Privacy Policy

1. Who We Are

ONE EKITI ("we", "us") operates a community engagement platform for the people of Ekiti State, Nigeria. We are the Data Controller for personal data collected through this Platform. For data-related enquiries, contact our Data Protection Officer at info@oneekiti.ng.

2. Data We Collect

2.1 Information you provide directly

• Account data: Full name, email address, phone number, password (hashed), LGA, role.
• Profile data: Profile photo, bio, social links (optional).
• Marketplace listings: Business name, item descriptions, price, photos, contact details you choose to display.
• Event submissions: Event title, description, venue, organiser name, email, and phone.
• Nominations: Nominee details and supporting information you submit.
• Contact messages: Name, email, and message content when you use our contact form.

2.2 Information collected automatically

• Usage data: Pages visited, features used, time on site.
• Device & connection data: IP address, browser type, operating system, referring URL.
• Cookies and session data: We use strictly necessary session cookies to keep you logged in and protect against CSRF attacks. We do not use advertising cookies.

2.3 Payment data

Payment card details are processed exclusively by Paystack and are never stored on our servers. We receive only a payment reference and confirmation status from Paystack after a successful transaction.

3. How We Use Your Data

• To create and manage your account;
• To facilitate marketplace listings, event registrations, and voting;
• To process payments via Paystack;
• To send transactional emails (registration, payment receipts, event updates);
• To send platform announcements (you may unsubscribe from non-essential communications);
• To detect and prevent fraud, abuse, and violations of our Terms of Service;
• To improve the Platform based on aggregated, anonymised usage analytics;
• To comply with Nigerian legal and regulatory obligations.

4. Legal Basis for Processing (NDPR)

We process your personal data on the following legal bases under the NDPR:

• Contract performance: Processing necessary to provide you the services you signed up for.
• Legitimate interests: Security monitoring, fraud prevention, platform improvement.
• Consent: Where we send optional marketing communications.
• Legal obligation: Where required by Nigerian law.

5. Data Sharing

We do not sell your personal data. We share data only in the following limited circumstances:

• Paystack: Name, email, and phone are shared to initialise payment transactions. Paystack's Privacy Policy governs their use of this data.
• Email service provider: Your email address is shared with our transactional email provider solely to deliver messages from us to you.
• Law enforcement: If required by a valid Nigerian court order or lawful request from a government authority.
• Business transfer: In the event of a merger or acquisition, data may be transferred to a successor entity under the same privacy protections.

6. Data Retention

• Active account data is retained for as long as your account exists.
• Upon account deletion, personal data is removed within 30 days, except where retention is required by law (e.g., financial transaction records — retained for 7 years per Nigerian tax law).
• Audit logs (IP, action, timestamp) are retained for 12 months for security purposes.

7. Your Rights (NDPR)

Under the Nigeria Data Protection Regulation, you have the right to:

• Access a copy of the personal data we hold about you;
• Rectification of inaccurate or incomplete data;
• Erasure ("right to be forgotten") where no overriding legal basis exists;
• Restriction of processing in certain circumstances;
• Data portability — receive your data in a commonly used format;
• Object to processing based on legitimate interests;
• Withdraw consent for any consent-based processing at any time.

To exercise any of these rights, email info@oneekiti.ng. We will respond within 30 days.

8. Cookies

We use only strictly necessary cookies:

• Session cookie: Keeps you logged in during your visit. Expires when you close your browser (or after 2 hours of inactivity).
• CSRF token cookie: Protects form submissions from cross-site request forgery attacks.

No advertising, analytics tracking, or third-party cookies are set on this Platform.

9. Security

We implement appropriate technical and organisational measures to protect your data, including:

• Passwords are stored using bcrypt hashing — never in plain text;
• HTTPS encryption for all data in transit;
• CSRF protection on all state-changing requests;
• Rate limiting on login and payment endpoints;
• Access controls ensuring only authorised staff can view sensitive data.

No method of transmission or storage is 100% secure. If you discover a security vulnerability, please report it responsibly to info@oneekiti.ng.

10. Children

The Platform is not directed at children under 18. If we become aware that we have collected personal data from a minor without parental consent, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you of material changes via email or an in-platform notice at least 14 days before they take effect.

12. Contact & Complaints

For privacy enquiries or to lodge a complaint:

• Email: info@oneekiti.ng
• Phone: +234 810 325 7168

You also have the right to lodge a complaint with the National Information Technology Development Agency (NITDA), which is the supervisory authority for NDPR compliance in Nigeria.