This Data Protection and Privacy Policy ("the Policy") is issued by Omo Offa Ni Mi Development Union, a registered non-profit and welfare-focused organisation committed to protecting the personal data of its stakeholders. The purpose of this Policy is to establish a clear and consistent framework for the lawful collection, processing, storage, use, and disclosure of personal data in line with applicable data protection laws in Nigeria.
Omo Offa Ni Mi Development Union is dedicated to ensuring the confidentiality, integrity, and availability of personal data entrusted to it by its beneficiaries, donors, employees, partners, and other stakeholders. This Policy outlines the organisation’s obligations, practices, and protocols for managing personal data in a transparent, accountable, and secure manner, thereby reinforcing trust and promoting compliance with data privacy laws.
This Policy applies to all personal data collected, received, stored, processed, or otherwise handled by Omo Offa Ni Mi Development Union in the course of its operations. It applies to:
This Policy applies across all locations and operational environments where Omo Offa Ni Mi Development Union collects or processes personal data, whether manually or electronically.
This Policy is developed in compliance with the Nigeria Data Protection Act, 2023 (NDPA), which governs the processing of personal data in Nigeria and establishes the Nigeria Data Protection Commission (NDPC) as the principal regulatory authority for data protection compliance. In addition to the NDPA, this Policy aligns with:
Omo Offa Ni Mi Development Union acknowledges its statutory duties under the NDPA and commits to upholding data subject rights and implementing appropriate technical and organisational safeguards.
For the purpose of the NDPA and this Policy, Omo Offa Ni Mi Development Union is the Data Controller, responsible for determining the purposes and means of processing personal data.
Data subjects and stakeholders may contact the Data Protection Officer (DPO) for inquiries, complaints, or requests relating to the processing of their personal data or the enforcement of their data protection rights.
For the purpose of this Data Protection and Privacy Policy, the following terms shall have the meanings assigned to them under the Nigeria Data Protection Act, 2023, unless the context otherwise requires:
“Personal Data” means any information relating to an identified or identifiable natural person (“Data Subject”); an identifiable person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.
“Sensitive Personal Data” refers to personal data that reveals or concerns the racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a person’s sex life or sexual orientation. Under this Policy, this also includes financial records and other data designated as sensitive under applicable law.
“Data Subject” means any natural person whose personal data is collected, held, or processed by Omo Offa Ni Mi Development Union. This includes registered beneficiaries, donors, staff, volunteers, and any other individuals whose data is obtained in the course of Omo Offa Ni Mi Development Union’s operations.
“Data Controller” means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. For the purpose of this Policy, Omo Offa Ni Mi Development Union acts as the Data Controller.
“Data Processor” means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the Data Controller. This includes Omo Offa Ni Mi Development Union’s vendors, consultants, and third-party service providers engaged to support data processing activities.
“Third Party” refers to any person or organisation other than the data subject, the data controller, or persons who, under the direct authority of the controller or processor, are authorised to process personal data. Third parties may include regulators, auditors, and system service providers.
“Consent” means any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which they, by a statement or by clear affirmative action, signify agreement to the processing of personal data relating to them. Consent must be documented and is revocable at any time.
“Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means. This includes collection, recording, organisation, structuring, storage, adaptation, retrieval, use, disclosure, dissemination, erasure, or destruction.
The “NDPC” is the regulatory authority established under the Nigeria Data Protection Act, 2023, empowered to oversee and enforce compliance with data protection laws in Nigeria.
Omo Offa Ni Mi Development Union shall ensure that all personal data processing activities are based on at least one lawful basis as stipulated under Section 25 of the Nigeria Data Protection Act, 2023. The lawful bases on which Omo Offa Ni Mi Development Union relies include the following:
Omo Offa Ni Mi Development Union processes personal data with the prior, informed, and unambiguous consent of the data subject, particularly in relation to marketing communications, special category data (e.g., religion or health), and where no other legal basis applies.
Where the processing of personal data is necessary for the execution or performance of a contract to which the data subject is a party—such as the provision of aid, delivery of welfare services, or volunteer arrangements—Omo Offa Ni Mi Development Union may lawfully rely on this basis.
Omo Offa Ni Mi Development Union may process personal data where such processing is required for compliance with applicable legal or regulatory obligations, including financial reporting, government disclosures, or lawful directives from authorities.
Processing may occur where necessary to protect the vital interests of the data subject or another person—such as in emergency health interventions or life-saving humanitarian relief.
Omo Offa Ni Mi Development Union may process data where such activity is necessary for the performance of a task carried out in the public interest or in the exercise of official authority, particularly in furtherance of public welfare objectives and poverty alleviation programmes.
Omo Offa Ni Mi Development Union may also process personal data based on its legitimate interests, provided such interests are not overridden by the rights and freedoms of the data subject. This includes internal governance, fraud prevention, system security, and stakeholder engagement.
In the course of its operations, Omo Offa Ni Mi Development Union collects and processes the following categories of personal data from beneficiaries, donors, volunteers, employees, and other stakeholders:
This includes information that directly identifies an individual, such as full name, date of birth, gender, national identification number (NIN), passport number, voter’s card, or any other government-issued means of identification.
This comprises personal contact information, such as residential address, email address, phone number(s), and next-of-kin details.
This includes bank account details, donation records, payment history, and other financial information relevant to fund disbursement or receipts.
Omo Offa Ni Mi Development Union may collect technical data generated through the use of its digital platforms, such as IP address, device type, browser version, and device identifiers for security and analytics purposes.
This refers to data relating to how individuals interact with Omo Offa Ni Mi Development Union’s services or platforms, including service access logs, interaction timestamps, frequency of visits, and preferences.
In limited circumstances and in accordance with Section 34 of the Nigeria Data Protection Act, 2023, Omo Offa Ni Mi Development Union may collect special categories of personal data, such as:
Sensitive personal data shall only be collected with the explicit consent of the data subject or as otherwise permitted by applicable law.
Omo Offa Ni Mi Development Union shall collect and process personal data solely for specific, explicit, and legitimate purposes as permitted under the Nigeria Data Protection Act, 2023. The purposes for which personal data may be processed include, but are not limited to, the following:
Personal data is processed to enable Omo Offa Ni Mi Development Union to identify eligible beneficiaries, register participants, distribute welfare packages, and facilitate access to the organisation’s products, programmes, and community services.
Data is collected and processed to manage interactions with registered beneficiaries, donors, volunteers, and partner agencies. This includes maintaining contact information, responding to enquiries, processing requests, and improving service delivery.
Omo Offa Ni Mi Development Union may process personal data as necessary to comply with applicable laws, regulatory directives, government reporting requirements, tax obligations, audit demands, or lawful requests by public authorities or regulatory bodies.
With the prior, informed, and freely given consent of the data subject, personal data may be used to send relevant communications regarding Omo Offa Ni Mi Development Union’s services, events, newsletters, donation campaigns, and community initiatives. Data subjects may withdraw consent to receive marketing communications at any time.
Omo Offa Ni Mi Development Union processes personal data to detect, prevent, and respond to fraud, abuse, data breaches, and other unlawful or suspicious activity. Processing is also done to maintain the security and integrity of its platforms, facilities, and digital infrastructure.
Omo Offa Ni Mi Development Union shall ensure that the collection and processing of personal data is preceded by the free, specific, informed, and unambiguous expression of will by the data subject, signifying agreement to the processing of their personal data for one or more specific purposes. Consent shall be:
In accordance with Section 30(3) of the Nigeria Data Protection Act, 2023, data subjects shall retain the right to withdraw their consent at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal. Omo Offa Ni Mi Development Union shall:
Omo Offa Ni Mi Development Union shall maintain verifiable records of consent in compliance with the accountability obligations under the Nigeria Data Protection Act, 2023. To that end:
Omo Offa Ni Mi Development Union retains personal data only for as long as is reasonably necessary to fulfil the lawful purposes for which the data was collected, including for the provision of welfare services, compliance with legal obligations, resolution of disputes, and enforcement of agreements. The duration of retention shall be determined based on the category of data, applicable statutory or regulatory requirements, donor contractual obligations, and the legitimate interests of data subjects and Omo Offa Ni Mi Development Union.
Omo Offa Ni Mi Development Union shall apply specific retention schedules to various categories of personal data processed in its operations, as follows:
Retention periods may be extended where required by law or justified by overriding legitimate interests.
Upon expiry of the applicable retention period, personal data shall either be archived securely or permanently disposed of, in a manner that ensures that the data is irretrievable and non-reconstructable. Archiving shall be performed using encrypted storage solutions accessible only by authorised personnel. Disposal shall be carried out using certified secure deletion software (for electronic records) or by cross-cut shredding and certified incineration (for hard copies). Any third-party engaged in data disposal shall be contractually bound by confidentiality and security obligations.
Omo Offa Ni Mi Development Union shall incorporate automated tools and periodic manual reviews to flag and delete data that is no longer required, subject to approval by the Data Protection Officer (DPO). All deletions shall be documented in a disposal log containing the date, method, categories of data, and the name of the officer responsible. Data subjects may also request the erasure of their personal data under applicable rights, and such requests shall trigger a retention review in accordance with the provisions of Clause 14 of this Policy.
Omo Offa Ni Mi Development Union shall ensure that all data subjects are provided with clear, concise, and accessible information about the collection, use, processing, storage, and potential disclosure of their personal data. This right shall be fulfilled through privacy notices, consent forms, and other public disclosures in accordance with Section 26 of the NDPA. Data subjects shall be informed prior to or at the point of data collection of the identity of the data controller, the purpose of processing, the legal basis, and their rights.
In accordance with Section 27 of the NDPA, every data subject shall have the right to request confirmation of whether their personal data is being processed by Omo Offa Ni Mi Development Union and to obtain a copy of such data. Upon receiving a valid access request, Omo Offa Ni Mi Development Union shall respond within 30 days by providing relevant information, including the categories of personal data processed, recipients (if any), retention period, and safeguards for international transfers. Requests may be made electronically, in writing, or by any verifiable means.
Subject to Section 33 of the NDPA, data subjects shall have the right to receive their personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller without hindrance. Where technically feasible, data subjects may request the direct transmission of their personal data to another entity. This right shall apply only where processing is based on consent or contract and carried out by automated means.
Omo Offa Ni Mi Development Union shall not subject data subjects to decisions based solely on automated processing, including profiling, which produce legal or similarly significant effects on the data subject, unless such decision:
In such cases, Omo Offa Ni Mi Development Union shall implement suitable safeguards, including the right to human intervention and contestation of the decision.
Data subjects may exercise any of the rights listed in this clause by submitting a written or electronic request to Omo Offa Ni Mi Development Union’s Data Protection Officer (DPO) at the contact details provided in this Policy. Omo Offa Ni Mi Development Union shall acknowledge all requests within five (5) working days and provide a substantive response within thirty (30) days, subject to any lawful extensions or exemptions under the NDPA. Identity verification may be required prior to acting on the request to prevent unauthorised disclosures.
Notwithstanding the rights outlined above, Omo Offa Ni Mi Development Union may deny, delay, or restrict the exercise of a data subject’s rights where such restriction is necessary and proportionate to safeguard public interest, protect legal obligations, preserve the rights of third parties, or enforce contractual or statutory claims. All such denials shall be communicated in writing with appropriate justifications.
Omo Offa Ni Mi Development Union shall not transfer personal data of data subjects to a foreign country or international organisation unless such transfer is in full compliance with Part VI of the Nigerian Data Protection Act, 2023. Cross-border transfers shall be permitted only where:
Where personal data is to be transferred to a jurisdiction outside Nigeria, Omo Offa Ni Mi Development Union shall ensure that the recipient country or organisation provides an adequate level of data protection as recognised by the NDPC. In the absence of such adequacy determination, Omo Offa Ni Mi Development Union shall rely on appropriate safeguards such as:
Omo Offa Ni Mi Development Union shall maintain a written record of all cross-border data transfers, including the recipient country, legal basis for the transfer, nature of personal data transferred, and details of applicable safeguards. These records shall be made available to the NDPC upon lawful request. Data subjects shall also be informed, where applicable, of the fact of international data transfer and their rights in connection thereto.
As of the date of this Policy, Omo Offa Ni Mi Development Union does not routinely transfer personal data to jurisdictions outside Nigeria. However, should such transfers become necessary—for instance, for the operation of cloud services or international donor compliance—transfers may be made to the following countries subject to NDPC-approved safeguards: [Insert list, e.g., United Kingdom, Ireland, Germany, Canada]. This list shall be reviewed periodically and updated in accordance with NDPC adequacy determinations or organisational requirements.
Omo Offa Ni Mi Development Union may disclose personal data of registered beneficiaries or service users to select third parties strictly for lawful and defined purposes that align with the objectives of this Policy and the NDPA. Categories of potential recipients may include:
Prior to engaging any third-party processor or recipient, Omo Offa Ni Mi Development Union shall conduct thorough due diligence to evaluate the third party’s data protection controls, organisational structure, legal compliance record, and risk posture. The outcome of such due diligence shall inform the terms of engagement and frequency of compliance monitoring thereafter.
Where any third party processes personal data on behalf of Omo Offa Ni Mi Development Union, such processing shall be governed by a Data Processing Agreement (DPA) that complies with the NDPA. The DPA shall clearly stipulate the subject matter, duration, nature and purpose of processing, types of personal data, obligations and rights of the parties, and security measures to be implemented by the processor.
Omo Offa Ni Mi Development Union shall retain overall responsibility for the protection of personal data shared with or processed by third parties. Third-party processors shall be contractually bound to notify Omo Offa Ni Mi Development Union of any data breach, cooperate with regulatory investigations, and refrain from engaging sub-processors without prior written consent. Breach of data protection obligations by a third party may result in contractual penalties, termination of engagement, or regulatory referral.
Omo Offa Ni Mi Development Union shall implement appropriate technical and organisational measures (“TOMs”) to ensure the security, integrity, and confidentiality of personal data under its control or possession. These measures are designed to protect personal data against unauthorised access, unlawful processing, accidental loss, destruction, or damage, and to uphold the rights of data subjects in accordance with the NDPA. Such TOMs shall be commensurate with the nature, scope, context, and purpose of the processing activities and the risk to the rights and freedoms of data subjects.
Omo Offa Ni Mi Development Union shall apply layered data protection protocols including, but not limited to:
All employees, volunteers, consultants, and service providers engaged by Omo Offa Ni Mi Development Union in the processing of personal data shall execute binding confidentiality and data protection agreements. Further, Omo Offa Ni Mi Development Union shall ensure that its staff and partners receive adequate and continuous training on data protection principles, secure data handling practices, breach response procedures, and ethical obligations under the NDPA. Breach of these confidentiality obligations shall result in disciplinary action, including possible termination of engagement.
Omo Offa Ni Mi Development Union shall establish systems for the ongoing monitoring, evaluation, and periodic testing of its security controls to identify vulnerabilities and respond to emerging threats. Reviews shall be conducted annually or upon a significant change in processing operations or technology infrastructure. Any identified gaps shall be promptly addressed through corrective and preventive measures. The effectiveness of implemented TOMs shall be documented and made available to the Nigeria Data Protection Commission (NDPC) upon legitimate request.
In accordance with Section 32 of the Nigerian Data Protection Act, 2023, Omo Offa Ni Mi Development Union has duly appointed a qualified Data Protection Officer (DPO) to oversee the organisation’s data protection framework. The appointment is a demonstration of Omo Offa Ni Mi Development Union’s commitment to ensuring robust data governance, privacy compliance, and accountability across all its data processing activities.
The DPO shall serve as the principal officer responsible for:
The DPO shall perform their duties independently and shall not be penalised or dismissed for performing functions in accordance with the NDPA. The DPO shall have unfettered access to Omo Offa Ni Mi Development Union’s senior management and to all relevant information necessary to carry out their duties effectively. Where required, the DPO may recommend improvements to internal data protection measures and escalate unresolved compliance matters to the board or trustees.
Data subjects and third parties may contact the DPO regarding any matter arising under this Policy or the NDPA through the following means:
Omo Offa Ni Mi Development Union shall maintain a transparent and accessible internal complaint resolution mechanism through which data subjects may lodge complaints about perceived violations of their data protection rights. Upon receipt of such complaint, the DPO shall acknowledge within five (5) business days and resolve the issue within thirty (30) calendar days, unless an extension is justified. Complainants shall be informed of the outcome of the internal review process in writing.
Where a data subject is unsatisfied with the outcome of the internal redress process, or where Omo Offa Ni Mi Development Union fails to resolve the complaint within the stipulated period, the data subject may escalate the matter to the Nigeria Data Protection Commission (NDPC), which has the statutory mandate to investigate complaints and enforce the provisions of the NDPA.
Complaints to the NDPC may be submitted via its online portal, in writing, or by any other approved means. Data subjects are encouraged to include relevant supporting documentation and any internal correspondence when filing such complaints to facilitate efficient resolution.
The contact details of the NDPC are as follows:
Omo Offa Ni Mi Development Union shall ensure that this Data Privacy Policy is subject to periodic review, and in any event, not less than once every twelve (12) calendar months. The purpose of the review shall be to ensure continued compliance with applicable data protection laws, evolving regulatory directives, industry best practices, and the operational realities of Omo Offa Ni Mi Development Union’s service delivery.
Notwithstanding the foregoing, this Policy shall be reviewed and updated immediately where:
Each iteration of this Policy shall be clearly identified by a version number and effective date. Omo Offa Ni Mi Development Union shall maintain a comprehensive version control register that records:
Obsolete versions shall be archived but made available upon legitimate request.
Where updates to this Policy materially affect the rights or obligations of data subjects, Omo Offa Ni Mi Development Union shall implement appropriate communication measures to ensure affected persons are duly informed. Such communication may include publication on the official website, issuance of email notifications, or placement of notices on digital platforms or service points. Continued use of Omo Offa Ni Mi Development Union’s platforms or engagement with its services after such notice shall constitute deemed acceptance of the revised Policy, except where explicit consent is required by law.