1. Introduction

The Pharmacists Council of Nigeria ("PCN", "we", "us", or "our") operates the Pre-Registration Examination for Pharmacists (PEP) online portal at pep.pcnmcpd.com ("the Platform"). This Data Privacy Policy explains how we collect, use, store, protect, and share your personal data in compliance with the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation 2019 (NDPR).

By creating an account and using this Platform, you consent to the collection and processing of your personal data as described in this policy.

---

2. Data Controller

The data controller responsible for your personal data is:

Pharmacists Council of Nigeria (PCN)
Plot 471, Constitution Avenue, Central Business District
Abuja, Federal Capital Territory, Nigeria
Website: www.pcn.gov.ng

---

3. Personal Data We Collect

We collect the following categories of personal data when you register for and use the Platform:

3.1 Account Information

• Email address (used as your username)
• Password (stored in encrypted/hashed form)

3.2 Profile and Identification Data

• Full name (surname, first name, other names)
• Date of birth and gender
• Residential address and state of origin
• Phone number
• Passport photograph
• National Identification Number (NIN)
• Provisional Registration Number
• Certificate of Experience Number

3.3 Professional and Educational Data

• Institution attended and year of graduation
• Internship Training Centre (ITC) details
• Preceptor information (name, designation, registration number, contact details)
• Internship area selections

3.4 Examination and Payment Data

• Examination registration details and examination number
• Examination centre assignment
• Payment transaction references (RRR, transaction IDs)
• Examination scores and results

3.5 Technical Data

• Browser type, IP address, and access timestamps (collected automatically via server logs)

---

4. Purpose of Data Collection

Your personal data is collected and processed for the following specific purposes:

Purpose	Lawful Basis (NDPA)
Creating and managing your user account	Consent; Performance of contract
Processing examination registration	Performance of statutory function; Consent
Identity verification for examination integrity	Legitimate interest; Legal obligation
Processing and verifying examination payments	Performance of contract
Generating examination centre lists and registration slips	Performance of statutory function
Recording and communicating examination results	Performance of statutory function
Contacting you regarding your registration or examination	Performance of contract; Legitimate interest
Fulfilling regulatory and statutory obligations of PCN	Legal obligation

---

5. Sensitive Personal Data

We collect certain data that may be classified as sensitive under the NDPA, including:

• Passport photographs (biometric data)
• National Identification Number (NIN)

This data is collected with your explicit consent and is processed solely for the purpose of identity verification during examination registration and administration. This data is handled with enhanced security measures as described in Section 8.

---

6. Data Sharing and Disclosure

Your personal data may be shared with:

• Remita (SystemSpecs) — Payment transaction references are shared for payment processing and verification.
• Examination centre administrators — Your name, photograph, examination number, and centre assignment are shared for examination administration purposes.
• Regulatory authorities — As required by Nigerian law or by a court order.

We do not sell, rent, or trade your personal data to third parties for marketing or commercial purposes.

---

7. Data Retention

Your personal data will be retained for the following periods:

• Account and profile data: For as long as your account remains active, and for a period of 6 years following account closure or last examination, in line with regulatory record-keeping obligations.
• Examination records and results: Retained permanently as part of PCN's statutory regulatory records.
• Payment records: Retained for a minimum of 6 years in accordance with financial regulations.
• Server logs: Retained for up to 12 months.

After the retention period, personal data that is no longer required will be securely deleted or anonymised.

---

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Passwords are stored using industry-standard one-way hashing (bcrypt) and are never stored in plain text.
• Access to personal data is restricted to authorised PCN administrators and managers based on role-based access controls.
• Data transmission between your browser and the Platform is encrypted using SSL/TLS (HTTPS).
• The Platform is hosted on secured servers with regular security reviews.
• Passport photographs undergo an approval workflow to prevent misuse.

---

9. Your Rights as a Data Subject

Under the Nigeria Data Protection Act 2023, you have the following rights:

Right	Description
Right of Access	You may request a copy of the personal data we hold about you.
Right to Rectification	You may request correction of inaccurate or incomplete personal data.
Right to Erasure	You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to regulatory retention obligations.
Right to Restriction	You may request that processing of your data be restricted in certain circumstances.
Right to Data Portability	You may request your personal data in a structured, commonly used, machine-readable format.
Right to Object	You may object to the processing of your personal data in certain circumstances.
Right to Withdraw Consent	Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of prior processing.

To exercise any of these rights, please contact us using the details in Section 11.

---

10. Cookies and Tracking

The Platform uses essential session cookies required for authentication and security (e.g., CSRF protection, session management). We do not use advertising, analytics, or third-party tracking cookies.

---

11. Contact Information

For questions, concerns, or requests regarding this privacy policy or your personal data, please contact:

Data Protection Officer
Pharmacists Council of Nigeria (PCN)
Email: dpo@pep.pcnmcpd.com
Phone: +234 907 700 5155

You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your data protection rights have been violated.

---

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Any changes will be posted on this page with an updated "Last Updated" date. Where changes are significant, we will make reasonable efforts to notify registered users via email.

---

13. Consent

By creating an account on this Platform, you acknowledge that you have read, understood, and agree to the collection and processing of your personal data as described in this Data Privacy Policy.