1 Introduction
CarnegienFreedom ("we," "us," or "our") is committed to protecting your personal data and respecting your privacy rights in accordance with the Nigeria Data Protection Act (NDPA) 2023 and other applicable data protection laws.
This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you visit our website at https://carnegienfreedom.com/ (the "Site") or interact with our services. By using our Site, you acknowledge that you have read and understood this Privacy Policy.
2 Data Controller
CarnegienFreedom is the data controller responsible for the personal data processed through this Site.
Contact Information:
Email: hello@carnegienfreedom.com
Response Time: We aim to respond to genuine enquiries within five (5) business days.
3 Data Protection Officer
Note: If your organisation processes personal data of more than 200 data subjects within six (6) months, has an annual turnover of ₦10 million or more, or processes sensitive personal data on a large scale, you are classified as a Data Controller of Major Importance and must appoint a DPO.
Currently, CarnegienFreedom does not meet the threshold requiring a mandatory Data Protection Officer under the NDPA. However, we have designated a responsible individual to oversee data protection compliance.
If you have any questions or concerns about how we handle your personal data, please contact us at hello@carnegienfreedom.com.
4 Categories of Personal Data We Collect
We collect and process the following categories of personal data:
4.1 Information You Provide Directly
- Contact Information: Name, email address, and any other details you voluntarily provide when contacting us.
- Communication Data: The content of messages, enquiries, or feedback you send to us.
4.2 Information Collected Automatically
- Technical Data: IP address, browser type and version, device type, operating system, time zone setting, and browser plug-in types.
- Usage Data: Information about how you use our Site, including pages visited, time spent on pages, referral sources, and click-through rates.
- Cookie Data: Information stored and accessed through cookies and similar tracking technologies. See Section 11 (Cookies) for more details.
4.3 Information from Third Parties
We do not currently receive personal data about you from third-party sources.
5 Lawful Basis for Processing
Under the NDPA, we process your personal data only where we have a valid lawful basis. The lawful bases we rely on are:
| Purpose | Lawful Basis | Explanation |
|---|---|---|
| Responding to enquiries and providing requested resources | Consent / Legitimate Interest | You voluntarily provide information when you contact us. |
| Responding to enquiries and providing customer support | Consent / Legitimate Interest | Necessary to respond to your request or in our legitimate interest to assist users. |
| Website maintenance, security, and fraud prevention | Legitimate Interest | Necessary to protect our Site and users from security threats. |
| Analytics and performance monitoring | Consent | Where cookies or tracking technologies are used for non-essential analytics. |
| Compliance with legal obligations | Legal Obligation | Where required by applicable law or regulatory authority. |
Where we rely on consent, you have the right to withdraw it at any time by contacting us or using the opt-out mechanisms provided.
6 Purposes of Processing
We use your personal data for the following purposes:
- To Provide Services: Providing educational resources and content you request.
- To Communicate: Responding to your enquiries, feedback, and support requests.
- To Improve Our Site: Analysing usage patterns to enhance user experience and content quality.
- To Ensure Security: Protecting our Site and users from fraud, abuse, and security threats.
- To Comply with Law: Meeting our legal and regulatory obligations under Nigerian and international law.
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.
7 How We Share Your Personal Data
We do not sell, trade, or rent your personal data to third parties. We may share your data only in the following circumstances:
- Service Providers: We use Netlify as our hosting and content delivery platform. Netlify processes technical data (such as IP addresses and browser information) on our behalf to host and serve our Site. Netlify is based in the United States.
- Legal Requirements: We may disclose your data if required to do so by law, court order, or governmental authority, or to protect our rights, property, or safety.
- Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the relevant third party, subject to the same data protection obligations.
8 Cross-Border Data Transfers
Your personal data is hosted and processed by Netlify, which operates servers in the United States and other jurisdictions. This means your data may be transferred outside Nigeria.
Under the NDPA, cross-border transfers are permitted where:
- The recipient country provides an adequate level of protection for personal data;
- Appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs); or
- The transfer is necessary for the performance of a contract or based on your consent.
Netlify has implemented appropriate technical and organisational measures, including Standard Contractual Clauses, to ensure your data is protected in accordance with the NDPA. By using our Site, you acknowledge and consent to this transfer.
9 Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law.
| Data Category | Retention Period |
|---|---|
| Email addresses provided in contact enquiries | 24 months from the date of collection, or until you withdraw consent or request deletion, whichever is earlier. |
| Contact form submissions | 12 months from the date of submission, or until the enquiry is resolved and no longer needed. |
| Technical/usage data (logs, analytics) | 12 months from collection, after which it is anonymised or deleted. |
| Cookie data | As specified in our Cookie Policy (see Section 11). |
If no specific legal retention period applies, we will retain personal data for a maximum of 6 months after the purpose for collection has been completed, in line with NDPA guidance.
10 Your Data Subject Rights
Under the NDPA, you have the following rights regarding your personal data:
10.1 Right to Access
You have the right to request confirmation of whether we process your personal data and, if so, to obtain a copy of that data along with information about how it is being used.
10.2 Right to Rectification
You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
10.3 Right to Erasure ("Right to be Forgotten")
You have the right to request the deletion of your personal data where:
- The data is no longer necessary for the purposes for which it was collected;
- You withdraw your consent and there is no other lawful basis for processing;
- The data has been unlawfully processed; or
- The data must be erased to comply with a legal obligation.
10.4 Right to Restrict Processing
You have the right to request that we limit the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.
10.5 Right to Data Portability
You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.
10.6 Right to Object
You have the right to object to the processing of your personal data based on legitimate interests or for direct marketing purposes.
10.7 Right to Withdraw Consent
Where we rely on your consent, you may withdraw it at any time. This will not affect the lawfulness of processing carried out before the withdrawal.
10.8 How to Exercise Your Rights
To exercise any of these rights, please contact us at hello@carnegienfreedom.com. We will respond within one month of receiving your request. If the request is complex, we may extend this period by a further two months and will notify you accordingly.
We may need to verify your identity before processing your request to ensure the security of your data.
11 Cookies and Tracking Technologies
11.1 What Are Cookies?
Cookies are small text files placed on your device when you visit a website. They help the site recognise your device and store certain information about your preferences or past actions.
11.2 Types of Cookies We Use
| Category | Purpose | Lawful Basis |
|---|---|---|
| Strictly Necessary | Essential for the Site to function (e.g., security, session management). | Legitimate Interest |
| Analytics/Performance | Help us understand how visitors interact with our Site (e.g., page views, time on site). | Consent |
| Functional | Enable enhanced functionality and personalisation (e.g., remembering preferences). | Consent |
11.3 Cookie Consent
When you first visit our Site, you will see a cookie consent banner. You can:
- Accept All cookies;
- Reject non-essential cookies; or
- Customise your preferences.
You can change your cookie preferences at any time by using the cookie settings button in the banner, or by selecting cookie settings on this page.
11.4 Third-Party Cookies
We do not currently use third-party advertising cookies. Any analytics cookies are set by our service providers (e.g., Netlify) and are subject to their respective privacy policies.
For more details, please see our full Cookie Policy.
12 Children's Privacy
Our Site is not directed at children under the age of 18, and we do not knowingly collect personal data from children.
If you are under 18, please do not provide any personal data to us. If we become aware that we have inadvertently collected personal data from a child under 18 without verifiable parental consent, we will take steps to delete that information as soon as possible.
If you believe we may have collected data from a child, please contact us at hello@carnegienfreedom.com.
13 Data Security
We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it, including:
- Encryption: All data transmitted between your browser and our Site is encrypted using HTTPS/TLS (Transport Layer Security).
- Access Controls: Limited access to personal data to authorised personnel only.
- Secure Hosting: Our Site is hosted on Netlify, which maintains industry-standard security certifications and practices.
- Regular Review: We periodically review our security measures to ensure they remain effective.
Despite these measures, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we are committed to promptly addressing any security incidents.
14 Data Breach Notification
In the unlikely event of a personal data breach that poses a risk to your rights and freedoms, we will:
- Notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of the breach;
- Notify you without undue delay if the breach is likely to result in a high risk to your rights and freedoms; and
- Provide information about the nature of the breach, the categories and approximate number of affected individuals, the likely consequences, and the measures taken or proposed to address the breach.
15 Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. Any changes will be posted on this page with an updated "Last Updated" date.
Significant changes will be notified to you via email (if you have provided one) or through a prominent notice on our Site. We encourage you to review this Privacy Policy periodically.
16 Contact Us
If you have any questions, concerns, or complaints about this Privacy Policy or our data protection practices, please contact us:
If you are not satisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).
NDPC Contact:
Website: www.ndpc.gov.ng
Address: No. 16, Sir Ahmadu Bello Way, Central Business District, Abuja, Nigeria
17 Consent
By using our Site and providing your personal data, you consent to the collection, use, and processing of your personal data as described in this Privacy Policy.
If you do not agree with this Privacy Policy, please do not use our Site or provide us with your personal data.