Privacy notice
How AN-NUSRAH collects, uses, protects and retains personal information, and how you can exercise your rights under the Nigeria Data Protection Act 2023.
هذا المحتوى غير متوفر بلغتك بعد، ويُعرض باللغة الإنجليزية.
Version privacy-v1
Who we are
AN-NUSRAH HUMAN RIGHTS AND ADVOCACY FOUNDATION is a non-profit organisation that provides legal aid, rights education and humanitarian support. We are the controller of the personal information described in this notice.
What we collect
We collect only what a service needs: your name and contact details; information about a legal matter or an assistance request; membership, volunteer or event records; and payment records. Sensitive narratives are stored encrypted and are read only by authorised staff who need them for the service you requested.
Why we use it
We use personal information to assess and deliver legal aid and assistance, manage membership and volunteers, run events and training, issue receipts and certificates, meet legal and safeguarding duties, and produce statistics that do not identify individuals. Where consent is the basis, we record the version of the notice you agreed to. Where the law requires us to keep a record, we rely on that legal obligation.
Who can see it
Access is limited by role. Staff actions are audited. We share information with a lawyer, volunteer, partner or funder only where that person must see it to deliver the service, and under confidentiality and data-protection obligations.
How we protect it
We use access controls, two-factor authentication for staff, field-level encryption for sensitive records, audit logs, encrypted backups and tested recovery procedures. We do not ask for a password, PIN, card number or one-time code by email, SMS or social media.
How long we keep it
We keep records only as long as the applicable retention rule requires, then review, archive, anonymise or delete them. Retention rules are reviewed by the compliance lead.
Your rights
You may ask for a copy of your information, ask us to correct it, object to certain uses, withdraw consent, or ask for erasure where the law allows. We respond within the period required by the Nigeria Data Protection Act 2023. Some records must be kept for legal or safeguarding reasons even after a request.
Children and vulnerable people
Where a person cannot give informed consent, we record the consent of a parent, guardian or trusted adult and follow our safeguarding procedure before sharing the file beyond the team delivering the service.
Complaints and contact
Use the contact page to reach the office, or ask for the data protection contact. If you are not satisfied with our response, you may complain to the Nigeria Data Protection Commission. A personal data breach that is reportable is recorded in our breach register and notified as the law requires.
Changes
We publish a new version when this notice changes and record its effective date. The version you agreed to remains on your record.
Read our safeguarding commitments.