperMind Education may use artificial intelligence systems to assist instructors with examination grading, transcription, identification of examination information, application of grading criteria, feedback, and other educational functions.

AI-assisted outputs are intended to support educational workflows and should be used in accordance with applicable institutional rules and instructor responsibilities. Where appropriate, instructors may review, verify, correct, or override relevant AI-generated outputs.

SuperMind seeks to minimise the personal information provided to AI systems to what is reasonably necessary for the relevant processing task and applies access and retention safeguards appropriate to the service.

9. Children's and Student Data

Because SuperMind Education may be used in educational environments, some users may be children or young people. SuperMind Global Limited seeks to apply additional care when processing children's and students' personal information.

Where consent, parental authorisation, school authorisation, or another specific legal basis is required by applicable law, the relevant institution, parent, guardian, user, or other authorised party may be responsible for providing or obtaining that authorisation as required by the circumstances.

SuperMind may also restrict certain features, data uses, communications, or account functions where additional safeguards are appropriate for younger users.

10. International Data Processing

SuperMind Education is designed as an international platform. Personal information may therefore be processed, transmitted, or stored in countries different from the country in which a user, instructor, or institution is located.

Where international data-transfer requirements apply, SuperMind Global Limited seeks to use appropriate contractual, technical, organisational, or legal safeguards as required by the applicable jurisdiction and the nature of the processing.

Applicable privacy rights and legal requirements may differ between countries and regions. SuperMind's global data-protection framework is intended to provide a common baseline of protection while supporting additional jurisdiction-specific measures where necessary.

11. Third-Party Service Providers

SuperMind Global Limited may use authorised third-party service providers to support functions such as payment processing, cloud infrastructure, communications, analytics, security, storage, and AI-assisted processing.

Third-party providers are expected to process data only for authorised purposes and subject to applicable agreements, provider terms, technical safeguards, and legal requirements.

SuperMind does not intentionally provide personal information to third parties for unrelated purposes without an appropriate legal, contractual, or user-authorised basis.

12. Data-Subject Rights

Depending on the jurisdiction and applicable law, users may have rights relating to their personal information. These rights may include:

• The right to request access to personal information
• The right to request correction of inaccurate information
• The right to request deletion where legally applicable
• The right to object to or restrict certain processing
• The right to request data portability where legally applicable
• The right to withdraw consent where processing is based on consent
• The right to raise concerns or complaints regarding data processing

These rights are subject to applicable legal exemptions, authentication requirements, institutional responsibilities, security considerations, and other lawful limitations.

13. Risk Assessment

Potential Risk	Possible Impact	Mitigation Measures
Unauthorised account access	Exposure of personal or educational information	Authentication controls, password hashing, session controls, access restrictions, and security monitoring where appropriate
Incorrect AI-assisted grading output	Incorrect score, feedback, or academic outcome	Instructor review, correction mechanisms, rubric-based grading, audit information, and result verification
Incorrect student or examination matching	Result associated with the wrong student	Examination identifiers, account matching, access controls, correction workflows, and instructor verification
Excessive data retention	Increased privacy and security exposure	Retention policies, deletion processes, data minimisation, and periodic review
Loss or compromise of uploaded examination files	Exposure of student academic information	Restricted access, retention controls, secure infrastructure, and deletion after the applicable retention period
Third-party service failure or breach	Loss, exposure, or interruption of data processing	Provider assessment, contractual controls where appropriate, restricted data sharing, and service architecture safeguards
International data-transfer risk	Data processed under different legal regimes	Appropriate legal, contractual, organisational, and technical safeguards where applicable

14. Necessity and Proportionality

SuperMind Global Limited seeks to ensure that personal-data processing is reasonably necessary and proportionate to the educational, operational, security, communication, payment, and platform functions being provided.

The platform is designed to avoid unnecessary collection of personal information where practical. Access to information is intended to be limited according to user role, authorisation, educational relationship, and legitimate operational requirements.

15. DPIA Review and Continuous Improvement

This DPIA may be reviewed and updated when SuperMind introduces significant new processing activities, materially changes its infrastructure or AI systems, expands into new regulatory environments, changes its data-retention practices, or identifies new privacy or security risks.

SuperMind Global Limited may also update this assessment in response to changes in applicable law, regulatory guidance, institutional requirements, security practices, or the functionality of the SuperMind Education platform.

16. Contact

Questions, requests, or concerns relating to this DPIA or SuperMind's processing of personal information may be directed to:

SuperMind Global Limited
SuperMind Education Platform
Email: support@supermindeducation.com
Website: supermindeducation.com