Data Protection: NiaConnect

Our Commitment

NiaConnect is built to serve students, educators, and donors across all 54 African nations. We recognise that data privacy is a fundamental right: not just a legal checkbox. Our data protection framework is aligned with:

Nigeria Data Protection Regulation (NDPR) 2019: as our primary operational jurisdiction
GDPR: for users based in the European Union
Kenya Data Protection Act 2019, South Africa POPIA, Ghana Data Protection Act, and other applicable national frameworks
The African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention)

We have appointed a Data Protection Officer (DPO) who oversees compliance and can be reached at [email protected].

Data Protection Principles

Every data decision at NiaConnect is guided by seven core principles:

Lawfulness & Fairness

We only process data on a valid legal basis and treat users with transparency.

Purpose Limitation

Data collected for one purpose is never used for an incompatible purpose.

Data Minimisation

We collect only what we genuinely need: nothing more.

Accuracy

We help you keep your data accurate and provide tools to correct it.

Storage Limitation

Data is retained only as long as necessary, then deleted securely.

Security

Technical and organisational measures protect your data from unauthorised access.

Accountability

We can demonstrate compliance with all the above at any time.

Lawful Basis for Processing

For every type of data we process, we identify and document a lawful basis:

Processing Activity	Lawful Basis
Account creation & login	Contract (necessary to provide the service)
Showing your profile to other users	Consent (via your privacy settings)
Sending transactional notifications	Contract & Legitimate Interest
Processing mentorship payments	Contract
Fraud detection & safety enforcement	Legitimate Interest & Legal Obligation
Platform analytics (aggregated)	Legitimate Interest
Marketing communications (optional)	Consent (opt-in only)
Complying with legal orders	Legal Obligation

Your Data Rights

Under applicable data protection law, you have the following rights. To exercise them, email [email protected]: we will respond within 30 days:

Right to Access: Receive a copy of all personal data we hold about you.
Right to Rectification: Have inaccurate data corrected.
Right to Erasure ("Right to Be Forgotten"): Have your data deleted, subject to legal retention obligations.
Right to Restriction: Pause processing of your data while a complaint is resolved.
Right to Portability: Receive your data in a structured, machine-readable format.
Right to Object: Object to processing based on legitimate interest, including profiling.
Right to Withdraw Consent: Where consent is the basis, withdraw it at any time without affecting prior processing.

Data Breach Response

In the event of a personal data breach, NiaConnect will:

Contain and assess the breach within 24 hours of discovery
Notify the relevant supervisory authority within 72 hours where legally required (NDPR, GDPR)
Notify affected users without undue delay where the breach poses a high risk to their rights and freedoms
Document all breaches in our internal security incident log
Conduct a post-incident review and implement preventive measures

To report a suspected breach or security vulnerability: [email protected]

Data Transfers

When data is transferred outside its country of origin, we use appropriate safeguards:

Standard Contractual Clauses (SCCs) approved by regulators
Binding Corporate Rules where applicable
Adequacy decisions issued by relevant authorities

We document all cross-border transfers in our Records of Processing Activities (RoPA) maintained by our DPO.

Privacy by Design

Data protection is embedded into how we build NiaConnect: not bolted on afterwards:

Every new feature undergoes a Data Protection Impact Assessment (DPIA) before launch
All profiles default to private: you choose what to share
Sensitive fields (passwords, payment details) are never stored in plain text
Access to production user data is restricted to authorised team members only
Third-party integrations are vetted for data protection compliance before use

Contact the DPO

If you have any concerns about how we process your personal data, or wish to exercise a data right, our Data Protection Officer is your first point of contact.

Data Protection