PRIVACY POLICY

1. Introduction

The Initiative for Aid & Educational Development ("IAED", "we", "our" or "us") is committed to protecting the privacy and personal data of individuals with whom it interacts. This Privacy Policy sets out the manner in which IAED collects, uses, stores, discloses and otherwise processes personal data through its website, programs, services and related engagements.

IAED processes personal data in accordance with the provisions of the Nigerian Data Protection Act, 2023 ("NDPA"), regulations, directives and guidance issued by the Nigeria Data Protection Commission ("NDPC"), and any other applicable laws governing the protection of personal data.

By accessing our website or otherwise providing your personal data to IAED, you acknowledge that you have read and understood this Privacy Policy.

2. About IAED

The Initiative for Aid & Educational Development (IAED) is a non-profit organisation established to advance educational development and promote equitable access to quality education for children from underserved communities.

IAED implements various educational initiatives, including the SAL Classroom Program, which provides specialised educational support to children from low-income households, including children living with disabilities and other learning needs.

3. Scope of this Privacy Policy

This Privacy Policy applies to all personal data processed by IAED in connection with:

  • Visits to our website;

  • Donations and fundraising activities;

  • Volunteer recruitment and engagement;

  • Partnerships and stakeholder engagements;

  • Educational programs and community initiatives;

  • Newsletters and other communications;

  • Any other interaction between IAED and individuals whose personal data is processed.

4. Categories of Personal Data Processed

Depending on the nature of your interaction with IAED, we may collect and process the following categories of personal data:

Personal Information Provided by You

This may include:

  • Full name;

  • Email address;

  • Telephone number;

  • Residential or correspondence address;

  • Organisation or employer details;

  • Donation information;

  • Information submitted through online forms;

  • Event registration details;

  • Volunteer applications;

  • Correspondence and enquiries.

Technical Information

When you access our website, we may automatically collect certain technical information, including:

  • Internet Protocol (IP) address;

  • Browser type and version;

  • Device information;

  • Operating system;

  • Website usage information;

  • Date and time of access;

  • Pages visited and referring websites.

Program-Related Information

Where necessary for program administration, IAED may process information relating to beneficiaries, applicants, volunteers, parents, guardians and partner organisations.

5. Methods of Collection

IAED may collect personal data directly from individuals when they:

  • Visit our website;

  • Complete online forms;

  • Contact IAED through email, telephone or other communication channels;

  • Register for programs or events;

  • Make donations;

  • Subscribe to newsletters;

  • Apply to volunteer;

  • Participate in IAED activities; or

  • Otherwise engage with IAED.

Personal data may also be collected automatically through cookies and similar technologies where applicable.

6. Purposes of Processing Personal Data

IAED processes personal data only for specified, explicit and legitimate purposes, including to:

  • Respond to enquiries and requests;

  • Administer educational programs and community initiatives;

  • Register participants for events and activities;

  • Process donations and issue acknowledgements or receipts;

  • Manage relationships with donors, volunteers, beneficiaries and partners;

  • Improve the functionality, security and performance of our website;

  • Communicate organisational news, newsletters and program updates, where consent has been obtained or another lawful basis applies;

  • Conduct monitoring, evaluation, research and program improvement activities;

  • Detect, investigate and prevent fraud or misuse of our services;

  • Comply with applicable legal, regulatory and governance obligations.

IAED shall not process personal data for purposes that are incompatible with those for which the information was originally collected unless authorised or required by law.

7. Lawful Basis for Processing

IAED processes personal data only where there is a lawful basis under the Nigerian Data Protection Act, including:

  • The consent of the data subject;

  • The performance of a contract or steps taken at the request of the data subject prior to entering into a contract;

  • Compliance with a legal obligation;

  • Protection of the vital interests of the data subject or another individual;

  • The performance of a task carried out in the public interest; or

  • IAED’s legitimate interests provided such interests are not overridden by the rights and freedoms of the data subject.

Where processing is based on consent, such consent may be withdrawn at any time without affecting the lawfulness of processing carried out prior to its withdrawal.

8. Donations and Payment Processing

Donation payments may be facilitated through authorised third-party payment service providers that maintain appropriate security and data protection standards.

IAED does not retain complete payment card details except where required by law or where strictly necessary for authorised financial administration.

9. Cookies and Similar Technologies

IAED may use cookies and similar technologies to enhance user experience, analyse website traffic, maintain website security and improve the functionality of its online services.

Where required by applicable law, users will be provided with appropriate choices regarding the use of non-essential cookies.

10. Disclosure of Personal Data

Personal data may be disclosed only where such disclosure is necessary for legitimate organisational purposes or required by law, including to:

  • Payment service providers;

  • Information technology and cloud service providers;

  • Professional advisers and consultants;

  • Auditors;

  • Regulatory authorities;

  • Law enforcement agencies;

  • Program partners operating under appropriate contractual confidentiality and data protection obligations.

IAED shall ensure that any third-party processing personal data on its behalf provides adequate safeguards for the protection of such information.

11. International Transfers of Personal Data

Where personal data is transferred outside the Federal Republic of Nigeria, IAED shall ensure that such transfers are undertaken in accordance with the requirements of the NDPA and that appropriate safeguards are implemented to protect the rights of data subjects.

12. Information Security

IAED maintains appropriate technical, organisational and administrative measures designed to safeguard personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Such measures include, where appropriate:

  • Role-based access controls;

  • Encryption and secure transmission technologies;

  • Password management and authentication controls;

  • Secure hosting environments;

  • Staff confidentiality obligations;

  • Periodic security assessments and monitoring.

Although IAED adopts reasonable safeguards, no method of electronic transmission or storage can be guaranteed to be completely secure.

13. Retention of Personal Data

Personal data shall be retained only for as long as is necessary to fulfil the purposes for which it was collected, comply with applicable legal and regulatory obligations, resolve disputes and enforce IAED's legal rights.

Upon expiry of the applicable retention period, personal data shall be securely deleted, anonymised or otherwise disposed of in accordance with IAED's records management procedures.

14. Processing of Children's Personal Data

As part of its educational and community development programs, IAED may collect and process personal data relating to children and other vulnerable individuals where such processing is necessary for the planning, administration, delivery, monitoring, safeguarding and evaluation of its programs and activities.

Where required by applicable law, IAED shall obtain the consent of a parent, legal guardian or other authorised representative before collecting or processing a child's personal data. Where processing is based on another lawful ground recognised under the NDPA, IAED shall ensure that such processing is properly documented and strictly limited to what is necessary for the relevant purpose.

Where IAED processes special categories of personal data relating to children, including information concerning disabilities, health conditions or other sensitive personal information, such processing shall only be undertaken where authorised by law and subject to enhanced technical and organisational safeguards.

Access to children's personal data shall be restricted to authorised personnel with a legitimate need to know in the performance of their official responsibilities.

15. Rights of Data Subjects

Subject to the provisions of the NDPA, data subjects may exercise the following rights:

  • The right to be informed;

  • The right of access;

  • The right to rectification;

  • The right to erasure, where applicable;

  • The right to withdraw consent;

  • The right to object to processing;

  • The right to request restriction of processing;

  • The right to data portability, where applicable;

  • The right not to be subject to a decision based solely on automated processing where such right applies; and

  • The right to lodge a complaint with the Nigeria Data Protection Commission.

IAED may, where legally permitted or required, decline or restrict a request, including where compliance with the request would prejudice a legal or regulatory obligation, the rights and freedoms of another person, the establishment or defence of legal claims, or other legitimate interests recognised by applicable law.

16. Third-Party Websites

The IAED website may contain links to websites operated by third parties. IAED neither controls nor accepts responsibility for the privacy practices, content or security of such external websites. Users are encouraged to review the privacy notices applicable to those websites before providing any personal information.

17. Amendments to this Privacy Policy

IAED reserves the right to amend or update this Privacy Policy from time to time in response to changes in applicable law, regulatory requirements or organisational practices.

Any revised version shall be published on the IAED website together with the effective date of the amendment.