3. Privacy Policy

Mahi Institute by Nèsta – Privacy Policy

First published: 22 July 2024 · Last updated: 10 March 2026

Thank you for trusting Mahi Institute by Nèsta with your personal data. This Privacy Policy explains what we collect, why, how we protect it, who we share it with and what rights you have. It applies to our website www.mahiinstitutebynesta.com, the Mahi app, our social media pages, live sessions, community spaces and communications.

1. Who We Are (Data Controller)

The data controller is Mahi Institute by Nèsta, an international training institute. Our Data Protection Officer can be contacted at legal@mahiinstitute.com. Students everywhere can use the same address for all privacy requests.

2. Laws That Apply

We handle personal data in line with: the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (our primary data protection framework); the Personal Data Protection Proclamation No. 1321/2024 of Ethiopia; the Digital Code of the Republic of Benin (Law No. 2017-20), supervised by the Autorité de Protection des Données Personnelles (APDP); the Nigeria Data Protection Act 2023, supervised by the Nigeria Data Protection Commission (NDPC); and the Data Protection Act 2012 (Act 843) of Ghana, supervised by the Data Protection Commission of Ghana. Where several laws apply, we follow the standard that gives you the greater protection.

3. Personal Data We Collect

3.1 Data you give us: full name, email address, phone or WhatsApp number, country and city, age confirmation, username and password, business name and type, goals and experience level, payment and billing details (processed by our payment providers), assignments, photographs and videos you share, messages, survey responses and support correspondence.

3.2 Data collected automatically: IP address, device type and ID, browser type, operating system, time zone, app version, lessons viewed and completed, time spent, quiz results, clicks, referring website, crash logs and approximate location derived from IP.

3.3 Data from third parties: payment confirmation from payment processors, app-store transaction data, information from learning, video, email and messaging providers, and information you make public on social media when you tag or message us.

3.4 Sensitive data. We do not ask for sensitive personal data (such as health, religion, political opinions or government ID numbers) except where required by law or for fraud prevention. Please do not post such data in assignments or community spaces.

3.5 Children. Our Services are not directed to children under 16 and we do not knowingly collect their data. If a parent or guardian enrols a 16–17-year-old, we process that student’s data on the basis of the guardian’s consent. If we learn we hold a child’s data without proper consent, we will delete it promptly.

4. How and Why We Use Your Data

We do not sell your personal data. Testimonials, reviews, results, assignments and other content you submit to the Institute may be published and used by us as set out in the Terms of Service, which you accept when you register or submit them. We do not use your data for fully automated decisions that produce legal or similarly significant effects on you.

5. Who We Share Data With

We share personal data only as needed and under written agreements requiring confidentiality and security:

• Service providers: hosting and cloud storage, video delivery, learning and app infrastructure, email and messaging platforms (including WhatsApp and SMS providers), support tools, analytics and fraud-prevention providers;
• Payment processors and banks: to take payments, process refunds and handle disputes;
• App stores: Apple and Google, for app distribution and in-app purchases;
• Professional advisers: lawyers, auditors and accountants under duties of confidentiality;
• Authorities: where required by law, court order or to protect rights, safety and security, including to defend the Institute against fraud, defamation or unlawful conduct;
• Business transfers: a successor if the business is reorganised or sold, on terms that protect your data;
• Other students and instructors: only information you choose to display in community spaces.

6. International Data Transfers

We serve students worldwide, so your data may be processed in the Philippines, United Kingdom, Ethiopia, Jamaica, Benin Republic, South Africa, Nigeria, Zimbabwe, Sierra Leone, Ghana, Cameroon and other countries where our providers operate, including the European Economic Area and the United States. Where we transfer data across borders we use safeguards required by law, such as adequacy decisions, standard contractual clauses, the UK International Data Transfer Agreement or Addendum, binding commitments from providers or, where lawful, your consent.

7. Data Retention

We keep personal data only as long as needed for the purposes in this Policy and to meet legal duties:

• Account and enrolment data: while your account is active and up to 6 years afterwards for legal, tax and dispute purposes;
• Payment and invoicing records: at least 6 years;
• Learning progress and certificates: while your account is active, then up to 5 years;
• Records of conduct breaches, expulsion and fraud: up to 6 years, to protect the Institute and its students;
• Marketing contact data: until you unsubscribe or are inactive for 24 months;
• Support correspondence: up to 3 years after closure.

When data is no longer needed it is securely deleted or irreversibly anonymised.

8. Security

We use appropriate technical and organisational measures: encrypted transmission (SSL/TLS), encrypted storage for sensitive data, role-based access control, multi-factor authentication for administrators, staff confidentiality obligations and regular security reviews and backups. No method of transmission or storage is completely secure, so please use a strong, unique password. If a breach is likely to put your rights at risk, we will notify the relevant regulator and affected individuals as the law requires, including within 72 hours where applicable.

9. Your Rights

Depending on where you live, you may have the right to: access your data; correct inaccurate data; erase your data in certain circumstances; restrict processing; object to processing based on legitimate interests and to direct marketing; receive your data in a portable format ; withdraw consent at any time; not be subject to automated decisions with significant effects; and complain to a regulator .

To exercise a right, email legal@mahiinstitute.com. We may need to verify your identity. We respond within one month (30 days), extendable where the law permits. We may keep data we are legally entitled or required to retain, such as payment records and records needed to defend legal claims.

Regulators you may contact: the UK Information Commissioner’s Office (ICO); the competent personal data protection authority in Ethiopia; the APDP in Benin; the NDPC in Nigeria; and the Data Protection Commission of Ghana. We would appreciate the chance to resolve your concern first.

10. Marketing Choices

You can opt out of marketing by clicking “unsubscribe” in any email, replying STOP to messages, changing notification settings in the Mahi app, or emailing management@mahiinstitute.com. We will still send essential service messages such as receipts, access links and security alerts.

11. Cookies and Third-Party Links

We use cookies as explained in our Cookie Policy. Our Platform may link to third-party sites and social platforms whose privacy practices are their own.

12. Changes to this Policy

We may update this Policy to reflect changes in law or practice. Updates are posted on this page with a new effective date, and material changes will be notified by email or in-app notice.

13. Lawful Bases for Using Your Data

13.1 Contract. We use your data to provide the Programmes you enrol for, give you access and support you.

13.2 Legitimate interests. We use limited data to keep the Services secure, prevent fraud, improve our teaching and understand how our website is used, where this does not override your rights.

13.3 Consent. We rely on your consent for certain marketing and for non-essential cookies, and you can withdraw consent at any time.

13.4 Legal obligation. We keep and share some data where the law requires, for example for tax, accounting or in response to lawful requests.

14. Automated Decisions and Advertising

14.1 No significant automated decisions. We do not make decisions that have legal or similarly significant effects on you solely by automated means.

14.2 Advertising measurement. We use advertising tools, including the Meta Pixel and server-side event measurement, to understand which adverts lead people to register an interest. These tools may receive information such as your IP address, browser details and the fact that you took an action on our website.

14.3 Your control. You can limit advertising tracking through your browser, device and Meta account settings, and by managing cookies as described in our Cookie Policy.

15. Children

15.1 Adults only. Our Programmes are intended for adults. We do not knowingly collect personal data from children.

15.2 If you think a child has registered. If you believe a child has given us personal data, contact us and we will delete it promptly.

16. Data Breaches

16.1 Our response. If a personal data breach occurs that is likely to put your rights at risk, we will take steps to contain it and will notify you and the relevant authority where the law requires.

17. How to Complain

17.1 Contact us first. If you have a concern about how we handle your data, email management@mahiinstitute.com and we will respond promptly.

17.2 Regulator. You also have the right to complain to the data protection authority in your country. In the United Kingdom this is the Information Commissioner’s Office (ico.org.uk).

18. Contact

Mahi Institute by Nèsta · Address: Wheler Street, Droylsden, Manchester, M11 1DR, United Kingdom · Email: management@mahiinstitute.com · support@mahiinstitute.com · Website: www.mahiinstitutebynesta.com

Thank you for trusting Mahi Institute by Nèsta with your data.