1. Who we are and the scope of this policy
FACT Foundation is a humanitarian and development organisation with its country office at 660 Inuwa Wada Crescent, Utako 900108, Abuja, FCT, Nigeria. For personal data collected through this website, FACT Foundation acts as the data controller.
This policy applies to visitors, newsletter subscribers, people who contact us, applicants and people who request access to website resources. Separate project-specific notices may apply where FACT collects personal data during research, monitoring, evaluation or programme activities.
2. Personal data we collect
Depending on how you use the website, we may collect:
- your name, email address, telephone number, organisation and job role;
- messages, enquiries and correspondence you send to us;
- newsletter preferences and records of consent or withdrawal;
- resource-access information, including the resource requested and the date of the request;
- recruitment information that you choose to provide when applying for an opportunity; and
- limited technical and security information such as IP address, browser type, device information, request logs and cookie preferences.
Please do not send sensitive personal data through general website forms unless FACT specifically requests it through an appropriate secure process.
3. Purposes and lawful bases
| Purpose | Typical lawful basis |
|---|---|
| Responding to enquiries and partnership requests | Legitimate interests, steps requested before entering an agreement, or performance of an agreement |
| Sending newsletters and research updates | Consent |
| Providing access to reports and datasets | Legitimate interests and, where applicable, consent for optional communications |
| Managing recruitment | Steps requested before employment, legitimate interests and legal obligations |
| Maintaining website security and preventing abuse | Legitimate interests and legal obligations |
| Meeting regulatory, audit and legal requirements | Legal obligation or public interest, where applicable |
Where we rely on consent, you can withdraw it at any time without affecting processing that occurred before withdrawal. We will not make newsletter consent a condition of downloading a public resource.
4. Sharing personal data
We may share personal data only where necessary with authorised FACT personnel and contracted providers supporting hosting, email delivery, security, database management and website operations. We may also disclose information where required by law, a regulator or a court, or where necessary to protect people, our systems or our legal rights.
Service providers must process personal data only on documented instructions, protect it appropriately and keep it confidential. FACT does not sell personal data.
5. International transfers
Some approved technology providers may process data outside Nigeria. Before an international transfer, FACT will use a transfer mechanism permitted under the Nigeria Data Protection Act 2023 and apply appropriate contractual, organisational and technical safeguards.
6. Retention
We keep personal data only for as long as it is needed for the stated purpose, legal requirements, dispute handling and security. As an initial website schedule, routine enquiries will normally be reviewed for deletion after 24 months, unsuccessful recruitment records after 12 months, resource-request and consent records after 36 months, and security logs after 12 months. Records may be retained longer where a law, contract, active investigation or dispute requires it. These periods will be confirmed in FACT’s internal retention schedule before launch.
7. Security
FACT uses proportionate technical and organisational safeguards, including access controls, encryption in transit, secure hosting configuration, backups, monitoring, least-privilege access and staff confidentiality requirements. No online service is completely risk-free, but we assess and improve our controls as the website and its services develop.
8. Your data-protection rights
Subject to applicable law, you may ask FACT to:
- confirm whether we process your personal data and give you access to it;
- correct inaccurate or incomplete information;
- delete personal data in appropriate circumstances;
- restrict or object to certain processing;
- provide qualifying data in a portable format;
- explain safeguards used for an international transfer;
- withdraw consent; and
- review a decision based solely on automated processing that produces legal or similarly significant effects.
We may need to verify your identity and clarify your request. You may also lodge a complaint with the Nigeria Data Protection Commission.
9. Children
This general website is not directed at children and FACT does not knowingly use it to collect children’s personal data without an appropriate lawful basis and safeguards. Programme or research activities involving children are governed by separate safeguarding and privacy procedures.
10. Cookies and external links
The current website is designed to operate without advertising or behavioural-tracking cookies. Essential storage may be used for security or user preferences when those features are introduced. If non-essential analytics or marketing cookies are added, FACT will provide clear information and obtain consent before they are activated.
Our pages may link to third-party websites such as LinkedIn and Instagram. Their own privacy notices apply when you visit them.
11. Contact and complaints
For a privacy question or rights request, email fact@factfoundation-int.org with “Data privacy request” in the subject line, call +234 912 300 0681, or write to FACT Foundation, 660 Inuwa Wada Crescent, Utako 900108, Abuja, FCT, Nigeria.
You can also contact the Nigeria Data Protection Commission if you believe your rights have not been addressed.
12. Changes to this policy
We may update this policy when our services, providers or legal obligations change. The effective date at the top of this page will show the latest published version. Material changes will be highlighted where appropriate.