Overview
Esuku Development Foundation ("EDF", "we", "us") is committed to protecting the privacy of people who interact with our website, programmes, donors and partners. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and the rights of data subjects under applicable Nigerian law including the Nigeria Data Protection Act (NDPA, 2023) and the Nigeria Data Protection Regulation (NDPR).
What personal data we collect
- Identity data: names, titles, date of birth (where necessary for programmes).
- Contact data: email addresses, phone numbers, postal addresses.
- Transactional data: donation records, payment references (processed through third-party payment providers).
- Programme data: education/support beneficiary records, consent forms, case notes (where relevant and lawful).
- Technical data: IP address, device and browser information, cookies and analytics data.
- Media: photos, images and videos submitted by beneficiaries, partners or taken at events (we obtain consent where applicable).
How we collect personal data
We collect data directly from individuals (contact forms, registration forms, donation pages, event sign-ups), from programme partners and third-party service providers (payment processors, analytics providers), and from public sources where lawful (e.g., public registers). We also collect technical information automatically when you visit our website via cookies and server logs.
Why we process personal data (legal bases)
We process personal data for the following lawful purposes:
- Contractual/Service provision: to provide programmes, process donations, issue receipts and fulfil agreements with partners.
- Legal compliance: to comply with statutory obligations (e.g., CAC, SCUML, tax and audit requirements).
- Legitimate interests: to manage our operations, prevent fraud, improve our services and carry out research and evaluation, balanced against individuals' rights.
- Consent: where we ask for explicit consent (e.g., use of photographs, marketing communications), data will be processed only with consent and individuals can withdraw consent at any time.
How we use and share personal data
- To manage donations and financial records (we use reputable third-party payment processors; sensitive payment details are handled by those providers and not stored on our servers).
- To administer programmes, beneficiary records and monitoring and evaluation.
- To send communications, newsletters and updates where consented or where we have a legitimate interest.
- To comply with lawful requests by regulators (e.g., SCUML), law enforcement, or courts.
- We may share limited data with service providers (payment processors, cloud hosting, analytics) under data processing agreements that require appropriate safeguards.
Cookies, analytics and tracking
Our website uses cookies and similar technologies to provide basic functionality, remember preferences, and collect analytics about site use. You can manage cookie preferences through your browser settings. We use analytics providers (e.g., Google Analytics) under anonymised or pseudonymised settings where possible; check the cookie policy for details.
Data security
We implement appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, disclosure, alteration or destruction. Access to sensitive data is limited to authorised staff. Where we use third-party processors, we place contractual safeguards to ensure data is protected to at least an equivalent standard.
Data retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected (including any legal, accounting or reporting requirements). Retention periods vary by record type; for example, financial/donation records are retained in line with statutory requirements for financial reporting and audits.
International transfers
To operate effectively we may transfer personal data to third parties in other countries. Where transfers occur outside Nigeria we ensure adequate protections (contracts, transfer mechanisms) are in place in accordance with applicable law.
Children and vulnerable persons
Where we collect personal data relating to children or vulnerable beneficiaries, we obtain parental or guardian consent as required and apply additional safeguarding safeguards. See our Safeguarding Policy for details.
Data subject rights
Individuals have rights to:
- Access personal data we hold about them;
- Request correction or erasure of inaccurate or unnecessary data;
- Object to or restrict processing in certain circumstances;
- Request data portability where applicable;
- Withdraw consent where we rely on consent for processing.
Data breaches and notifications
In the event of a personal data breach we will promptly assess the risk and, where required by law, notify the relevant regulator (e.g., NITDA) and affected individuals in line with statutory requirements.
Changes to this policy
We may update this Privacy Policy from time to time. We will publish the revised policy on our website with an updated effective date and, where appropriate, notify data subjects of material changes.
Notes & legal references
This policy should be read alongside Esuku Development Foundation's Data Protection Policy, Safeguarding Policy, and AML/SCUML compliance frameworks. References: Nigeria Data Protection Act (2023), NDPR, Companies and Allied Matters Act (2020), SCUML regulations.