Privacy Policy.

Who We Are

ExJAM Humanitarian Foundation is a non-profit organisation registered under Nigerian law as an Incorporated Trustee. We operate this website and the member portal to support alumni contributions, case sponsorship, and community support for ExJAM alumni and their families. For data enquiries, please use the contact form on our website.

What Data We Collect

We collect the following categories of personal data:

• Account data: name, email address, phone number, and state of residence when you register.
• Donation data: transaction amounts, payment processor references, and donation history. We do not store full card details.
• Case submission data: patient case details and medical or welfare information submitted via the case portal.
• Correspondence: messages sent via the contact form, volunteer applications, and ambassador applications.
• Usage data: pages visited, referring URL, and device type — collected anonymously via analytics.

How We Use Your Data

We use your data to:

• Process and acknowledge donations.
• Manage case submissions, assessments, and sponsorship matching.
• Send impact reports, newsletters, and event invitations — with an unsubscribe option on every email.
• Comply with Nigerian regulatory obligations (CAC, FIRS, NDPR).
• Improve our website and services using aggregated, anonymised analytics.

Data Sharing

We do not sell or rent personal data. We share data only with:

• Payment processors — to handle donations and issue payment references. We do not store full card details.
• Database, authentication, and storage providers — to hold member account, donation, and case data.
• Email delivery services — to send transactional emails and newsletters.
• Website hosting and CDN providers — to serve the site; request data may be logged for security and performance purposes.
• Product analytics providers — using anonymised usage data only (pages visited, feature interactions). No personally identifiable information is shared.
• Error monitoring services — technical error reports, transmitted only with your cookie consent.
• Regulatory authorities where legally required.

All processors operate under data processing agreements and are bound to handle data in accordance with applicable privacy law.

Your Rights

Under the Nigeria Data Protection Regulation (NDPR), you have the right to:

• Access, correct, or delete your personal data.
• Withdraw consent at any time.
• Object to processing.
• Lodge a complaint with the National Information Technology Development Agency (NITDA).

To exercise any of these rights, use the contact form on our website.

How Long We Keep Your Data

Donor records are retained for seven years for tax and regulatory compliance. When you delete your account, portal access is removed, active sessions are signed out, and your profile is marked deleted. Donation, sponsorship, case, notification, and audit records are retained where legal, regulatory, or programme obligations require them. Case data is retained for the duration of programme involvement and five years thereafter.

Cookies

We use essential session cookies for login functionality and, with your consent, error-monitoring tools (Sentry) to help us fix bugs faster. No advertising or third-party tracking cookies are used. You may withdraw consent at any time via the cookie banner or your browser settings without affecting core site functionality.

Our analytics provider is Vercel Analytics, which collects anonymised page-view data and does not use persistent identifiers.

Lawful Basis for Processing (UK & EU Donors)

If you are located in the United Kingdom or European Economic Area, the UK GDPR and EU GDPR apply to how we handle your personal data. We process your data on the following lawful bases (Article 6):

• Contract: processing your donation, issuing receipts, and managing your member account.
• Legal obligation: retaining donation records for tax and regulatory compliance.
• Legitimate interests: fraud prevention, security monitoring, and service improvement. You have the right to object to processing on this basis.
• Consent: sending marketing emails and newsletters. You may withdraw consent at any time by clicking the unsubscribe link in any email.

Under UK/EU GDPR (Articles 13–22) you also have the right to: access your data; rectify inaccuracies; erasure (“right to be forgotten”) where no legal obligation requires retention; restrict or object to processing; data portability; and to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or your local EU supervisory authority.

Data controller: ExJAM Humanitarian Foundation. For data enquiries, use the contact form on our website.

International Residents

California (CCPA/CPRA): California residents have the right to know what personal information we collect, request deletion, and opt out of any “sale” of personal data. We do not sell personal data. To exercise your rights, use the contact form on our website.

Canada (PIPEDA): Canadian residents may request access to or correction of personal data we hold, and withdraw consent for non-essential processing at any time by contacting us via the contact form.

For all international enquiries, responses are provided within 30 days of a verified request.

Contact Us

For any questions about this Privacy Policy or your personal data, please use the contact form on our website. Data enquiries receive a response within five business days (30 days for international requests).