Privacy Policy & NDPR Notice

1. Who We Are

The Great Achievers Club (TGAC) is a community-focused organisation dedicated to celebrating achievement and driving humanitarian causes for the Adamo community and beyond. This Privacy Policy explains how we collect, use, store, and protect personal data submitted through the AGM Celebration & Fundraising Event Registration Portal at tgac.online.

2. Legal & Regulatory Basis

This policy complies with:

• The Nigeria Data Protection Regulation (NDPR) 2019, as amended;
• The Nigeria Data Protection Act (NDPA) 2023;
• Guidelines issued by the Nigeria Data Protection Commission (NDPC);
• Internationally recognised data protection principles including lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.

3. Data We Collect

When you register for a TGAC event, we collect only the information necessary for event administration:

• Identity: first name, last name, gender.
• Contact: email address, phone number, WhatsApp number (optional).
• Location: State and Local Government Area (LGA).
• Professional context (optional): occupation, organisation.
• Event preferences: attendee category, number of accompanying guests, referral source, special requirements or dietary needs, additional messages.
• Technical metadata: IP address, browser type, timestamps (for security, abuse prevention, and audit purposes only).

4. How We Use Your Data

• To verify, review, and process your event registration.
• To dispatch the official event confirmation email upon administrative acceptance.
• To maintain a private accreditation register accessible only to authorised TGAC event administrators.
• To compile anonymised statistics on event attendance for reporting and future planning.
• To detect and prevent fraudulent, malicious, or abusive activity against the portal.

We do not use your data for marketing, profiling, automated decision-making with legal effects, sale to third parties, or any purpose incompatible with the ones above without your explicit further consent.

5. Data Sharing & Disclosure

Your data is accessible only to:

• Authorised TGAC event administrators.
• Our infrastructure processors (Supabase for database hosting; Vercel for application hosting; Resend for transactional email delivery), each of whom is contractually bound to comply with equivalent data protection standards.
• Law enforcement or regulatory authorities, only when required by valid legal process.

Your data is never sold, rented, or shared with third parties for commercial purposes.

6. Security Measures

• All data transmissions are encrypted in transit using TLS 1.2 or higher.
• Databases are stored on encrypted, access-controlled infrastructure hosted in the European Union (Ireland region).
• Administrative access is protected by strong password hashing (bcrypt), JWT-based sessions with strict same-site cookies, and IP-based rate limiting and brute-force protection.
• All administrative actions (accept, reject, edit, login attempts) are recorded in a tamper-evident audit trail.
• Modern web-security headers are enforced site-wide: HSTS, Content Security Policy, X-Frame-Options, and Permissions Policy.
• Suspicious payloads, known scanning tools, and abusive request patterns are automatically blocked at the edge.

7. Data Retention

Registration data is retained for a maximum of twelve (12) months after the event date, after which the record is either securely and permanently deleted or fully anonymised for historical reporting purposes only.

8. Your Rights Under NDPR / NDPA

As a data subject you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete personal data.
• Erasure (“right to be forgotten”) of your data, subject to legal retention obligations.
• Restrict or object to certain processing activities.
• Data portability — receive a copy of your data in a machine-readable format.
• Withdraw consent at any time (this will cancel your event registration).
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC).

To exercise any of these rights, contact us at privacy@tgac.online — we will respond within 30 days.

9. Cookies

This site sets only strictly necessary cookies required for session management (the authenticated admin session cookie tgag_admin_token). We do not use tracking, analytics, or advertising cookies.

10. Data Breach Notification

In the unlikely event of a personal-data breach, we will notify the Nigeria Data Protection Commission (NDPC) within 72 hours and, where the breach poses a high risk to your rights and freedoms, we will notify affected data subjects directly and without undue delay, in line with NDPR/NDPA obligations.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The current version, along with the “Last updated” date, will always be available at tgac.online/privacy. Material changes will be brought to your attention prior to submission of any new personal data.

12. Contact the Data Controller