Data Protection Policy

1.Purpose and scope

This policy exists to:

• protect the privacy of members of the Set, supporters, donors, event attendees and website visitors;
• ensure the Set meets its duties as a data controller under the Nigeria Data Protection Act 2023;
• set out clear rules for everyone who handles personal data on behalf of the Set.

It applies to the Executive Council, chapter coordinators, committee members and any volunteer who handles personal data for the Set, and to all systems the Set uses, including its website, membership records, giving records, WhatsApp groups and event registrations.

2.Roles and responsibilities

3.Data protection principles

The Set follows the principles of the NDPA. Every processing activity must satisfy all of them:

• Lawfulness, fairness and transparency — data is collected and used on a clear legal basis, and people are told how their data is used.
• Purpose limitation — data is used only for the purposes it was collected for, unless a new use is compatible or fresh consent is obtained.
• Data minimisation — only data that is actually needed is collected.
• Accuracy — records are kept correct and up to date, and errors are corrected promptly when reported.
• Storage limitation — data is kept no longer than the retention schedule in section 8 requires.
• Integrity and confidentiality — data is secured against loss, unauthorised access or disclosure.
• Accountability — the Set can demonstrate compliance with this policy.

4.Personal data the Set processes

The Set does not knowingly collect data from anyone under 18, does not process special-category data (health, religion, political views) except where a member volunteers it for a specific Set purpose with explicit consent, and does not use member data for advertising or sell it to anyone.

5.How data is used

• Communicating with members about meetings, events, elections and Set news;
• Organising reunions and events, including payment reconciliation;
• Acknowledging and accounting for gifts and give-back projects;
• Publishing news, stories and photographs on the website where consent has been given;
• Producing aggregate reports for the Council that do not identify individuals.

6.Sharing and third parties

Personal data is shared only where necessary and with safeguards in place:

• Service providers the Set relies on (website hosting, form and database services, email delivery), each under a duty to process data only on the Set’s instructions;
• Banks and payment channels, strictly for reconciling gifts and event payments;
• Public authorities, only where the law requires it.

Before adopting any new service that will hold member data, the Council must confirm it offers protection consistent with the NDPA. Where data is transferred outside Nigeria, the Set ensures an equivalent level of protection.

7.Security measures

• Access to membership and giving records is limited to officers who need it for their role;
• Accounts that hold member data use strong, unique passwords and, where available, two-factor authentication;
• Member spreadsheets and lists are not forwarded, reposted or left on shared public drives;
• Messages containing personal data are sent only to verified recipients;
• Devices used to handle member data are locked and kept secure.

8.Retention schedule

9.Rights of individuals

Every person whose data the Set holds has the right to:

• be informed about how their data is used;
• request a copy of the data the Set holds about them;
• ask for corrections to inaccurate data;
• ask for deletion of their data where the law allows;
• object to or restrict certain processing;
• withdraw consent at any time, for example for a photograph or a newsletter.

Requests are made to the Data Protection Contact and are answered within 30 days. No fee is charged, and no explanation is required from the requester.

10.Data breach response

If personal data is lost, exposed to the wrong people, or compromised:

• the person who discovers it reports it to the Data Protection Contact immediately;
• the Contact assesses the risk to affected individuals and contains the breach;
• where the breach is likely to cause significant harm, the Council notifies the Nigeria Data Protection Commission within 72 hours, as required by the NDPA;
• affected members are informed where the risk to them is high;
• the Council records the breach and the steps taken, and fixes the root cause.

11.Complaints and contact

Questions, requests or complaints about personal data go to the Data Protection Contact:

Data Protection Contact — Epiphany ’06 Set · email: [to be added on adoption] · phone: [to be added on adoption].

A person who is not satisfied with the Set’s response may complain to the Nigeria Data Protection Commission.

12.Review

The Executive Council reviews this policy at least once every two years, or sooner if the Set starts a new kind of processing or the law changes.