1. Who we are
FESAC Charity Foundation (“FESAC”, “we”) is a charity foundation incorporated in Nigeria (CAC 192992) with teams in Canada and Nigeria. We are responsible for the personal information described in this policy.
Privacy contact: our Privacy Officer can be reached at info@fesaccharityfoundation.com (subject “Privacy”), or by post at either office:
- Canada: 2 13678 100 Ave, Surrey, BC V3T 0V3, Canada
- Nigeria: 64 Ahamadu Ahijio Road, Narayi High Cost, Kaduna, Nigeria
2. The laws we follow
Because we work across countries, we apply the highest of the following standards to everyone:
- Canada: British Columbia's Personal Information Protection Act (PIPA), which covers non-profit organisations in BC, and the federal Personal Information Protection and Electronic Documents Act (PIPEDA) where it applies. Our emails also follow Canada's Anti-Spam Legislation (CASL).
- Nigeria: the Nigeria Data Protection Act 2023 (NDPA), overseen by the Nigeria Data Protection Commission (NDPC).
- Elsewhere: if you live in the UK, EU or another region with privacy laws, you have the rights described in section 9.
3. What we collect and why
| When you… | We collect | Why, and our legal basis |
|---|---|---|
| Contact us | Name, email, topic, your message | To reply to you (consent / legitimate interest). |
| Register as a volunteer | Name, email, phone, location, interests, transport needs, age confirmation, availability, skills, how you heard of us; optionally a copy of your ID | To organise outreach, keep volunteers and beneficiaries safe and verify identity (consent; legitimate interest in safeguarding). |
| Subscribe to our newsletter | Email (and name if given), the date, time and wording of your consent | To send updates and appeals you asked for, and to prove your consent (express consent). |
| Donate | Name, email, amount, currency, frequency, programme chosen, and the payment reference. Your card or bank details go directly to Paystack or Stripe. | To process your gift, send receipts and keep accounting records (contract; legal obligation). |
| Browse the site | Technical data such as IP address, browser and pages requested, in server logs | To keep the site secure and working, and to prevent spam and abuse (legitimate interest). |
4. Identity documents and sensitive information
Uploading an ID when registering as a volunteer is optional. If you upload one, it is sent once, securely, to our volunteer coordinator. It is not stored on our website or published. We use it only to verify your identity and delete it within 30 days of verification. You can always show your ID in person instead.
We do not ask for health, religious or other sensitive information through this website. If you share it with us in a message, we use it only for the purpose you shared it for.
6. International transfers
Our teams are in Canada and Nigeria, and our service providers may process data in other countries, including the United States. When information leaves the country where you provided it, we use providers with strong security and contractual safeguards. Information held abroad may be subject to the laws of that country.
7. How long we keep it
- Messages: up to 2 years after our last contact.
- Volunteer records: while you volunteer with us, then up to 2 years.
- ID documents: deleted within 30 days of verification.
- Newsletter: until you unsubscribe. We keep a record of your consent and unsubscribe request to respect your choice.
- Donation records: as long as tax and accounting laws require, generally 6 to 7 years.
8. How we protect it
The site is served over encrypted HTTPS. Forms are validated and rate-limited to block abuse, and access to personal information is limited to the people who need it. No system is perfectly secure. If a breach affects your information and creates a real risk of harm, we will notify you and the relevant regulator as the law requires.
9. Your rights
You can ask us to:
- tell you what personal information we hold about you and give you a copy;
- correct information that is wrong or incomplete;
- delete your information, where we don't need to keep it by law;
- stop using it for a particular purpose, or withdraw consent you gave;
- move it to another organisation, where the law provides this right.
Email info@fesaccharityfoundation.com. We respond within 30 days and may need to confirm your identity first. Withdrawing consent doesn't affect anything we did before.
If you're not satisfied with our answer, you can complain to a regulator:
- Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca)
- Office of the Privacy Commissioner of Canada (priv.gc.ca)
- Nigeria Data Protection Commission (ndpc.gov.ng)
10. Children
This website is not directed at children, and we don't knowingly collect personal information online from anyone under 13. Volunteers under 18 need written consent from a parent or guardian. Photos of children in our programmes are published only with consent, as set out in our safeguarding policy.
12. Changes to this policy
We'll update this page when our practices change and revise the date at the top. If a change is significant, we'll highlight it on the website or email the people affected.
This policy is written in plain language to be clear and honest. It is not a substitute for legal advice and will be reviewed as FESAC grows.