This notice explains how Sickle Cell Foundation of Nigeria (SCFN) handles information through this website and its donation services. It is intended to address the Nigeria Data Protection Act 2023 and applicable Nigeria Data Protection Regulation (NDPR) requirements. It does not replace a separate notice for clinical services or research participation.
1. Who is responsible and how to contact us
SCFN is responsible for its website and donor records. For privacy requests, contact info@sicklecellfoundation.com, National Sickle Cell Centre, Ishaga Road, Idi-Araba, Surulere, Lagos, Nigeria.
2. Information we collect
- Donor name, email, public anonymity preference and optional contact permission.
- Donation amount, currency, frequency, campaign, payment status, references and dates.
- Limited provider verification results, payment channel and subscription or authorisation identifiers needed to administer recurring donations.
- Newsletter details and information you choose to send through enquiries or participation forms.
- Session identifiers, security and diagnostic records, and technical information needed to operate the website.
Public anonymity does not make a donation anonymous to SCFN or its payment provider. Do not enter medical records or card credentials in donation names or messages.
3. Why we use information
We use information to process and reconcile donations, maintain accounts, administer recurring payments, communicate about payments, respond to requests, prevent fraud and secure the website. These activities may rely on fulfilling your donation instructions, legal obligations and legitimate interests, as applicable. Optional news and fundraising updates rely on your choice to receive them; you can withdraw that permission without affecting an earlier lawful use.
4. Payment and card data protection
Card entry takes place on Flutterwave’s or Paystack’s hosted checkout. SCFN’s donation form does not collect full card numbers, PINs, security codes or one-time passwords. Providers process payment information under their own notices and applicable card-data protection standards, including PCI DSS. We retain limited transaction and subscription identifiers; we do not claim that no payment information is stored.
Provider webhook records are restricted to information needed by payment handlers. They are scheduled for removal after 30 days; this does not remove the separate financial ledger. Older records may contain additional provider metadata until that cleanup runs. Backups and security records may follow separate retention requirements.
5. Service providers, disclosures and transfers
We use Flutterwave and Paystack for payments, Railway for application hosting, databases, queues and uploaded media, Netlify for static content delivery, Resend for email, and MailerLite for newsletter subscriptions where configured. Providers may process information outside Nigeria. For information about the processing locations and transfer safeguards applicable to your information, contact SCFN using the privacy contact above.
We may share necessary information with authorised service providers or where required by law. Public campaign displays may show your name unless you choose anonymity. Choosing optional donation updates does not by itself subscribe you to a separate newsletter service.
6. Cookies and browser storage
Essential session and security cookies support the website and authenticated areas. Browser session storage remembers an unfinished donation’s amount, currency, frequency, name, email and choices within the current tab. The draft is cleared after the donation flow completes or resets; closing the browser session normally clears session storage. Payment providers use their own cookies on hosted checkout.
7. Retention and security
Financial, donor and subscription records are kept for as long as needed for accounting, legal, reconciliation and support purposes. Retention depends on the type of record and applicable legal obligations. Contact SCFN for information about your records. Withdrawal of marketing consent does not automatically erase records needed for these purposes.
We restrict administrative access and use encrypted connections for payment and website communications. No system can guarantee complete security. Any applicable breach assessment and notification duties remain governed by law.
8. Your choices and rights
Subject to applicable law, you may request access, correction, erasure, restriction or portability of your personal information, object to processing, and withdraw consent. Contact the privacy address above; we may need proportionate information to verify your identity. Please do not send card credentials. Some requests may be limited by legal record-keeping duties.
You may also raise a concern with the Nigeria Data Protection Commission.
9. Children and changes to this notice
Children should use donation services with a parent or guardian’s involvement. Contact SCFN if you believe a child’s information has been supplied without appropriate authority. Changes to this notice should be published with their effective date and explained where required.