Privacy Policy

We collect personal data only when you voluntarily provide it through our website forms or communications. The categories of data we may collect include:

• Identity & contact data: full name, email address, phone number, WhatsApp number, country, and state of origin.
• Educational & demographic data: date of birth, gender, education level, institution attended, course of study, and occupation — collected as part of scholarship and volunteer applications.
• Financial need information: descriptions of financial circumstances provided in scholarship application forms.
• Communications data: messages, inquiries, and feedback submitted via our contact form or email.
• Newsletter & subscription data: email address when you subscribe to our updates.
• Technical data: IP address, browser type, device type, referring URL, and pages visited — collected automatically via Vercel Analytics for aggregate, anonymised site performance monitoring.

We do not collect payment card details directly. Any donation transactions are processed through secure third-party payment providers.

We use your personal data for the following purposes:

• Processing and reviewing scholarship applications.
• Registering and managing volunteer sign-ups.
• Responding to contact form enquiries and general communications.
• Processing partnership requests from organisations.
• Sending newsletters and programme updates (only to subscribers who have opted in).
• Improving our website experience using anonymised analytics data.
• Maintaining our records for legal and compliance purposes.

We will not use your data for automated decision-making or profiling without your explicit consent.

We process your personal data under the following lawful bases:

• Consent: when you subscribe to our newsletter or submit a form.
• Contractual necessity: when processing your scholarship or volunteer application.
• Legitimate interests: to operate and improve our website, prevent fraud, and maintain organisational records.
• Legal obligation: where required by Nigerian law or regulatory authorities.

We do not sell, rent, or trade your personal data. We may share data with trusted service providers who assist in operating our platform, strictly on a need-to-know basis:

• Supabase: our cloud database provider, used to store form submissions and application data securely.
• Clerk: our authentication provider, used for admin and registered user accounts.
• Vercel: our hosting provider, which processes anonymised analytics.
• Payment processors: for donation transactions (where applicable).

All third-party providers are contractually bound to use your data only for the purpose of providing their service to us and to maintain appropriate security standards.

We may disclose personal data to law enforcement or government agencies if required by a valid court order or Nigerian law.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Application data (scholarship, volunteer): retained for up to 5 years after the application is closed or concluded.
• Contact messages: retained for up to 2 years.
• Newsletter subscriptions: retained until you unsubscribe.
• Analytics data: anonymised and retained as aggregated statistics with no individual identifiers.

Upon expiry of the retention period, data is securely deleted or anonymised.

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. These include:

• Encrypted connections (HTTPS/TLS) on all website pages.
• Row-level security (RLS) policies on our Supabase database to restrict data access.
• Admin access protected by multi-factor authentication via Clerk.
• Strict security response headers (X-Frame-Options, Content-Type-Options, XSS-Protection).
• Service role keys stored as server-side environment variables, never exposed publicly.

While we take every precaution, no method of internet transmission is 100% secure. In the event of a data breach that affects your rights and freedoms, we will notify you in accordance with the NDPR.

Under the NDPR and applicable data protection law, you have the right to:

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct any inaccurate or incomplete data.
• Erasure: request deletion of your personal data, subject to our legal retention obligations.
• Restriction: ask us to limit how we use your data in certain circumstances.
• Objection: object to our processing of your data where we rely on legitimate interests.
• Withdrawal of consent: unsubscribe from our newsletter at any time or withdraw any consent you have given.
• Data portability: receive your data in a structured, commonly used, machine-readable format.

To exercise any of these rights, please email us at info@oshiobugiefoundation.org. We will respond within 30 days.

Our website does not use tracking or advertising cookies. Vercel Analytics collects anonymised, aggregate usage statistics without placing cookies or tracking individuals across sites. We may use essential session cookies for authentication purposes when you log into our admin or member portal.

Our programmes serve young people, including minors. For applicants under the age of 18, we require the consent of a parent or guardian. We do not knowingly collect personal data from children under 13 without verifiable parental consent. If you believe we have inadvertently collected such data, please contact us immediately.

We may update this Privacy Policy from time to time. Any changes will be published on this page with an updated effective date. We encourage you to review this page periodically. Continued use of our website after changes are posted constitutes acceptance of the revised policy.

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact our Data Protection Officer: