Data Protection Policy

Our institutional principles and practices for securing your personal and organizational data.

Last updated: October 14, 2026

This Data Protection Policy explains how Suns Initiative for Human and Community Development (“Suns Initiative”, “we”, “us”, or “our”) processes, safeguards, and governs the personal data of partners, donors, volunteers, participants, and visitors across our digital platforms and community programs in Nigeria.

We adhere strictly to the Nigeria Data Protection Act (NDPA), the Nigeria Data Protection Regulation (NDPR), and applicable international standards regarding data privacy and data subject rights.

1. Core Data Principles

Whenever we handle data, we are guided by internationally recognized principles:

  • Lawfulness, Fairness, and Transparency: Personal data is processed on valid legal grounds (consent, legitimate interest, or statutory obligation) with clear notice.
  • Purpose Limitation: We collect personal data exclusively for designated charitable, educational, partner communication, and volunteer coordination purposes.
  • Data Minimization: We only request information strictly necessary to fulfill our mission or process financial transactions.
  • Accuracy: We take reasonable steps to ensure partner and donor records are up to date.
  • Storage Limitation: Data is retained only for the duration required by law or necessary for continuous impact updates.
  • Integrity and Confidentiality: Data is protected against unauthorized access, accidental loss, alteration, or disclosure via modern encryption and role-based access control.

2. Partner & Donor Data Governance

When individuals or organizations partner with Suns Initiative via our Partnership page or make financial contributions, we collect:

  • Contact Details: Full name, institutional name, email address, and phone number.
  • Commitment Parameters: Chosen contribution type (financial funds vs. in-kind gifts), pledge schedule (one-time, 3 months, 6 months, 12 months, 24 months, or custom duration), and designated focus areas.
  • Transaction References: Payment confirmation identifiers provided by Paystack. Note: Full credit/debit card numbers and CVV codes are NEVER captured, processed, or stored on our servers.
  • In-Kind Gift Details: Descriptions of equipment, apparel, school supplies, or asset donations.

Use of Partner Records: Partner information is securely recorded in our administrative console to maintain accountability, track multi-month pledges, generate donation receipts, and send periodic updates documenting the tangible work and youth transformation achieved through your support.

3. Cookies and Local Storage

Our website uses cookies, session markers, and browser local storage to provide a fast, secure, and intuitive user experience:

  • Strictly Essential Cookies & Storage: Required for secure session authentication, admin console access, CSRF protection, and storing your consent preferences (e.g. suns_cookie_consent_v1).
  • Payment Security Tokens: When initiating checkout on our Partnership or Donation forms, Paystack loads secure iframes that set fraud-prevention and transaction validation tokens in compliance with PCI-DSS standards.
  • Analytics & Performance: Anonymous, aggregated telemetry to understand website performance, page load speed, and popular educational resources, helping us optimize the platform.

You can control or delete cookies through your browser settings at any time or interact with our Cookie Consent Banner to customize your preferences.

4. Security Safeguards

We implement comprehensive technical and organizational safeguards:

  • Transport Security: All web traffic is encrypted end-to-end via Transport Layer Security (TLS 1.3) with HTTPS enforcement.
  • Database Security: Data is housed within Google Cloud / Firebase Firestore environments featuring AES-256 encryption at rest, automated backups, and strict security rules restricting access exclusively to authenticated administrators.
  • Administrative Access: Internal access is protected by multi-factor authentication and role-based permissions.

5. Data Retention Periods

  • Financial & Partner Records: Retained for 7 years to satisfy Nigerian statutory accounting, auditing, and non-profit reporting requirements.
  • General Enquiries & Contact Messages: Retained for 24 months, after which they are purged.
  • Volunteer Applications: Retained for up to 3 years to maintain active rosters and match applicants to upcoming clinics.

6. Your Data Subject Rights

Under the Nigeria Data Protection Act (NDPA), you hold the following enforceable rights:

  • Right to Access: Request a summary of the personal data we hold about you.
  • Right to Rectification: Request correction of inaccurate, outdated, or incomplete data.
  • Right to Erasure: Request deletion of your personal records, subject to statutory record-keeping laws.
  • Right to Restrict or Object: Opt out of impact newsletters, outreach updates, or communications at any time.
  • Right to Data Portability: Request your data in a structured, machine-readable format.

7. Contact Our Data Protection Lead

For data access requests, corrections, or questions regarding this Data Policy, please contact our administrative team:

Suns Initiative for Human and Community Development
Attn: Data Protection Officer
Jos, Plateau State, Nigeria
Email: info@sunsinitiative.org
Telephone: +234 814 377 9790

See also our Privacy Policy and Terms & Conditions.