Privacy Policy

This Privacy Policy explains how the FOUND Africa Technology (“FOUND”, “we”) collects, uses, shares and protects your personal data when you apply to and take part in the Digital Officers programme. This page is maintained by FOUND to answer common questions about how we handle your data.

1. Data controller

FOUND Africa Technology is the data controller of your personal data. You can reach us at admin@foundafrica.tech. For NDPA queries specifically, mark your email “Data Privacy Request”.

2. Personal data we collect

• Identity & contact: first and last name, date of birth, personal email, phone number, university, local government area.
• Account data: official FOUND email, password (stored hashed), sign-in times, referral code you signed up through.
• Programme data: courses completed, certificate uploads, PDF/ZIP submissions, pitches, poll and rating responses, points earned and spent.
• Identity verification: bank name, account number, account name, or a copy of a government-issued ID stored in your linked personal folder.
• Technical data: IP address and basic device information used only to secure your account and prevent abuse.

3. Lawful bases (NDPA §25)

• Consent — for marketing emails, optional uploads, and Google Drive integration. You can withdraw consent at any time.
• Performance of a contract — to run the programme you applied to and pay stipends or prizes.
• Legal obligation — to comply with Nigerian tax, anti-fraud and financial regulations, and with Nigerian law where FOUND is established.
• Legitimate interest — to prevent duplicate accounts, referral fraud, and unauthorised access.

4. How we use your data

• Review your application, issue your official FOUND email and welcome you.
• Track course completions, verify submissions, and rank leaderboards.
• Pay stipends, prize money and seed funding to verified bank accounts.
• Send you programme updates, digests, and reward blast announcements.
• Detect duplicate or fraudulent applications and referral abuse.

5. Sharing with third parties (processors)

We only share your data with processors that help us run the programme, under data processing agreements:

• Supabase / Lovable Cloud — database, auth and file storage.
• Google (Gmail / Workspace / Drive) — sending official emails and, only if you connect it, reading your submitted folder.
• Cloudflare — hosting and CDN.

We do not sell your personal data.

6. Cross-border transfers

Some processors host data outside Nigeria. Where that happens, we rely on the adequacy decisions, safeguards and standard contractual clauses permitted by the Nigeria Data Protection Act, 2023 and the Nigeria Data Protection Commission (NDPC).

7. Retention

• Rejected applications — deleted within 7 days.
• Approved but never signed in — deleted after 30 days; the Digital Officer serial number is returned to the pool.
• Inactive accounts — archived or deleted after 90 days of inactivity, following notice to your registered email.
• Financial records — kept for the period required by Nigerian law (typically 6 years) even after account deletion.

8. Your rights under the NDPA

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data (you can edit most of it yourself in your profile).
• Request deletion (“right to be forgotten”) subject to legal retention obligations.
• Object to processing and withdraw any consent you gave us.
• Request a portable copy of the data you provided to us.
• Lodge a complaint with the Nigeria Data Protection Commission if you believe we have mishandled your data.

To exercise any of these rights, email admin@foundafrica.tech. We respond within 30 days.

9. Security

We enforce role-based access, row-level security on our database, encrypted transport (HTTPS), signed URLs for private uploads, and admin-only access to identity data. Only admin@foundafrica.tech has administrator privileges. No system is perfectly secure — if you suspect a breach, contact us immediately.

10. Children

In Nigeria the programme is not intended for anyone under 16. We do not knowingly collect data from children under 16.

11. Changes to this policy

When we materially update this policy or our Terms of Use, we bump the version and ask every existing user to re-accept on next sign-in.