Privacy Policy
Effective date: 13 June 2026
1. Who we are
ExJAM Humanitarian Foundation ("ExJAM", "we", "our") is a Nigerian non-profit organisation registered under the Companies and Allied Matters Act. Our registered address is Nigeria, and we operate the portal at portal.exjamfoundation.org (the "Portal") and the public website at exjamfoundation.org (together, the "Services").
ExJAM is the data controller for personal data collected through the Services. Questions or requests relating to this policy should be directed to privacy@exjamfoundation.org.
2. Data we collect
| Category | Examples | Source |
|---|---|---|
| Identity | Full name, date of birth, gender | Provided by you at registration |
| Contact | Email address, phone number, postal address | Provided by you |
| Financial | Donation amounts, payment processor reference, bank account details for disbursements | You and our payment processors (Paystack, Stripe) |
| Medical case data | Patient alias, diagnosis category, treatment cost estimate | Provided by case applicants. Treated as sensitive. |
| Identity documents | Government-issued ID, medical certificates uploaded to support cases | Provided by case applicants |
| Usage / technical | IP address, browser type, pages visited, session duration | Automatically collected |
| Communications | Messages sent via the Portal, email correspondence | Provided by you |
3. Lawful basis for processing (GDPR Articles 6 & 13)
Where the General Data Protection Regulation (UK GDPR / EU GDPR) applies, for example when processing data of individuals located in the United Kingdom, European Economic Area, or where UK/EU law otherwise has effect, we rely on the following lawful bases:
Contract performance (Article 6(1)(b))
Processing your name, contact details, case information, and payment data to administer your membership, process medical case applications, process approved disbursements, and provide receipts.
Legitimate interests (Article 6(1)(f))
Analytics to understand how the Portal is used and improve its quality; fraud prevention; security monitoring; and internal audit. Our interests in operating a safe, effective humanitarian service do not override your rights. You may object to this processing at any time.
Legal obligation (Article 6(1)(c))
Retaining financial records to comply with applicable tax and accounting law.
Vital interests (Article 6(1)(d))
In exceptional circumstances, processing medical case data to protect the vital interests of the patient named in a case.
Explicit consent (Article 9(2)(a))
Processing sensitive data categories (medical case data, identity documents) on the basis of the explicit consent you provide when submitting a case or uploading documents.
For Nigerian residents, processing is also governed by the Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act (NDPA) 2023. We process your data lawfully, fairly, and transparently in accordance with those instruments.
4. How we use your data
- Create and manage your ExJAM portal account
- Process medical case applications and coordinate board approvals
- Disburse approved funds to case recipients
- Process and receipt charitable donations
- Send transactional emails (case status updates, donation receipts, security alerts)
- Send marketing/newsletter emails, only where you have opted in or where we rely on legitimate interests for existing members
- Detect and prevent fraud, abuse, and unauthorised access
- Comply with legal obligations and respond to lawful requests
- Improve portal performance and user experience (analytics)
5. Data processors & international data transfers
We share your data only with trusted processors who provide contractual guarantees consistent with applicable data protection law. Data processed by these services may be transferred outside Nigeria and the UK/EU/EEA:
| Processor | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | United States (East US) |
| Stripe | International card payment processing (USD) | United States |
| Paystack | Nigerian payment processing (NGN) | Nigeria / United States |
| Resend | Transactional email delivery | United States |
| PostHog | Product analytics (anonymised usage data) | United States / EU |
| Vercel | Web hosting and edge delivery | United States / global edge |
Where data is transferred outside the UK/EEA to countries not deemed adequate by the UK/EU Commission, we rely on Standard Contractual Clauses (SCCs) or equivalent mechanisms. Where data is transferred outside Nigeria, we ensure appropriate safeguards exist in accordance with NDPA Section 43.
6. International privacy addendum
United Kingdom residents
The UK GDPR and Data Protection Act 2018 apply to your data. Your rights include access, rectification, erasure, restriction, portability, and objection. You may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. We rely on SCCs (UK International Data Transfer Agreements) for transfers outside the UK.
European Economic Area residents
The EU GDPR applies. You may lodge a complaint with the supervisory authority in your member state. We rely on EU SCCs (2021) for transfers to countries without an adequacy decision. Our processing of your data is governed by the lawful bases set out in Section 3.
United States residents
If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) may apply. You have the right to know what personal information we collect, to delete it, to opt out of its sale (we do not sell personal information), and to non-discrimination for exercising these rights. To exercise California rights, contact dpo@exjamfoundation.org.
Canadian residents
The Personal Information Protection and Electronic Documents Act (PIPEDA) applies. You have the right to access your personal information and to challenge its accuracy. Contact dpo@exjamfoundation.org to exercise these rights or to lodge a complaint with the Office of the Privacy Commissioner of Canada.
7. Your rights
Subject to applicable law, you have the following rights regarding your personal data:
- Access: obtain a copy of the personal data we hold about you
- Rectification: correct inaccurate or incomplete data
- Erasure: request deletion of your data (subject to legal retention obligations)
- Restriction: ask us to pause processing while a dispute is resolved
- Portability: receive your data in a machine-readable format
- Objection: object to processing based on legitimate interests
- Withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior lawful processing
To exercise any right, email dpo@exjamfoundation.org. We will respond within 30 days. We may ask you to verify your identity before processing a request.
To delete your portal account, email privacy@exjamfoundation.org with the subject line "Account deletion request". We will remove your profile and personal data within 30 days, except where retention is required by law (e.g. donation records for tax purposes are retained for 7 years).
8. Data retention
- Member profile data: retained while your account is active; deleted within 30 days of an erasure request unless legal retention applies
- Case documents: retained for 7 years from case closure for audit and legal purposes
- Donation and financial records: retained for 7 years to comply with financial reporting requirements
- Security audit logs: retained for 2 years
- Analytics data: retained for 12 months in identifiable form, then anonymised
9. Cookies
| Cookie | Type | Purpose |
|---|---|---|
| sb-* | Strictly necessary | Supabase authentication session: required to keep you signed in |
| exjam_cookie_consent | Strictly necessary | Stores your cookie consent preference for 12 months |
| ph_* | Analytics (optional) | PostHog product analytics: tracks page views and feature usage to improve the portal |
| _vercel_* | Analytics (optional) | Vercel web analytics: anonymised performance metrics |
You may withdraw consent for analytics cookies at any time by clicking "Decline optional" in the cookie banner, or by clearing your cookies and re-visiting the site. Strictly necessary cookies cannot be disabled without breaking core functionality.
10. Security
We protect your data using industry-standard controls: TLS in transit, AES-256 encryption at rest via Supabase, row-level security policies, role-based access control, and multi-factor authentication for staff accounts. Case documents are stored in private, access-controlled object storage. Despite these measures, no internet transmission is entirely secure. We cannot guarantee absolute security.
11. Children
The Portal is not directed at children under 18. We do not knowingly collect personal data from children. Medical cases may involve minors as patients, but all applications must be submitted by an adult guardian. If you believe we hold data about a child without guardian consent, contact privacy@exjamfoundation.org.
12. Changes to this policy
We may update this policy from time to time. Material changes will be communicated by email to registered members at least 14 days before they take effect. The effective date at the top of this page will always reflect the current version.
13. Contact & complaints
General privacy queries: privacy@exjamfoundation.org
Data subject rights & DPO: dpo@exjamfoundation.org
If you are unhappy with our response, Nigerian residents may contact the Nigeria Data Protection Commission (NDPC). UK residents may contact the ICO (ico.org.uk). EU residents may contact their local supervisory authority.