- Lawfulness, Fairness & Transparency (GDPR Art. 5(1)(a)): We never sell, rent, or broker your personal data to third-party advertisers or data brokers.
- Data Minimization & Anonymity: Donors can choose to contribute anonymously on public campaign pages while receiving secure electronic receipts.
- Explicit Consent for Medical/Health Data (GDPR Art. 9): Sensitive campaign documentation is processed strictly with explicit consent that can be withdrawn at any time.
- Global Data Rights: Whether you are located in the European Economic Area (EEA), the United Kingdom, Nigeria, or across the global diaspora, we extend full GDPR and NDPA data subject rights to every user.
1. Controller Identity & GDPR / NDPA Regulatory Scope
For the purposes of the European Union General Data Protection Regulation (Regulation (EU) 2016/679) (“EU GDPR”), the UK General Data Protection Regulation and Data Protection Act 2018 (“UK GDPR”), and the Nigeria Data Protection Act 2023 (“NDPA”), the Data Controller responsible for your personal data is:
Data Controller: TRANZT DIGITALS LIMITED (Company Registration No. RC-7612345), trading as CrowdAlt
Registered Office: Victoria Island, Lagos State, Nigeria
Data Protection Officer (DPO): privacy@crowdalt.org
This Privacy Policy applies to all visitors, donors (including diaspora donors transacting in EUR, GBP, USD, or NGN), campaign organizers, and campaign beneficiaries whose personal data is processed through the CrowdAlt website, APIs, and related crowdfunding services (collectively, the “Platform”).
2. Categories of Personal Data We Collect (GDPR Arts. 13 & 14)
In accordance with the GDPR principle of data minimization (Article 5(1)(c)), we limit our collection of personal data to what is strictly necessary for the operation, security, and regulatory compliance of our crowdfunding platform:
Full name, email address (to issue mandatory electronic tax/donation receipts), donation amount, selected display currency (NGN, USD, GBP, EUR), optional voluntary tip amount, optional public message of support, public anonymity preference, and payment transaction reference metadata received from our payment processor.
Full legal name, email address, phone number, bcrypt-hashed account credentials, campaign narratives, media uploads, 10-digit Nigerian NUBAN bank account number, bank institution code, and 11-digit Bank Verification Number (BVN) metadata used exclusively for identity cross-verification and anti-money laundering (AML) compliance.
Where a fundraiser is created for medical treatment, surgery, tuition, or emergency relief, Organizers may upload supporting evidence (such as medical reports, hospital invoices, or photographs) relating to themselves or a third-party Beneficiary. Health and medical data constitute Special Category Personal Data under GDPR Article 9. We process such data strictly upon the explicit consent (GDPR Art. 9(2)(a)) of the data subject (or their parent/legal guardian) obtained prior to upload.
IP address, browser type and version, time zone setting, device operating system, HTTP-only authentication session tokens, and regional currency preferences.
3. Lawful Bases for Processing (GDPR Articles 6 & 9)
Under the EU/UK GDPR and the NDPA 2023, we must establish a valid lawful basis before processing your personal data. Below is our statutory mapping of processing activities to their governing legal bases:
| Processing Purpose | Data Categories | GDPR / NDPA Lawful Basis |
|---|---|---|
| Creating accounts, hosting campaigns, processing donations & settling payouts | Donor & Organizer identity, contact, campaign, and payout routing details | Contractual NecessityGDPR Art. 6(1)(b) • NDPA Sec. 25(1)(b)(i) |
| KYC/BVN identity verification, AML/CFT screening, and statutory tax/audit retention | Organizer BVN match status, NUBAN account, transaction & payout logs | Legal ObligationGDPR Art. 6(1)(c) • NDPA Sec. 25(1)(b)(ii) |
| Displaying medical/health documentation in fundraisers & public donor attribution | Health/medical records (Special Category Data), photos, public donor names | Explicit ConsentGDPR Art. 6(1)(a) & Art. 9(2)(a) • NDPA Sec. 25(1)(a) |
| Fraud prevention, velocity anomaly detection, network security & service integrity | IP address, device metadata, session logs, and checkout security tokens | Legitimate InterestsGDPR Art. 6(1)(f) • NDPA Sec. 25(1)(b)(iv) |
4. Purposes of Processing & Automated Fraud Checks (GDPR Art. 22)
- Fulfilling Donations & Issuing Receipts: Routing payments through licensed payment gateways, attributing funds to verified campaigns, and sending itemized electronic receipts.
- Organizer Verification & Beneficiary Protection: Authenticating campaign creators and bank account ownership prior to releasing raised funds.
- Milestone & Settlement Notifications: Sending transactional service notifications regarding donation confirmations, verification status, and bank payouts.
- Safeguards Against Solely Automated Decisions (GDPR Art. 22): While our payment infrastructure uses automated fraud-scoring rules to flag suspicious card velocity or AML anomalies, no campaign termination, account ban, or permanent fund freeze is ever executed without human review by our Trust & Compliance team. You have the right to contest any automated flag and request human intervention.
5. Payment Security & Zero Card Storage
CrowdAlt never collects, processes, or stores your raw debit/credit card numbers (PAN), expiration dates, or CVV security codes on our servers. All payment credentials are encrypted via TLS 1.3 and transmitted directly to Paystack Payments Limited (a Stripe company), an audited PCI-DSS Level 1 payment processor.
6. Data Sharing, Sub-Processors & Article 28 DPAs
We share personal data only with vetted recipients necessary to deliver our services. Every third-party service provider acting as a Data Processor on our behalf is bound by a written Data Processing Agreement (DPA) compliant with GDPR Article 28 and NDPA regulations:
- Payment & Settlement Processors: Paystack (a Stripe company) and regulated Nigerian commercial/microfinance settlement banks for card acquiring, interbank transfers, NUBAN resolution, and payout execution.
- Cloud Hosting & Database Infrastructure: Enterprise cloud infrastructure providers (MongoDB Atlas and application hosting servers) operating under SOC 2 Type II, ISO 27001, and GDPR Article 28 Data Processing Addenda with encryption at rest and in transit.
- Campaign Organizers & Public Campaign Pages: Unless a donor selects the “Donate Anonymously” checkbox at checkout, the donor's name, donation amount, and optional comment are displayed on the campaign page. When “Donate Anonymously” is selected, public attribution is masked as “Anonymous Supporter.”
- Regulatory & Law Enforcement Authorities: Disclosed strictly where mandated by applicable law, court order, or Central Bank of Nigeria (CBN) / Nigerian Financial Intelligence Unit (NFIU) statutory anti-money laundering obligations (GDPR Art. 6(1)(c)).
7. International Data Transfers (GDPR Chapter V, Arts. 44–49)
CrowdAlt is headquartered in Nigeria and enables global diaspora supporters in the European Economic Area (EEA), the United Kingdom, North America, and worldwide to donate to verified Nigerian causes. Consequently, personal data collected from EEA or UK residents may be transferred to and processed in Nigeria or secure cloud data centers outside the EEA/UK.
Whenever we transfer personal data originating from the EEA, UK, or Switzerland to jurisdictions not yet covered by an adequacy decision, we rely on:
- EU Standard Contractual Clauses (SCCs): The European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914) incorporated into our sub-processor agreements pursuant to GDPR Article 46(2)(c).
- UK International Data Transfer Addendum (IDTA): The UK Information Commissioner's Office (ICO) Addendum for transfers subject to UK GDPR.
- Contractual Derogation for Direct Donations (GDPR Art. 49(1)(b)): Where a donor outside Nigeria initiates a donation to a Nigerian fundraiser, the transfer of transaction metadata necessary to credit the Nigerian beneficiary is required for the performance of the donation contract with the donor.
8. Data Retention, Technical Security & Breach Notification
Storage Limitation (GDPR Art. 5(1)(e)): We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:
- Financial, Donation & Payout Records: Retained for six (6) years following the transaction date to comply with mandatory Nigerian tax, anti-money laundering (Money Laundering Prevention and Prohibition Act 2022), and financial audit laws.
- Active Organizer Accounts & Campaigns: Retained for the duration of the active account. Upon account closure or a verified GDPR Article 17 erasure request, non-financial profile data and campaign media are deleted or irreversibly anonymized within 30 days.
- Security Logs & Session Tokens: Authentication cookies expire automatically after 7 days; security audit logs are rotated after 90 days.
Technical & Organizational Security (GDPR Art. 32) & 72-Hour Breach Notification (Arts. 33–34): We enforce TLS 1.3 encryption in transit, AES-256 encryption at rest, cryptographic password hashing, and role-based access controls. In the event of a personal data breach likely to result in a risk to your rights and freedoms, CrowdAlt will notify the relevant Supervisory Authority (including EU/UK DPAs and the NDPC) within 72 hours of becoming aware of the breach, and will notify affected individuals without undue delay where a high risk exists.
9. Your Data Subject Rights (GDPR Articles 12–22 & NDPA)
Under the EU GDPR, UK GDPR, and the Nigeria Data Protection Act 2023, you have the following enforceable rights regarding your personal data, which you may exercise free of charge at any time:
Request confirmation of whether we process your personal data and receive a full copy of that data (Subject Access Request).
Request immediate correction of inaccurate personal data or completion of incomplete account or campaign details.
Request deletion of your personal data where it is no longer necessary or consent is withdrawn, subject to statutory financial retention duties.
Request that we suspend the processing of your personal data while accuracy or legitimate grounds are being verified.
Receive your personal data in a structured, commonly used, machine-readable format (JSON or CSV) to transfer to another service.
Object at any time to processing based on legitimate interests (Art. 6(1)(f)) or any direct marketing communications.
Withdraw your consent at any time (including for medical/health campaign uploads or public donor display) without affecting prior lawful processing.
Request human intervention, express your point of view, and contest any automated fraud or compliance flag.
Response Timeline (GDPR Art. 12(3)): To exercise any of these rights, email privacy@crowdalt.org. We verify requester identity and respond to all legitimate requests within thirty (30) calendar days.
11. GDPR & Privacy Compliance Checklist
The following compliance checklist summarizes how CrowdAlt satisfies mandatory requirements under the EU/UK GDPR, the ePrivacy Directive, PCI-DSS Level 1, and the Nigeria Data Protection Act 2023:
Every data processing activity is tied to a documented legal basis: Contractual Necessity, Legal Obligation, Explicit Consent, or Legitimate Interests.
Medical and health records uploaded to emergency campaigns are processed strictly upon explicit, revocable consent from the data subject or legal guardian.
Guaranteed 30-day fulfillment for Access (SAR), Rectification, Erasure (Right to be Forgotten), Restriction, Data Portability, Objection, and Human Review.
International transfers for EEA, UK, and diaspora donors are safeguarded by EU Standard Contractual Clauses (SCCs), the UK IDTA, and TLS 1.3 / AES-256 encryption.
All payment, cloud hosting, and identity verification partners are bound by written GDPR Article 28 Data Processing Agreements and PCI-DSS Level 1 audits.
We collect only the minimum personal data required for donation receipts, fraud prevention, and CBN regulatory verification—with zero sale of personal data.
Incident response procedures mandate notifying competent supervisory authorities within 72 hours and affected users without undue delay in high-risk incidents.
Appointed Data Protection Officer (DPO), Records of Processing Activities (RoPA), Data Protection Impact Assessments (DPIAs), and public donor anonymity controls.
12. Contact Our DPO & Right to Lodge a Supervisory Complaint
If you wish to exercise any of your GDPR or NDPA rights, withdraw consent, submit a Subject Access Request (SAR), or inquire about our privacy practices, please contact our Data Protection Officer:
Data Controller: TRANZT DIGITALS LIMITED (RC-7612345) • CrowdAlt Platform
Data Protection Officer (DPO): privacy@crowdalt.org
Legal & Compliance Desk: legal@crowdalt.org
Registered Address: Victoria Island, Lagos State, Nigeria
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority if you believe our processing of your personal data infringes the GDPR or NDPA:
- European Economic Area (EEA): Your local national Data Protection Authority (listed by the European Data Protection Board at edpb.europa.eu).
- United Kingdom: The Information Commissioner's Office (ICO) at ico.org.uk.
- Federal Republic of Nigeria: The Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.