Privacy Policy

1. Information We Collect

We collect the following types of personal data:

• Account Information: Name, email address, age, institution/school (if provided), username, password (hashed), and profile details.
• Activity Data: Quiz participation records, answers, scores, leaderboard positions, reward redemptions (including cash prize claims and data bundle requests).
• Device and Usage Data: IP address, browser type/version, device type, operating system, approximate location (derived from IP if permitted), pages visited, time spent, referral sources, and interaction logs.
• Payment/Redemption Data: Bank account details or mobile money information (only if you claim cash prizes; processed securely via third-party payment providers).

We do not collect sensitive personal data (e.g., health, religion, ethnicity) unless voluntarily provided in quiz responses (which we do not store in identifiable form).

2. How We Use Your Information and Lawful Basis

We process your personal data for the following purposes and on these lawful bases under the NDPA:

• To provide and operate the platform, personalize quizzes, manage leaderboards, and deliver rewards (lawful basis: performance of a contract / your request to participate).
• To communicate important updates, prize announcements, or service notices (lawful basis: performance of contract or legitimate interests).
• To improve the platform, analyze trends, prevent fraud, and ensure security (lawful basis: legitimate interests, balanced against your rights).
• To comply with legal obligations, e.g., tax reporting on prizes over certain thresholds (lawful basis: legal obligation).
• To send marketing communications (e.g., new features, promotions) only with your explicit consent (lawful basis: consent — you can withdraw anytime).

We do not use your data for automated decisions with significant legal effects.

3. Sharing of Information

We do not sell your personal data to third parties.

We may share data with:

• Service providers (e.g., hosting like Vercel, analytics tools, payment processors like Paystack/Flutterwave) who act as processors under strict confidentiality agreements.
• Legal authorities if required by law, court order, or to protect our rights/safety.
• Partners only with your consent (e.g., for sponsored rewards).

4. Cookies & Tracking Technologies

We use cookies and similar technologies for essential functions (login, session management), analytics (usage patterns), and performance. Non-essential cookies — including those used by advertising partners such as Google AdSense — require your consent via our cookie banner. Google AdSense may use cookies to serve ads based on your prior visits to our site or other sites. You can manage preferences in your browser or our consent tool, or opt out of personalised advertising at www.aboutads.info.

5. Data Retention

We keep your personal data only as long as necessary:

• Account and profile data: While your account is active, plus up to 12 months after deletion (for legal/audit purposes).
• Activity and quiz data: Up to 24 months (for leaderboards, disputes, or platform improvement).
• Redemption/payment data: As required by financial/tax laws (typically 6–7 years).

After these periods, data is anonymized or securely deleted.

6. Children's Privacy

Our platform is not intended for children under 13 years old. We do not knowingly collect data from children under 13. For users aged 13–17, we require verifiable parental or guardian consent before processing personal data. Parents/guardians may contact us at any time to access, correct, or delete their child's information.

7. Your Rights as a Data Subject

Under the NDPA, you have the following rights (free of charge, once per year):

• Access your personal data.
• Rectify inaccurate or incomplete data.
• Erase your data (right to be forgotten, subject to legal exceptions).
• Restrict processing.
• Data portability (receive your data in a structured format).
• Object to processing (e.g., for marketing).
• Withdraw consent at any time (where consent is the basis).

To exercise any right, email admin@zestinitiative.org with your request. We will respond within 30 days (extendable by 60 days for complex cases). If unsatisfied, you may complain to the Nigeria Data Protection Commission (NDPC) at complaints@ndpc.gov.ng.

8. Data Security

We use technical and organizational measures (e.g., encryption, access controls, regular audits) to protect your data. However, no system is 100% secure. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the NDPC within 72 hours (where feasible) and affected users without undue delay if high risk exists.

9. Cross-Border Data Transfers

Some of our service providers (e.g., hosting, analytics) are located outside Nigeria (e.g., US, EU). We ensure such transfers are protected by appropriate safeguards, such as standard contractual clauses or other mechanisms approved under the NDPA.

10. Changes to This Policy

We may update this policy to reflect changes in practices or law. We will post the revised version here with a new effective date. For major changes, we will notify you via email, in-app notice, or platform announcement. Continued use after changes constitutes acceptance.

11. Contact Us

For privacy questions, rights requests, or complaints, email us at: admin@zestinitiative.org

We are happy to assist. Thank you for trusting Zest Initiative with your data!