This Data Protection Policy sets out how Covenant and Light Chapel (“CLC”, “the Church”, “we”) handles personal data in compliance with the Nigeria Data Protection Act, 2023 (NDPA), the Nigeria Data Protection Regulation, 2019 (NDPR), and the guidance of the Nigeria Data Protection Commission (NDPC). It complements our Privacy Policy.
1. Our commitment
We are committed to processing personal data lawfully, fairly, and transparently, and to upholding the rights of every data subject. Personal data is treated as a trust placed in our care.
2. Data protection principles
In all our processing, we observe the following principles. Personal data shall be:
- processed lawfully, fairly, and in a transparent manner;
- collected for specified, explicit, and legitimate purposes;
- adequate, relevant, and limited to what is necessary;
- accurate and, where necessary, kept up to date;
- retained no longer than is necessary;
- processed securely, protecting against unauthorised access, loss, destruction, or damage;
- handled by persons who owe a duty of care to the data subject.
3. Lawful basis for processing
We process personal data only where at least one lawful basis applies:
- Consent — you have given clear consent for a specific purpose;
- Contract / service — processing is necessary to deliver a service you requested;
- Legal obligation — processing is required to comply with the law;
- Vital interest — to protect someone’s life;
- Legitimate interest — for the legitimate purposes of the Church as a religious organisation, balanced against your rights.
4. Consent
Where we rely on consent, it is sought clearly and separately from other terms, and you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
5. Your rights as a data subject
Under the NDPA and NDPR, you have the right to:
- be informed about how your data is used;
- request access to the personal data we hold about you;
- request correction of inaccurate or incomplete data;
- request deletion of your data (“right to be forgotten”) where applicable;
- object to, or request restriction of, certain processing;
- request portability of data you provided to us;
- withdraw consent at any time;
- lodge a complaint with the Nigeria Data Protection Commission (NDPC).
We will respond to verified requests within the timeframe required by law (and in any case without undue delay).
6. How we protect your data
- encryption of data in transit using secure (HTTPS/TLS) connections;
- role-based access controls limiting who can view personal data;
- restricted, audited administrative access;
- use of reputable, compliant hosting and service providers;
- regular review of our security and data-handling practices.
7. Third parties and data processors
Where we engage third parties to process data on our behalf (for example, payment processors, SMS/verification providers, hosting and email services), we do so under agreements that require them to protect personal data and to process it only on our instructions and in line with applicable law.
8. Cross-border transfers
Some of our service providers may process data outside Nigeria. Where this happens, we take reasonable steps to ensure your data continues to receive an adequate level of protection consistent with the NDPA and NDPR.
9. Data breach management
We maintain procedures to detect, report, and investigate personal-data breaches. Where a breach is likely to result in a risk to your rights and freedoms, we will notify the NDPC and affected individuals as required by law.
10. Data retention
We retain personal data only for as long as necessary to fulfil the purpose for which it was collected or to meet legal requirements, after which it is securely deleted or anonymised.
11. Data Protection contact
To exercise any of your rights, raise a concern, or ask a question about how we handle your data, contact our data protection point of contact at covenantandlightchapel@gmail.com or +234 803 484 9917. You also have the right to contact the Nigeria Data Protection Commission (NDPC) directly.
12. Review
This policy is reviewed periodically and updated to reflect changes in our practices or the law. The “Last updated” date above reflects the most recent revision.