Terms of Service

1. Definitions and interpretation

1.1In these Terms:

• (a)"Ambezi", "we" and "us" mean Ambezi Technologies Solutions Limited, a company incorporated in the Federal Republic of Nigeria under the Companies and Allied Matters Act 2020.
• (b)"Institution" means the university, polytechnic, college of education or other tertiary institution that registers for the Platform.
• (c)"Platform" means the Rubric examination and assessment software, including its web, desktop and mobile applications, application programming interfaces and related services.
• (d)"Institutional Users" means the administrators, lecturers, invigilators and students whom the Institution authorises to use the Platform.
• (e)"Institution Content" means all data and materials the Institution or its Institutional Users put into the Platform, including questions, marking schemes, answers, images, student and staff records and results.
• (f)"Subscription" means the Institution's right to use the Platform under the plan confirmed on onboarding, for a given semester.
• (g)"Semester" means an academic semester or session for which the Institution uses the Platform.
• (h)"Data Protection Law" means the Nigeria Data Protection Act 2023 and the regulations and directives issued under it by the Nigeria Data Protection Commission ("NDPC"), including the General Application and Implementation Directive 2025.
• (i)"Privacy Policy" and "SLA" mean our Privacy Policy and Service Level Agreement published on this website, as updated.

1.2Headings are for convenience and do not affect meaning. "Including" means "including without limitation". References to a law include that law as amended or replaced. A reference to writing includes email.

2. The agreement and acceptance

2.1These Terms, the Privacy Policy, the SLA, Schedule 1 (Data Processing Terms) and the plan or order confirmed on onboarding together form the agreement between Ambezi and the Institution (the "Agreement"). If they conflict, the order of priority is: Schedule 1 (for personal data), the plan or order, these Terms, the SLA, then the Privacy Policy.

2.2The Institution accepts the Agreement when its authorised representative registers the Institution, ticks the acceptance box, signs an order, or first uses the Platform, whichever happens first. The person accepting confirms they have authority to bind the Institution. The parties agree that acceptance in electronic form is valid and that electronic records, including emails and Platform logs, may be used as evidence to the extent the Evidence Act 2011 allows.

2.3If you do not agree to the Agreement, do not use the Platform.

3. Eligibility, accounts and Institutional Users

3.1The Platform is intended for Nigerian tertiary institutions. The Institution confirms that it is duly established or accredited in Nigeria and that the information it gives us is accurate and kept up to date.

3.2Each Institutional User must have their own account and must not share credentials. A student must be at least 16 years old. Where a student is under 18, the Institution is responsible for any parent or guardian consent the Data Protection Law requires (see Schedule 1).

3.3The Institution is responsible for all activity under its accounts, for keeping credentials secure, for promptly removing users who no longer need access, and for telling us at support@ambezi.com without delay if it suspects unauthorised access. We are not liable for loss caused by the Institution's or its users' failure to protect credentials.

3.4Each Institution's data is kept separate from every other Institution's. An Institution must not attempt to access another Institution's data.

4. The Platform

4.1Subject to the Agreement, we grant the Institution a non-exclusive, non-transferable, revocable right during the Subscription to use the Platform for creating, delivering, marking and administering examinations and assessments for its own students.

4.2AI-assisted grading. The Platform may suggest scores for written answers using an AI model. A suggested score is an aid to a lecturer's judgement, not a final grade. The Institution must ensure that a qualified person reviews AI-suggested scores before results are published, so that no student is graded solely by automated means. AI output can contain errors.

4.3Examination integrity features. The Platform detects and records certain student actions during an examination (such as leaving the examination screen) and can flag or submit an attempt according to settings chosen by the lecturer. These features are a deterrent and a source of evidence. They cannot prevent every form of malpractice: for example, a second device, a shared screen or a virtual machine cannot be detected by a web page. The Institution remains responsible for invigilation and for fair procedures before any penalty is imposed.

4.4We may improve, change or retire features. If we make a change that materially reduces the core functionality of a paid Subscription, we will give at least 30 days' notice.

5. Institution responsibilities

5.1The Institution is responsible for:

• (a)the accuracy and lawfulness of the student, staff and examination data it provides, and for having the right to provide it;
• (b)complying with the regulations and guidelines of its regulators, including the National Universities Commission, the National Board for Technical Education and the National Commission for Colleges of Education, and with its own examination policies;
• (c)telling students, before an examination, what the Platform records, how AI-assisted grading works, and how to appeal a result;
• (d)obtaining and recording any consent or other lawful basis required under the Data Protection Law (including parent or guardian consent for students under 18);
• (e)reviewing AI-suggested scores and integrity records before relying on them, and operating fair procedures for any allegation of misconduct;
• (f)providing students with a reasonable way to take examinations where the Platform is unavailable to them for reasons outside their control; and
• (g)making sure Institutional Users comply with the Agreement.

6. Acceptable use

6.1Institutional Users must not, and the Institution must make sure they do not:

• (a)use the Platform for anything other than legitimate educational assessment, or for students not enrolled at the Institution;
• (b)circumvent or interfere with examination security measures, including question randomisation, time limits and copy-and-paste restrictions;
• (c)impersonate another person, or sit an examination or authorise someone else to sit it on their behalf;
• (d)gain or attempt to gain unauthorised access to the Platform, another user's account, another Institution's data, or our systems, contrary to the Cybercrimes (Prohibition, Prevention, etc.) Act 2015 (as amended);
• (e)upload malicious code, overload the Platform, or use bots, scrapers or other automated means without our written permission;
• (f)reverse-engineer, decompile, copy, resell or sublicense any part of the Platform, or use it to build a competing product;
• (g)submit content that is unlawful, defamatory, obscene, infringes another person's rights, or breaches another person's data protection rights; or
• (h)use the Platform in breach of any Nigerian law.

6.2We may investigate suspected breaches, remove content, suspend access under section 17, and report unlawful conduct to the appropriate authorities.

7. Fees and payment

7.1Fees. The Institution pays the fees stated in the plan or order confirmed on onboarding. Fees are normally charged per student unlocked in a Semester, plus any base platform fee stated in the plan. A student is charged once per Semester, however many times they are locked or unlocked in that Semester.

7.2Invoices. We invoice the Institution monthly for students newly unlocked since the previous invoice. Invoices are issued and payable in Nigerian Naira (₦) within 14 days of the invoice date, using the payment methods stated on the invoice.

7.3Payment methods. Payments are processed by Monnify. If the Institution saves a card or sets up a direct-debit mandate, it authorises us, through Monnify, to charge invoices as they fall due. We do not see or store full card numbers. The Institution may change or remove a saved payment method at any time, but remains liable for invoices due.

7.4Taxes. Fees exclude Value Added Tax (currently 7.5%) and any other tax, which we will add where the law requires. If the Institution must deduct withholding tax, it must deduct only the amount the law requires, remit it to the relevant tax authority, and give us a valid withholding tax credit note, so that we receive the invoiced amount less only that lawful deduction.

7.5Late payment. If an invoice is unpaid on its due date, the Subscription is treated as overdue and the Institution keeps access for a further 14 days. After that, we may suspend access until the balance is paid. We will not suspend access during an examination window that is entered in the Platform calendar and notified to us in advance, unless the invoice is more than 30 days overdue. Student data is not deleted because of non-payment. It is kept while access is suspended and fully restored on payment.

7.6Refunds. Fees are non-refundable once an examination has run on the Platform in the relevant Semester. If no examination has run, the Institution may request a pro-rata refund within 7 days of payment.

7.7Price changes. We may change fees for a future Semester by giving at least 30 days' written notice. A change does not affect fees already invoiced.

7.8Disputed invoices. The Institution must tell us of any good-faith dispute within 14 days of the invoice date and pay the undisputed part. We will work together promptly to resolve the dispute.

8. Free trials and pilots

8.1A new Institution may start on a free trial or pilot with the access agreed on onboarding. No payment card is required to start. Moving to a paid Subscription requires the Institution's written confirmation. Trials and pilots are provided "as is", on a best-efforts basis, and without the SLA service credits. At the end of the trial, access may be limited until a paid Subscription starts.

9. Intellectual property

9.1We and our licensors own all intellectual property in the Platform, including the software, designs, AI configurations, documentation and the names "Ambezi" and "Rubric". Nothing in the Agreement transfers ownership to the Institution, and the Institution gets only the right of use in section 4. Our rights are protected under the Copyright Act 2022 and other Nigerian law.

9.2If the Institution or its users give us feedback or suggestions, we may use them without restriction or payment.

9.3Nothing in the Agreement gives the Institution any right in our trade marks, except that it may truthfully say it uses Rubric.

10. Institution Content

10.1As between the parties, the Institution owns the Institution Content, and examination questions and marking schemes created by its lecturers remain the Institution's property. Students keep the rights they hold in their own answers. The Institution grants us (and our sub-processors) a limited, worldwide licence to host, process, copy and display Institution Content only as needed to provide the Platform and as the Agreement allows.

10.2We may use information derived from use of the Platform that does not identify any individual or Institution (for example, the number of examinations run) to operate, secure and improve the Platform and to produce statistics.

10.3The Institution is responsible for its Institution Content and must have all rights and permissions needed to upload it. At any time during the Subscription, and for 90 days after it ends, the Institution may export its examination records. We will help on request. Uploaded images are deleted automatically one year after upload, so the Institution should export anything it needs to keep for longer.

11. Data protection

11.1Each party will comply with the Data Protection Law. For personal data of students and staff processed on the Platform, the Institution is the data controller and Ambezi is the data processor. Schedule 1 sets out the data processing terms that section 29 of the NDPA requires, and applies automatically. For Institution account, billing and website enquiry data, Ambezi is the controller, as the Privacy Policy explains.

11.2We will keep personal data secure as described in the Privacy Policy and Schedule 1. The Institution will not ask us to process personal data in a way that breaches the Data Protection Law.

12. Confidentiality

12.1Each party will keep the other's confidential information confidential, use it only to perform or receive the benefit of the Agreement, and disclose it only to those personnel and advisers who need it and who are bound by equivalent duties. Confidential information includes examination content, non-public pricing and technical information. It does not include information that is public without breach, was already lawfully known to the recipient, or is independently developed. A party may disclose confidential information where the law, a court or a regulator requires it, after giving the other party notice where lawful.

13. Service levels and support

13.1Our uptime commitment, support response times, maintenance practices and service credits for paid Subscriptions are in the SLA. The SLA does not apply to free trials and pilots. Apart from the SLA, we do not promise that the Platform will be uninterrupted or error-free.

14. Warranties and disclaimers

14.1Each party confirms that it has the authority to enter into the Agreement. We will provide the Platform with reasonable skill and care and in line with the SLA.

14.2Except as stated in the Agreement, and to the fullest extent Nigerian law allows, the Platform is provided "as is" and "as available", and we give no other warranty, express or implied, including of fitness for a particular purpose, uninterrupted operation, or that AI-suggested scores or integrity records are error-free.

15. Limitation of liability

15.1Nothing in the Agreement limits or excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else that Nigerian law does not allow to be limited or excluded.

15.2Subject to that, and to the fullest extent Nigerian law allows: (a) neither party is liable for loss of profit, revenue, goodwill or anticipated savings, or for any indirect or consequential loss; and (b) the total liability of Ambezi to the Institution arising out of or in connection with the Agreement, whether in contract, tort (including negligence), breach of statutory duty or otherwise, is limited to the fees the Institution paid in the three months before the event that gave rise to the claim.

15.3We are not liable for loss caused by Institution-side errors, by the Institution's failure to follow section 5, or by outages of the Institution's own network, power or devices.

16. Indemnities

16.1The Institution will indemnify Ambezi against third-party claims, and the resulting losses and reasonable legal costs, to the extent they arise from: (a) the Institution's failure to obtain any consent or have any lawful basis the Data Protection Law requires for the data it gives us; (b) Institution Content that infringes another person's rights or is unlawful; or (c) its Institutional Users' unlawful use of the Platform.

16.2Ambezi will indemnify the Institution against third-party claims, and the resulting losses and reasonable legal costs, to the extent they allege that the Platform, used as the Agreement permits, infringes that third party's intellectual property rights in Nigeria. We may, at our option, modify the Platform, obtain a right for the Institution to continue using it, or end the affected feature and refund prepaid fees for it.

16.3The indemnified party must promptly notify the other of the claim, let it control the defence and settlement (but a settlement that admits fault for the indemnified party needs that party's consent), and give reasonable help at the indemnifier's cost.

17. Term, suspension and termination

17.1The Agreement starts on acceptance and continues until terminated. Either party may terminate the Subscription by giving 30 days' written notice, effective at the end of a Semester unless the parties agree otherwise.

17.2Either party may terminate immediately by written notice if the other commits a material breach that cannot be remedied, or that it does not remedy within 14 days of written notice of it, or becomes insolvent or ceases business.

17.3We may suspend access immediately, and for as long as needed, where necessary to protect the security of the Platform or other users, to stop unlawful use, to comply with law or a court order, or for non-payment under section 7.

17.4On termination: (a) the right to use the Platform ends, subject to any paid period; (b) the Institution has 90 days to export its examination records, after which we will delete them in line with the Privacy Policy and Schedule 1 unless the Institution instructs otherwise in writing or the law requires us to keep them; (c) accrued rights and unpaid fees remain due; and (d) sections 9, 10, 12, 15, 16, 22 and 23, Schedule 1, and any other provision meant to survive, continue.

18. Force majeure

18.1Neither party is liable for delay or failure to perform (other than to pay money due) caused by events beyond its reasonable control, including natural disaster, epidemic, war, terrorism, civil unrest, industrial action, government action, widespread failure of the national power grid or of telecommunications and internet services, or the failure of a third-party cloud provider that is not caused by our default. The affected party must tell the other promptly and take reasonable steps to resume performance. If the event continues for more than 60 days, either party may terminate on written notice.

19. Anti-corruption and compliance

19.1Each party will comply with applicable anti-corruption law, including the Corrupt Practices and Other Related Offences Act 2000, and will not offer, give, request or accept any bribe or improper advantage in connection with the Agreement. Each party will comply with the sanctions, anti-money-laundering and tax laws that apply to it.

20. Public-sector Institutions

20.1Where the Institution is owned or funded by the Federal Government or a State Government, it confirms that it has obtained all approvals and followed all procurement procedures required to enter into the Agreement (including under the Public Procurement Act 2007, where it applies), that funds are or will be available to pay the fees, and that it will pay invoices by the due date notwithstanding its internal approval or disbursement processes.

21. Notices

21.1Notices under the Agreement must be in writing and sent by email: to us at support@ambezi.com, and to the Institution at the administrator email address on its account. A notice takes effect on the next business day after it is sent, unless the sender receives a delivery-failure message. Each party must keep its contact details current. Operational notices (for example, maintenance) may also be given in the Platform.

22. General

22.1Entire agreement. The Agreement is the whole agreement about the Platform and replaces earlier discussions and proposals. Each party confirms it has not relied on any statement that is not in the Agreement.

22.2Changes. We may update these Terms by giving the Institution at least 30 days' written notice. If a change is materially adverse and the Institution does not accept it, it may terminate under section 17 before the change takes effect. A change does not alter fees or commitments for a paid period already under way, unless the law requires.

22.3Assignment. The Institution may not assign or transfer the Agreement without our written consent. We may assign it to a successor to our business on notice.

22.4Severability and waiver. If a provision is found invalid or unenforceable, the rest of the Agreement continues, and the parties will replace the provision with a valid one that is as close as possible in effect. A failure or delay in enforcing a right is not a waiver of it.

22.5Independent parties. The parties are independent contractors. Nothing in the Agreement creates a partnership, agency, joint venture or employment relationship.

22.6Third parties. Only the parties may enforce the Agreement. Students and other Institutional Users have no right to enforce it against Ambezi, but the Privacy Policy describes the rights they have under the Data Protection Law.

22.7Language. The Agreement is in English, which prevails over any translation.

23. Governing law and disputes

23.1The Agreement, and any dispute or claim arising out of or in connection with it (including non-contractual disputes), is governed by the laws of the Federal Republic of Nigeria.

23.2The parties will first try to settle any dispute in good faith by discussion between senior representatives for 30 days after one gives the other written notice of it. If the dispute is not settled, either party may refer it to mediation. If mediation does not resolve it within 30 days, or either party declines to mediate, the dispute will be finally settled by arbitration under the Arbitration and Mediation Act 2023, by a sole arbitrator agreed by the parties (or, failing agreement within 14 days, appointed under that Act). The seat of arbitration is Lagos, Nigeria, and the language is English.

23.3Nothing stops a party from seeking urgent injunctive or interim relief from the courts of Nigeria to protect its intellectual property or confidential information, or to prevent a breach of the Agreement.

24. Contact

24.1Questions about these Terms: support@ambezi.com. General enquiries: info@ambezi.com.

Schedule 1: Data Processing Terms

A. Details of the processing

B. Our obligations as processor

1.Ambezi will process the personal data only on the Institution's documented instructions, which are given by the Agreement and by the Institution's use of the Platform, unless the law requires otherwise, in which case Ambezi will tell the Institution first where the law permits. Ambezi will tell the Institution if it believes an instruction breaches the Data Protection Law.

2.Ambezi will make sure that everyone it authorises to process the data is bound by a duty of confidentiality.

3.Ambezi will apply appropriate technical and organisational measures to protect the data against accidental or unlawful destruction, loss, alteration, disclosure and access, as described in the Privacy Policy, including tenant separation, role-based access, encrypted connections, hashed passwords and an audit log.

4.Ambezi will, taking account of the nature of the processing, help the Institution respond to requests from data subjects (access, correction, deletion, restriction, portability and objection), and to meet its security, breach-notification, data protection impact assessment and consultation duties. If a data subject contacts Ambezi directly, Ambezi will promptly pass the request to the Institution.

C. Sub-processors

5.The Institution gives general authorisation for Ambezi to use the sub-processors listed in the Privacy Policy. Ambezi will give the Institution at least 30 days' notice by email before adding or replacing a sub-processor that will handle Institution data. The Institution may object on reasonable data protection grounds within that period, and the parties will work in good faith to resolve it. If they cannot, the Institution may terminate the affected Subscription without penalty and receive a pro-rata refund of prepaid fees. Ambezi will bind each sub-processor to obligations equivalent to this Schedule and stays responsible to the Institution for their performance.

D. Transfers outside Nigeria

6.The Institution acknowledges that the sub-processors may process data outside Nigeria. Ambezi will make such transfers only where sections 41 to 43 of the NDPA are satisfied, including under written agreements with appropriate safeguards, and will tell the Institution on request how a transfer is protected.

E. Personal data breaches

7.Ambezi will notify the Institution's administrator by email without undue delay and in any event within 72 hours of becoming aware of a personal data breach affecting Institution data. The notice will describe the nature of the breach, the categories and approximate numbers of people and records affected, the likely consequences, and the measures taken or proposed. Ambezi will keep the Institution updated and help it notify the NDPC (within 72 hours of the Institution becoming aware) and affected individuals.

F. Return and deletion

8.On termination, the Institution has 90 days to export its data. After that, Ambezi will delete the personal data (and existing copies, other than backups that are overwritten on a rolling cycle) unless the Institution instructs otherwise in writing or the law requires it to be kept. Uploaded images are deleted automatically one year after upload.

G. Audit

9.Ambezi will give the Institution the information reasonably needed to show compliance with this Schedule and will allow and contribute to audits, including inspections, by the Institution or an auditor it appoints, on reasonable notice, during business hours, no more than once a year (unless a breach or a regulator requires otherwise), under confidentiality, and at the Institution's cost.

H. The Institution's obligations as controller

10.The Institution is responsible for the lawfulness of the processing it instructs, including providing privacy notices to students and staff, identifying a lawful basis, obtaining consent where needed (including explicit consent where required, and parent or guardian consent for students under 18), registering with the NDPC and carrying out any data protection impact assessment where the law requires it, and responding to its data subjects.