Your data, handled lawfully, transparently and securely — in line with GDPR and the Nigeria Data Protection Act 2023.
| Document | Data Privacy & Protection Policy (GDPR / NDPR Aligned) |
|---|---|
| Version | 1.0 |
| Effective date | 1 October 2026 |
| Approved by | Board of Trustees, WY-ICARE |
| Review cycle | Annual |
| Applies to | All staff, volunteers, partners, contractors and representatives of WY-ICARE |
WY-ICARE collects and processes personal data of beneficiaries, staff, volunteers, donors, partners and website visitors. This policy describes how that data is handled in compliance with the EU General Data Protection Regulation (GDPR) where applicable, and the Nigeria Data Protection Act 2023 (NDPA) and its subsidiary legislation.
It applies to all personal data processed by WY-ICARE in any form — digital, paper or recorded — across all programmes and systems.
Personal data is processed lawfully, fairly and transparently; collected for specified, explicit and legitimate purposes; limited to what is adequate and necessary; kept accurate and up to date; retained no longer than necessary; and secured against unauthorised access, loss or disclosure.
Beneficiaries: names, contact details, demographic and vulnerability data for programme targeting, delivery and verified impact reporting — under legitimate interest and consent where required.
Donors & partners: identification, contact and transaction data to process donations, issue receipts, meet grant compliance and prevent fraud.
Website visitors: basic analytics and AI-assistant conversation metadata to improve services. WY-ICARE does not sell personal data.
You may request access to, correction of, or deletion of your personal data; restriction or objection to processing; and data portability. Requests are free of charge and answered within 30 days via contact@wyicare.org.
You may lodge a complaint with the Nigeria Data Protection Commission (NDPC) or, where GDPR applies, your local supervisory authority.
Data is protected through access controls, encryption in transit, staff training and partner data-sharing agreements. Safeguarding and whistleblowing records are held under restricted access. Retention schedules follow donor requirements and Nigerian law; data is securely destroyed thereafter.
The website uses only essential and performance cookies. Where payment processors or mapping services load third-party content, their own privacy notices apply; WY-ICARE minimises data shared with them.