Privacy Policy

Policy version v1.3-2026-11 · Applies under the Nigeria Data Protection Act 2023 (NDPA).

Who we are

Forward Kaduna Professionals for Atiku–Ashiru (“Forward Kaduna”, “we”) is the data controller for personal data collected on this website. Contact our Data Protection lead through the Contact page.

What we collect

• Membership: full name, phone number, optional email, photo, profession, professional category, organisation, skills, LGA, ward and polling unit.
• Ideas and enquiries: what you submit, and any optional contact details you provide.
• Face check: when you add a photo, our server measures it to confirm it shows one real face and to prevent misuse. This produces a face signature (a list of 128 numbers, not an image) kept with your record.
• Live selfie check: during registration you take a selfie with your camera. It is compared once with the photo you uploaded, to confirm the photo is really you, and is then discarded. The selfie is never saved, shown or shared.
• Invitations: if you joined through a member's invite link, we record who invited you. The inviter sees only a count, never your name.
• Events: if you tap “I'll attend” or are checked in at an event (by scanning your card), we record that. Only administrators for your LGA can see it.
• Security data: a salted, one-way hash of your IP address for rate limiting, and anti-bot checks by Cloudflare Turnstile.

Why we use it (lawful basis)

• Membership administration (your consent): issuing your membership ID, card and access link, and contacting you about Forward Kaduna activities.
• Polling-unit data (separate, explicit consent): organising lawful, peaceful grassroots engagement and election-day volunteer coordination. This is sensitive political-opinion data under the NDPA and is never published.
• Publicity (optional consent): a public share page showing only your endorsement graphic and name.
• Preventing fake and abusive registrations (legitimate interest and your consent): your face signature is compared with other members (to catch duplicates and re-used photos) and with a short internal list of people who must not be issued a card. It is processed on our own servers, never shared or sold, used for nothing else, and deleted when your record is deleted. A person always makes the final decision on any flagged application.
• Statistics: only aggregated counts are published. Ward counts below 5 are shown as “<5” so no one can be identified.

Who can see your data

Only authorised administrators, under role-based access enforced in our database: State administrators, and LGA Coordinators for their assigned LGAs only. Content administrators cannot see member data. Every view, export, edit and deletion of member data is recorded in an immutable audit log. We do not sell your data.

Processors

We use Supabase (database and file storage), Vercel (hosting), Cloudflare (security), and, only when enabled, Resend (email) and Termii (SMS/WhatsApp). They process data only on our instructions.

Security

Photos are stored privately and shown only through short-lived links. Your personal access link is stored only as a cryptographic hash — keep your link private, as anyone with it can view your membership page. If you lose it, you can get a new one with your phone number, your membership ID or email, and your ward; the old link then stops working.

Your rights

You may access, correct, or delete your data, or withdraw consent at any time, using the Correct or Delete My Data form. You may also complain to the Nigeria Data Protection Commission (NDPC).

Retention

See our Data Retention & Deletion Policy.