Skip to content
OS Digital EducationResearch Assessment Portal Sign in

Research Assessment Portal

Privacy Policy

Last updated 29 October 2026 · How OS Digital Education handles personal data in the Research Assessment Portal (RAP).

1. Who is responsible

OS Digital Education is the data controller for personal data in the portal. The portal is used for research supervision and assessment, which is part of the institution's academic function. Personal data is processed in line with the Nigeria Data Protection Act 2023 and the institution's own data protection policy.

2. What data the portal holds

Account and profile

  • Name, title, e-mail address and phone number.
  • Matriculation Number or Staff ID, department, programme and entry session.
  • For staff: designation, specialisation and supervision capacity.
  • Role(s) and account status.
  • Your password, stored only as a one-way hash. Nobody, including the institution, can read it.

Research records

  • Projects, group membership and supervisor assignments.
  • Topic proposals, submissions and every version, and the uploaded files.
  • Reviews, decisions, required corrections, deadlines and approvals.
  • Discussions and comments, including their edit history.
  • Grades given after completion.
  • For supervisors and administrators: their personal research topic bank.

Activity and security data

  • The project timeline (who did what and when).
  • An audit log of administrative actions.
  • Sign-in attempts (an encrypted fingerprint of the identifier used, the IP address and the result) and the time of your last sign-in.
  • For "Remember me", the browser description and IP address of each remembered device.
  • In-app notifications and a log of e-mails sent to you.
  • A record of AI requests (who asked, which feature, which provider and model, token counts). The record does not contain the request's text.

3. Why it is used

  • To run research supervision: routing proposals and submissions to the right supervisors, recording decisions and corrections, tracking deadlines and moving projects through their stages.
  • To produce lists and reports for the research office and supervisors, for example supervisee lists, student lists and grade lists (PDF or Excel), and statistics on progress and overdue work.
  • To send account and workflow notices, and broadcast messages from the people responsible for you.
  • To keep the portal secure: detecting repeated failed sign-ins, investigating misuse and keeping an accountable record of administrative actions.
  • To keep accurate academic records that the institution is required to keep.

The portal does not sell personal data, show advertising or profile users for marketing.

4. Who can see it

  • Students see their own projects. In a group project, they also see the names of the other members and the shared work.
  • Supervisors see the projects they are assigned to and the students they manage, including those students' contact details. Their dashboards and lists count only those records.
  • Administrators see institution-wide records needed to manage the portal. Confidential supervisor-only discussions stay hidden from administrators unless the institution allows otherwise. Private group discussions are visible only to the students in the group.
  • The Super Admin manages settings, moderation and data clean-up.

Data is not shared outside the institution, except with the service providers needed to run the portal (hosting, e-mail delivery and, if enabled, the AI provider below), or where the law requires it.

5. AI providers

AI features are currently switched off, so no data is sent to any AI provider. If they are switched on, data will be sent only when a user asks for an AI feature. Only topic text and academic context are sent, never names, identification numbers or contact details.

6. E-mail

E-mails are sent from the institution's mail server or e-mail provider and are logged in the portal's e-mail queue (recipient, subject, status). Broadcast e-mails are sent individually, so recipients do not see each other's addresses.

7. Cookies and browser storage

  • rap_session: an essential session cookie that keeps you signed in and protects forms against cross-site request forgery. It is deleted when you sign out, close the browser or stay idle for 30 minutes.
  • rap_remember: set only if you tick "Remember me". It holds a random token, and only a hash of it is stored on the server. It expires after 30 days without activity and is removed when you sign out.
  • The browser's session storage keeps small interface preferences, such as the open settings tab and the sidebar scroll position. They are cleared when the tab closes.
  • Google reCAPTCHA protects the sign-in and password pages against automated attacks. On those pages only, Google's reCAPTCHA script runs and may set its necessary _GRECAPTCHA cookie; it sends Google information about your browser and how you use the page so it can tell people from bots. Google's Privacy Policy and Terms of Service apply to that check.

The portal uses no analytics or advertising cookies, and pages load no external scripts or fonts except Google reCAPTCHA on the sign-in and password pages.

8. Security

Security measures include:

  • encrypted connections (HTTPS) in production;
  • hashed passwords;
  • encryption of stored API keys;
  • role-based and record-level access checks on every request;
  • private file storage outside the public web folder;
  • file-type validation;
  • sign-in throttling, Google reCAPTCHA on the public forms and automatic session time-outs;
  • an audit log of administrative actions.

No system is perfectly secure. Report any suspected breach to the research office straight away.

9. How long data is kept

  • Research records (projects, submissions, reviews and decisions) are kept for 7 years, or longer where the institution's regulations require. Accounts with research history are archived, not erased.
  • Housekeeping data (notifications, sent e-mail logs, sign-in attempts, expired tokens, AI outputs and old files of closed projects) may be permanently deleted earlier by the Super Admin's data clean-up. Each clean-up is recorded in the audit log.
  • Content removed by moderation stays in a recycle bin until it is restored or permanently deleted.

10. Your rights

Subject to the law and the institution's record-keeping duties, you may ask to:

  • see the personal data held about you;
  • have inaccurate data corrected;
  • object to or restrict certain processing;
  • have data deleted when it is no longer needed.

Where the institution allows it, you can update some details yourself on My profile. Send other requests to the research office. Some research records cannot be deleted while the institution must keep them. If you are not satisfied with the response, you may complain to the Nigeria Data Protection Commission.

11. Changes and contact

This policy is updated when the portal changes; the date at the top shows the current version. Questions or requests about your data: Send mail.