Privacy notice

1. Who is responsible for your data

the company that runs Goodzera runs Goodzera and is the data controller for the personal data described in this notice, under the Nigeria Data Protection Act 2023 (NDPA) and the guidance of the Nigeria Data Protection Commission (NDPC).

For anything about your personal data, email our data protection contact at our support page.

Each NGO that receives your details is a separate, independent controller for what it receives and is responsible for how it uses them. This notice covers the Goodzera platform only. For how an NGO uses your details, read that NGO’s own privacy notice or contact it.

2. What we collect

When you give

The email address for your receipt, your name if you give one, each gift’s amount, NGO and campaign, the processing fee and total, the payment reference and status, and when it happened. We also record your choices: whether to hide your name publicly, whether to show your gift amount, and, for each NGO, whether it may contact you.

From the payment provider

Confirmation that the payment succeeded, failed or was refunded, the amounts and fees, and settlement details. We do not receive your full card number, PIN or one-time password.

If you create an account

Your email address, name and sign-in details, the NGOs you follow, and the link between your account and gifts made with your verified email address.

Email preferences

If you unsubscribe from an NGO’s updates, or from all updates, we record that choice so we keep honouring it.

Reports

If you report a post, the reason you give and, if you are signed in, your account identifier.

Security and abuse prevention

Your IP address, used in scrambled (hashed) form to apply rate limits, a bot-protection check at checkout, and the technical data in our hosting provider’s logs.

Support requests

What you tell us when you contact support.

We do not use advertising or analytics cookies, and we do not sell personal data.

3. How we use it, and our lawful bases

The NDPA requires a lawful basis for each use of personal data. Ours are:

We do not make decisions about you that have legal or similarly significant effects based only on automated processing. Trust ratings are about NGOs, not individuals.

4. Who receives your details

• The NGOs you give to. Each NGO you give to receives your name, email and the details of your gift to it. If your basket includes several NGOs, each one receives them. This happens whatever contact choice you make, because the NGO must keep donor records. Your contact choice decides whether it may also contact you about its work.
• Authorized Goodzera staff, for operations, support, refunds, verification and compliance.
• Service providers who process data for us under contract (see section 7).
• Authorities and others where the law requires, for example the Special Control Unit against Money Laundering (SCUML), the Nigerian Financial Intelligence Unit, tax authorities, regulators, courts or the police, and banks or the payment provider when handling a dispute.
• Professional advisers, such as lawyers and auditors, under duties of confidentiality.
• A successor, if Goodzera is reorganized or transferred, under the same protections as this notice.

5. What appears publicly

A campaign’s supporter list shows recent gifts with the donor’s name, or “Anonymous” when the donor hid their name. The gift amount is shown only if the donor allowed it. Nothing else about donors is public. Some NGO updates are for supporters only and are not shown to the public.

6. Emails from Goodzera and NGOs

• Receipts are sent for every confirmed gift. They are part of the service and are not marketing.
• Update emails. When an NGO publishes updates, we email people who gave to it in the last 24 months and allowed it to contact them. We send at most one email per NGO per day. Updates for supporters only are not copied into the email; the email links to them.
• Unsubscribing. Every update email has a one-click unsubscribe link for that NGO, and one for all NGOs. Unsubscribing does not affect receipts.

7. Service providers

We use these providers to run Goodzera. They process personal data on our instructions and under contracts that require them to protect it. The payment provider is also a regulated institution with its own legal obligations for payment records.

8. Transfers outside Nigeria

Several of these providers (Clerk, Supabase, Vercel, Inngest, Resend and Cloudflare) store or process data outside Nigeria. Under Part VIII of the NDPA, we transfer personal data abroad only where the destination provides an adequate level of protection or where another lawful basis applies, such as appropriate safeguards in our contracts with the provider, or where the transfer is necessary to perform our contract with you. You can ask us for more information about these safeguards using the contact details below.

9. How long we keep data

• Gift and identity records (your name and email on confirmed gifts, receipts and accounting entries) are kept for as long as Nigerian anti-money-laundering, tax and accounting laws require. Financial records are kept unchanged so accounts and audits stay accurate.
• Unfinished payment attempts are kept while a payment may still be confirmed, and then as part of the payment record.
• Account data, follows and the link to your giving history are kept until you delete them on your data page or ask us to.
• Unsubscribe choices are kept so we never email you again. If you delete your data, we keep only a scrambled fingerprint (hash) of your email address for this purpose, not the address itself.
• Security logs and audit records are kept for as long as needed to protect the platform and meet our legal obligations.

10. Your rights

Under the NDPA you have the right to:

• be informed about how your data is used (this notice);
• get a copy of your data, and receive it in a structured, machine-readable format;
• have inaccurate data corrected;
• have data deleted where we no longer need it or have no legal reason to keep it;
• restrict or object to some uses, including use based on our legitimate interests;
• withdraw consent at any time, without affecting what was done before;
• complain to the Nigeria Data Protection Commission.

Download or delete your data yourself. Signed in, go to your data page. “Download my data” gives you a file of your gifts, your contact choice for each, and the NGOs you follow. “Delete my data” removes the NGOs you follow and the link between your account and your giving history, and turns your email into a hash-only “do not email” record. We then tell you exactly what we must keep and why, such as your name and email on confirmed gifts, which anti-money-laundering rules require.

For any other request, contact our support page. We may need to confirm your identity first. We respond without undue delay and within the time the NDPA allows. Because each NGO is its own controller, ask the NGO directly about data it holds; we will help where we can.

11. Cookies and browser storage

We use only what Goodzera needs to work. We do not use advertising or analytics cookies.

12. Security

We protect data with encryption in transit, strict access controls that keep each NGO’s data separate, private storage for documents with short-lived links, and audit records of sensitive actions. No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will notify the NDPC within 72 hours as the NDPA requires, and tell you without undue delay where the law requires it.

13. NGO members and documents

If you work for an NGO on Goodzera, we process your name, email, role and the documents your NGO uploads, such as registration certificates, representative identification and bank evidence. These documents are private: only authorized members of your NGO and Goodzera reviewers can see them, unless your NGO chooses to publish a document such as audited accounts. Board member names and roles appear on the public profile only if your NGO publishes them. We use this data to verify the NGO, rate it from the evidence, pay out gifts and meet our legal obligations.

14. Children

Goodzera is not directed at children under 18, and we do not knowingly collect their data without a parent’s or guardian’s consent. If you think a child has given us personal data, contact us and we will deal with it.

15. Changes to this notice

We update this notice when our practices or the law change. The version and dates at the top show which notice applies. For significant changes we will give notice on Goodzera before they take effect.

16. Contact and complaints

Email our support page or use the support page. If you are not satisfied with our answer, you can complain to the Nigeria Data Protection Commission (NDPC).