Privacy Policy

Some demographic or programme information may reveal sensitive characteristics. AFC will collect sensitive personal data only where necessary, proportionate and supported by a valid legal basis and additional safeguards. Fields that are optional will be identified where practicable.

We obtain personal data directly from you when you register, apply, pay, participate, communicate, complete a survey or diagnostic, post content or change your preferences. We may also receive data from programme partners, funders, facilitators, referral organisations, publicly available sources, payment providers, webinar or event platforms, cookie and analytics technologies, and persons authorised by you.

Where another organisation provides your data, AFC will take reasonable steps to ensure that the collection is lawful and that you receive relevant privacy information.

Where we rely on legitimate interests, we assess the purpose, necessity and effect on your rights. You may request information about the applicable balancing assessment. Where consent is required, it must be freely given, specific, informed and unambiguous; silence or a pre-ticked box is not consent.

AFC uses Flutterwave and may use other payment service providers to process payments. When you pay, the payment service provider may collect payment-card, bank, authentication, device, fraud and transaction information directly under its own privacy notice. AFC generally receives the transaction reference, payer details, amount, currency, status, date and information needed for reconciliation, refunds and disputes.

Flutterwave or any other payment service provider may act as AFC’s service provider for some processing and as an independent controller for obligations it determines under financial, anti-fraud or payment laws. Do not send AFC complete card numbers, card security codes, passwords or one-time passwords.

Some AFC Hub features are designed to make selected member or business information visible to other members or the public. AFC will identify the visibility of a field or provide a relevant setting before publication where practicable. You should not place sensitive, confidential or unnecessary personal information in a public field.

Removing content from active display may not immediately remove copies from backups, lawful records, search-engine caches or material already shared by others. AFC will take reasonable steps within its control and explain any lawful retention requirement.

AFC may work with programme partners, funders and facilitators to select participants, deliver activities, provide support or report outcomes. AFC will disclose programme-specific recipients and purposes where they differ materially from this Policy. Identifiable data will not be shared with a funder merely because the funder supports a programme unless there is a lawful basis and appropriate notice.

AFC will prefer aggregated or de-identified impact reporting where individual identification is unnecessary and will use appropriate contractual or data-sharing controls with participating organisations.

Where an online or physical session is recorded, AFC will provide notice of the purpose, likely audience, access period and practical participation choices. A programme recording used to provide the contracted learning service will be handled separately from public marketing use.

AFC will obtain an appropriate release or rely on another lawful basis explained at the time before using an identifiable testimonial, photograph, voice or story for public promotion. Withdrawal of consent will affect future use where consent is the basis, but may not require recall of lawful printed material already distributed.

AFC Hub may use strictly necessary cookies for security, login, preferences and transaction continuity. With any consent required by law, AFC may use analytics or marketing cookies to understand usage and measure communications. AFC will provide a cookie or preference tool through which non-essential choices can be accepted, rejected or changed.

Browser controls may also restrict cookies, but blocking necessary cookies may affect account or payment functions. Details of active cookie providers, purposes and durations should be made available through the website’s cookie interface.

AFC may share personal data only where necessary and lawful with:

• hosting, cloud, communications, email, webinar, customer-support, analytics and security service providers;
• Flutterwave and other authorised payment, banking, fraud-prevention or refund service providers;
• programme partners, facilitators and funders under the controls described above;
• professional advisers, auditors, insurers and contractors subject to confidentiality;
• regulators, courts, law-enforcement bodies or other persons where disclosure is legally required or necessary to protect lawful rights; and
• a lawful successor or restructuring participant, subject to appropriate confidentiality and data-protection safeguards.

AFC does not sell personal data. AFC will not permit a service provider to use personal data for unrelated independent marketing merely because it provides a service to AFC.

AFC operates across Africa and may use service providers or programme partners located outside Nigeria. Where personal data is transferred internationally, AFC will assess the destination and use a transfer basis and safeguards required by applicable law, which may include an adequacy decision, approved contractual clauses, binding arrangements, explicit consent in limited circumstances or another lawful derogation.

You may contact AFC for information about the safeguard used for a relevant transfer, subject to lawful confidentiality restrictions.

AFC retains personal data only for as long as reasonably necessary for the stated purpose, legal obligations, dispute management and the establishment or defence of claims. Unless a programme notice or law requires a different period, AFC applies the following working periods:

At the end of the applicable period, AFC will delete, anonymise or securely isolate the information unless continued retention is lawful and necessary.

AFC uses organisational and technical safeguards appropriate to the nature and risk of the processing, including access controls, service-provider due diligence, secure transmission where appropriate, backups, monitoring, staff confidentiality and incident-response procedures.

All user passwords and keys are encrypted and inaccessible to the public including internal staffs. Our servers automatically runs daily backup to ensure high availability to prevent data loss.

AFC will investigate suspected personal-data breaches and notify the Nigeria Data Protection Commission and affected individuals where required by law. You should report suspected account or data compromise promptly.

Subject to applicable conditions and exemptions, you may have the right to:

• obtain confirmation that AFC processes your personal data and request access;
• correct inaccurate or incomplete personal data;
• request deletion, restriction or cessation of processing in appropriate circumstances;
• receive qualifying data in a structured, commonly used and machine-readable format and request portability where applicable;
• object to processing based on legitimate interests and object at any time to direct marketing;
• withdraw consent at any time without affecting processing already lawfully carried out;
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, except where law permits it with appropriate safeguards; and
• complain to the Nigeria Data Protection Commission or another competent authority.

To exercise a right, contact [email protected]. AFC may request proportionate information to verify identity and protect the account. AFC will respond within the period required by applicable law and will explain any lawful refusal, fee or extension and the available complaint route.

AFC may introduce business-diagnostic or recommendation tools. Before using a diagnostic to make a solely automated decision with legal or similarly significant effects, AFC will complete the required risk assessment, explain the principal logic and significance, provide a route to correct underlying data and enable human review where required.

Routine scoring used only to recommend learning resources will be described at the point of use, including the inputs, audience and whether a human reviews the result. AFC will not activate undisclosed marketplace, credit, eligibility or profiling uses through this general Policy.

AFC Hub accounts and paid programmes are intended for persons aged 18 or over unless AFC expressly offers a youth programme. For an approved youth programme, AFC will provide age-appropriate information and obtain parent, guardian or institutional authorisation where required. AFC will not knowingly use a child’s data for behavioural advertising.

Programme administration and payment messages are service communications and may be necessary to fulfil the transaction. Optional newsletters and promotions are managed separately. You may opt out using the unsubscribe method in the message or by contacting AFC. Opting out of marketing will not stop necessary service, security or legal communications.

AFC may update this Policy to reflect changes in law, technology or services. The current version and effective date will be published on AFC Hub. AFC will provide reasonable notice of material changes and will seek consent where a new processing purpose requires it. Continued use will not be treated as consent where the law requires a specific affirmative choice.

Please contact AFC first so we can investigate and respond. If you are dissatisfied, you may complain to the Nigeria Data Protection Commission through its published channels or seek another lawful remedy.

Contact details