Legal
Privacy policy
What we collect, why, how long we keep it, and what you can ask us to do about it.
This page is a draft.
It sets out the structure and the obligations that apply. The marked gaps must be filled, and this text reviewed by a lawyer, before the site takes a single payment or publishes anything binding.
Last reviewed: [TODO: date this policy was last reviewed]
Who we are
Assoutudeen Prophetic Medicine Foundation, Assoutudeen Street, Zone 5, Fiwasaye Community, Ede, Osun State, Nigeria. Registered with the Corporate Affairs Commission as Incorporated Trustees under [TODO: CAC registration number]. You can reach us at [email protected] or on 0816 188 2470.
Our data protection contact is [TODO: named person responsible for data protection, with a direct email]. Whether we are required to register as a data controller of major importance with the Nigeria Data Protection Commission, and whether we must appoint a Data Protection Officer, depends on the volume of data we process: [TODO: confirm current NDPC thresholds and whether APMF meets them].
What we collect
- When you contact us — your name, email, phone number if you give one, and what you write to us.
- When you subscribe to email — your email address, your name if you give one, and a record of when you consented.
- When you donate — your name, email and the amount. Card details go directly to Paystack and never reach our servers; we never see or store them.
- When you ask for assistance — the details of your situation, which may include health information about you or your family, and any documents you upload. This is sensitive personal data and we treat it as such.
- When you buy honey or a book — your delivery address and phone number.
Why we may use it, and on what basis
[TODO: legal basis table — consent, contract, legitimate interest or legal obligation, set against each category above. Confirm with a lawyer]
We ask for consent with an unticked box, every time. We never pre-tick a consent checkbox, and declining does not stop you from using the site.
Publishing your story
Applying for assistance is not permission to be written about. We report our impact by category — “four children in secondary school”, “a revert sister” — and we will not publish your name, your photograph or your story unless you have given separate, explicit, written consent for that specifically. We keep a record of that consent, and you can withdraw it.
Who we share it with
Only the services that make the site work: [TODO: confirm the final list] — currently our hosting provider (Vercel), our database provider (Neon), our media host (Cloudinary), our payment processor (Paystack), and our email provider (Resend). We do not sell personal data, and we do not share it with anyone else unless the law requires it.
[TODO: data processing agreements signed with each processor]
How long we keep it
[TODO: retention periods for each category — contact messages, subscribers, donation records, assistance applications, consent records]
How we protect it
The site is served over HTTPS. The database is encrypted at rest, access to the admin panel is restricted by role, and staff accounts only see what their role requires — editors, for example, cannot see donation or order records at all.
[TODO: backup schedule and data breach response plan]
Your rights
Under the Nigeria Data Protection Act 2023 you can ask us for a copy of your data, ask us to correct it, ask us to delete it, object to how we are using it, or withdraw consent you have given. Write to [email protected] and we will respond within [TODO: response window — 30 days is the usual commitment]. If you are not satisfied, you can complain to the Nigeria Data Protection Commission.
Cookies
[TODO: confirm whether analytics will be used. If yes, a cookie banner with a genuine decline option is required before it loads]