Privacy Notice
This notice explains how Bauchi Grassroots Connect handles personal and sensitive personal data under the Nigeria Data Protection Act 2023 and the NDPC General Application and Implementation Directive 2025.
Who controls your data
Bauchi Grassroots Connect is the data controller. The Data Protection Officer can be contacted at privacy@bauchisaa.org.ng.
Information we collect
Membership details, contact and location information, date of birth, photograph, NIN verification evidence, voter-card status and optional encrypted VIN, referral activity, optional banking information, consent records, donation records, administrator activity and technical security logs.
Why and lawful bases
We process data to create and secure membership records, verify identity, issue Virtual IDs, support voter-registration sensitisation, administer referrals, communicate where separately authorised, comply with electoral and financial obligations, prevent fraud and protect the platform. Bases include consent, explicit consent for sensitive processing, legitimate interests and legal obligations.
Processors and transfers
Cloudflare supports hosting and security; Dojah performs NIN verification; Paystack processes donations; Resend provides operational email. Where processing occurs outside Nigeria, Bauchi Grassroots Connect will use an adequacy basis or contractual and organisational safeguards and maintain a transfer assessment.
Retention
Records are retained only for their stated purpose and applicable legal periods. Failed payment attempts are normally removed or anonymised after 90 days; expired sessions after 30 days; membership data is reviewed after the campaign and normally removed or anonymised within 24 months unless law, a legal hold or the member’s continuing relationship requires otherwise.
Your rights
You may request access, correction, deletion where applicable, restriction, objection, portability, withdrawal of optional consent, information about sharing, or human review. You may also complain to the Nigeria Data Protection Commission.
Security and incidents
We use access controls, protected administrator sessions, audit logs, encryption, identity-number masking, minimisation, backups and incident-response procedures. No system is completely risk-free; report suspected misuse immediately to the DPO.
Automated decisions
Referral rankings are calculated from verified registrations. They do not determine legal rights or eligibility for public services. Material adverse decisions require human review.