Privacy Policy

1. Who we are

C-PAID is a non-profit organisation registered in Nigeria as an incorporated trustee with the Corporate Affairs Commission under registration number [IT number]. Our office is at Okeebadan Estate, Akobo, Ibadan, Oyo State, Nigeria. For the purposes of the NDPA, C-PAID is the data controller for personal data collected through this website.

2. The information we collect

We collect only the information you choose to give us, together with limited technical information that your browser sends automatically.

• When you contact us: your name, email address, phone number (if you provide it), the subject of your enquiry and your message.
• When you enquire about partnership: your name, organisation, role, contact details and the nature of the partnership you have in mind.
• When you apply to volunteer: your name, contact details, location, skills, areas of interest, availability and anything else you choose to tell us.
• When you enquire about giving: your name, contact details and the details of the support you wish to offer.
• When you browse the site: technical data such as your IP address, browser type, device type and the pages you visit, collected through server logs and any cookies described in section 6.

We ask that you do not send us sensitive personal data, such as health information or religious beliefs, through the website forms unless we have specifically requested it.

3. How we use your information and our lawful basis

We use personal data only where the NDPA permits us to do so.

Purpose	Lawful basis
Responding to your enquiry or message	Your consent, and our legitimate interest in answering people who contact us
Assessing and managing partnership discussions	Steps taken at your request before entering an agreement, and our legitimate interests
Reviewing volunteer applications and arranging placements	Your consent, and steps taken at your request
Processing and acknowledging donations, once online giving is available	Performance of the arrangement with you, and our legal obligations
Keeping the website secure and understanding how it is used	Our legitimate interest in running a safe, effective website
Meeting legal, regulatory, tax and audit requirements	Compliance with our legal obligations

We will not use your information for marketing or send you newsletters unless you have clearly agreed to receive them. You can withdraw that agreement at any time.

4. Who we share it with

We do not sell, rent or trade personal data. We share it only where necessary, and only with:

• service providers who host our website and email, acting on our instructions and bound to keep the data confidential;
• [our payment provider], once online giving is introduced, to process donations securely;
• our professional advisers, such as auditors and lawyers, where needed;
• regulators, law enforcement or courts, where the law requires us to.

5. Transfers outside Nigeria

Some of our service providers may store data on servers outside Nigeria. Where personal data leaves Nigeria, we take the steps the NDPA requires to ensure it receives an adequate level of protection, such as contractual safeguards with the provider.

6. Cookies

Our website uses cookies that are needed for it to work properly and securely. [If analytics are used: We also use analytics cookies from [provider] to understand how visitors use the site, and we will only set them with your consent.] You can control or delete cookies through your browser settings, although some parts of the site may not work as intended if you block essential cookies.

7. How long we keep it

We keep personal data only for as long as we need it for the purpose for which it was collected.

Information	How long we keep it
General enquiries	Up to [two] years after our last contact with you
Volunteer applications not taken forward	Up to [one] year, unless you ask us to delete it sooner
Records of active volunteers and partners	For the duration of the relationship, plus [six] years
Donation and financial records	As long as Nigerian tax and accounting law requires

When data is no longer needed, we delete it securely or anonymise it.

8. How we protect it

We use appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS), access restricted to authorised personnel and secure, password-protected systems. No method of transmission over the internet is completely secure, but we work to protect your information and review our safeguards regularly. If a breach is likely to put your rights at risk, we will notify the NDPC within the time the law requires and, where necessary, inform you without undue delay.

9. Children’s information

Our website is intended for adults. We do not knowingly collect personal data from anyone under 18 through the website without the consent of a parent or legal guardian. If you believe a child has sent us information, please contact us and we will delete it. Personal data relating to children who take part in our programmes is handled separately, under our Safeguarding and Child Protection Policy and with parental or guardian consent.

10. Your rights

Under the NDPA, you have the right to:

• be informed about how your personal data is used;
• obtain a copy of the personal data we hold about you;
• ask us to correct data that is inaccurate or incomplete;
• ask us to delete your data, where there is no lawful reason for us to keep it;
• ask us to restrict or stop processing your data in certain circumstances;
• receive your data in a commonly used format and have it transferred to another organisation, where applicable;
• withdraw your consent at any time, without affecting processing already carried out;
• lodge a complaint with the Nigeria Data Protection Commission.

To exercise any of these rights, please email [data protection contact email]. We will respond within the time required by law and may ask you to confirm your identity before we act on a request.

11. Changes to this policy

We may update this policy from time to time to reflect changes in our work or in the law. The date at the top of this page shows when it was last revised.

12. Contact us

For questions about this policy or how we handle your information, please contact our [Data Protection Officer / data protection contact] at [data protection contact email], or write to C-PAID, Okeebadan Estate, Akobo, Ibadan, Oyo State, Nigeria. You can also reach us at contact@changepointinitiative.org or on 0704 474 1441, Monday to Friday, 9am to 6pm.