SWW Privacy Policy

Your personal data will be:

• processed and collected for specific, explicit, and legitimate purposes and only further processed in a way that is compatible with such purposes;

• processed adequately, accurately, and without prejudice to the dignity of the human person;

• stored only for the period within which it is reasonably needed and legally permissible; and

• Secured against all foreseeable hazards and breaches such as theft, cyberattack, viral attack, dissemination, manipulation of any kind, or damage.
  
  

We may, in certain instances, rely on your consent to process some of the Personal Data we obtain from you to provide our services. Consent is your confirmation or agreement to our data collection and processing request. Consent may be obtained through the use of “check boxes”, “accept buttons”, “toggle buttons”, “submit buttons”, “oral confirmation”, “written confirmation”, or such other similar methods, including your continuous use of our services and/or provision of your Personal Data to us where consent is required, to indicate your agreement/consent to the use of your Personal Data.

You agree that upon granting us your consent, you have the legal capacity to give consent, are aware of your privacy rights, and have the option to withdraw your consent at any given time.

Where we need your consent, and this is not provided to us, we may be unable to provide you with (a) Our Services; and/or (b) process your Personal Data to provide you with Our Services, except where we have other legal bases to do so. Where this is the case, we will advise you accordingly at the time you withdraw your consent.

We may process your personal data on more than one lawful ground depending on the specific purpose for which we are using your personal data. Kindly contact us if you need further details or clarity about the specific legal ground. We are relying on processing your personal data where more than one ground has been stated. We will rely on any of the legal bases listed below, depending on the processing activities: We will ask you for your consent in certain processing activities that involve sensitive personal data or marketing mailing. Where we obtain your consent, kindly note that you can withdraw the consent at any time, and we will comply. The legal bases include:

• Contract: to fulfil the terms of the contract to which you are a party or to take steps prior to entering a contract;

• Legal Obligation: to comply with applicable laws and regulations;

• Legitimate Interest: where we have carried out a Legitimate Interest Assessment and determined the processing does not override your rights and freedoms;

• Vital Interest: to protect your vital interests or those of another person;

• Public Interest: for the performance of a task carried out in the public interest or in the exercise of official authority.

We may collect, use, store and transfer different kinds of personal data about you, which we have grouped as follows:

• Identity Data: includes name, username, marital status, ID card details, date of birth, gender, professional background, tax status, and job title.

• Contact Data: includes home address, country of residence, billing address, delivery address, email address, and telephone numbers.

• Financial Data: includes bank account, payment card details, bank statement, and income details.

• Contract or Business Data: includes information collected in the course of legal service or contractual or client relationships.

• Technical Data: includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.

• Communication Data: includes your name, contact details, means, place and time of communication and its content.

• Other Data: we may collect data from you to be processed in relation to administrative or judicial proceedings.

• Sensitive Personal Data: religious or other beliefs, sexual orientation, health, race, ethnicity, political views, trade union membership, or criminal records.We process these in the course of providing services to you or when complying with law. The law requires us to obtain your express consent when protecting our sensitive personal data
  
  

If you provide us with personal data about any other individual (e.g., emergency contacts, family members, or referees), you warrant that you have:

• informed them of their data’s intended use by She Writes Woman in accordance with this Privacy Policy; and

• obtained their prior, express consent to such disclosure.

You shall indemnify us against any claims arising from your failure to comply with this obligation.

We do not knowingly collect personal data directly from minors or individuals lacking the legal capacity to consent. Where services are to be provided to such individuals, we will collect the necessary information strictly through a parent or legal guardian, except in exceptional circumstances where processing is necessary to protect vital interests and consent cannot be obtained in a timely manner.

Where there is any suspected personal data breach, the data processor shall notify us upon becoming aware of a breach. We shall, within 72 hours of becoming aware of a breach which is likely to result in a risk to your rights and freedoms, notify the Nigeria Data Protection Commission (NDPC). Where the breach is likely to result in a high risk to your rights and freedoms, we shall immediately communicate the breach to you in plain and clear language.

We use cookies and other tracking technologies on some parts of our website.  Cookies make it easier for us to give you a better experience online. A cookie is a small piece of text that is saved on your Internet browser when you use our website. The cookie is sent back to our computer each time you visit our website. You can stop your browser from accepting cookies, but if you do, some parts of our website or online services may not work properly.

We will retain your personal data for as long as is required to provide our services to you and comply with our legal and statutory obligations or verify your information with the required verification authorities.

We are statutorily obliged to retain the personal data and data you provide to us to carry out our services and in compliance with laws and regulatory guidelines applicable to us and third parties. Therefore, even after the discontinuation of our services, we may retain certain personal data and transaction data to comply with legal and statutory obligations. Where no specific obligation applies, data shall be deleted or anonymised within six (6) months after the purpose of processing has been fulfilled

All personal data shall be destroyed by us where possible. For personal data and records obtained, used, and stored by us, we will carry out reviews of the data periodically to verify the accuracy, purpose, validity, and requirements to retain.

The length of storage of personal data shall, among other things, be determined by:

• the contract terms agreed between you and us, or the length of time it is needed for the purpose for which it was obtained; or

• whether the transaction or relationship has a statutory implication or a required retention period or;

• whether there is an express request for deletion of the personal data by you, provided that such request will only be treated where you are not under any investigation which may require us to retain your personal data, or there is no subsisting contractual arrangement with you that would require the processing of the personal data; and

• whether we have a lawful basis for retaining the data beyond the period for which it is necessary to serve the original purpose.

We collect personal data only for identified purposes, and where consent has been obtained, such personal data will not be reused for other purposes that are incompatible with the original purpose, except consent is obtained for such further purposes.

In some circumstances, we will anonymise your Personal Data so that it can no longer be associated with you for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

We hold your privacy rights very dear to our operations. Apart from the right to give, withhold or withdraw consent, you have rights to all relevant information that may guide you in making informed decisions about your personal data. For example, you have the right to be notified of anyone or any place to which we may transfer your personal data. Other rights are:

• Right to be Informed: This Privacy Policy details how we process your Personal Data in compliance with the Applicable Data Protection Law. 

• Right of Access to your personal information: This enables you to receive a copy of the Personal Data we hold about you and to check that we are lawfully processing it. To process your request, we may need to collect specific information from you as a security measure to help us confirm your identity and ensure that your Personal Data is not disclosed to any person who has no right to receive it. You will not be required to pay any fees for us to process your subject access request. However, we may charge a reasonable fee where processing your request will impose unreasonable costs on us or refuse to comply with your request if you fail to do so. We try to respond to all legitimate requests within one month. Occasionally, it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated. Where data is held electronically in a structured form, such as in a Database, you have a right to receive that data in a common electronic format.

• Right to Rectification of your personal information: this enables you to have any incomplete or inaccurate data we hold about you corrected, completed or updated, though we may need to verify the accuracy of the new data you provide to us.

• Right to Object to Processing of your personal information: You may object to the processing of your Personal Data where we are relying on a legitimate interest (or those of a third party) as the legal basis for that particular use of your data (including carrying out profiling based on our legitimate interests). In some cases, we may demonstrate that we have compelling legitimate interest or public interest grounds to continue to process your information, which override your right to object.

• Request the transfer of your Personal Data to you or to a third party: We will provide to you, or a third party you have chosen, your Personal Data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you

• Right to request erasure of your personal data: where there is no good reason for us continuing to process it: You have the right to ask us to delete or remove your Personal Data where 

1.  We no longer need to process your data for the purpose it was collected; 

2. You have withdrawn your consent to the processing of your Personal data, and we cannot rely on any other legal basis to process your Personal Data; 

3. You have successfully exercised your right to object to processing, and we have no overriding interests; 

4. We may have processed your information accidentally, or

5. where we are required to erase your Personal Data to comply with local law.

•  Right in Relation to automated decision-making (which essentially entitles you to human intervention). Note, however, that the exception to this right is:

1. where the Applicable Data Protection Law requires us to retain a historical archive of your Personal Data to fulfil regulatory requirements; or

2. where you object to your data being used for marketing purposes, and we have retained a set of your Personal Data to ensure we do not inadvertently contact you in future. We may not always be able to comply with your request for erasure for specific legal reasons. Where we are unable to do so, you will be notified, if applicable, at the time of your request.

• Right to lodge a complaint with the Commission: you have the right to make a complaint at any time to the Nigerian Data Protection Commission or approach a competent court of law to enforce your data protection rights. We would, however, appreciate the chance to deal with your concerns before you approach the NDPC, so please contact us in the first instance.

• Right to withdraw consent: There are types of personal data that are mandatory for us to process in order to carry out your instructions or perform our legal mandate for your benefit. If you withhold such information, it may be impracticable to carry out our mandate in relation to you. If you seek more clarification on our data processing, contact our designated Data Protection Officer. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

• Right to request to restrict the processing of your Personal Data: This enables you to ask us to suspend the processing of your Personal Data in one of the following scenarios:

1. If you want us to establish the data’s accuracy;

2. where our use of the Personal Data is accidental, but you do not want us to erase it;

3. where you need us to hold the Personal Data even if we no longer require it for any legitimate purpose; or

4. You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

We do not sell, trade, or rent personal data. However, to enable us to render our services to you, we may share your information with trusted third parties, such as cloud storage providers, IT support, health service providers, recruitment agencies, and regulators, as well as any third party where we have legal basis to do so. Your personal data may be stored in locations outside our direct control, for instance, on servers or databases co-located with host providers.

We may also disclose your personal data in compliance with applicable laws or legal obligations to which we are bound. Please note that third-parties’ websites you engage with through our services or website(s) will have their privacy policies, and we are therefore not responsible for their actions, including their information protection practices. The use of your data by such third parties will be subject to their applicable privacy policies, which you should carefully review.

We may share your information with law enforcement agencies, public or tax authorities or other regulatory authorities or organizations if we believe that such use is reasonably necessary to:

1. comply with a legal obligation, process, or request (including tax and related reporting requirements);

2. 2. enforce our Terms of Engagement and other agreements, policies, and standards, including investigation of any potential violation thereof;

3. detect, prevent, or otherwise address security, fraud, or technical issues; or

4. protect the rights, property or safety of us, our users, a third party or the public as required or permitted by law (including the exchange of information with external organizations and entities for the purposes of fraud prevention, legal compliance, and the mitigation of credit risk).

Where your personal data is to be transferred to a country outside Nigeria, we shall put adequate measures in place to ensure the security of such data. We shall, among other things, confirm whether the country is on the Nigeria Data Protection Commission (“NDPC”) Whitelist of Countries with adequate data protection laws and where the country may not have an adequate level of Data Protection, we will ensure that appropriate safeguards are in place to protect your Personal Data. Details of the protection given when your personal data is transferred outside Nigeria shall be provided to you upon request.

Transfer of personal data out of Nigeria would be in accordance with the provisions of the Nigeria Data Protection Act (“NDPA”) 2023 and other relevant data protection laws. We will only transfer personal data out of Nigeria on any of the following conditions:

1. your consent has been obtained;

2. the transfer is necessary for the performance of a contract between you and She Writes Woman Mental Health Initiative or for implementation of pre-contractual measures taken at your request;

3. the transfer is necessary to conclude a contract between us and a third party in your interest;

4. the transfer is necessary for reason of public interest;

5. the transfer is for the establishment, exercise, or defense of legal claims or compliance with a legal obligation to which we are subject;

6. the transfer is necessary to protect your vital interests or the interest of other persons, where you are physically or legally incapable of giving consent;

7. the transfer is necessary for the purpose of the legitimate interests pursued by us as data controller or data processor, or by a third party to whom the data is disclosed.

We take reasonable steps and have put appropriate security measures in place to hold information securely in electronic or physical form and to prevent unauthorized access, modification, disclosure or accidental loss. We maintain administrative, technical, and physical controls to protect your personal data.In addition, we limit access to your Personal Data to employees, agents, contractors and other third parties on a need-to-know basis. They will only process your Personal Data on our instructions and are subject to a duty of confidentiality.

We store information in our access-controlled premises or in electronic databases requiring logins and passwords. Also, we require our third-party data storage providers to comply with appropriate information security industry standards. All employees and third-party providers with access to confidential information are subject to confidentiality obligations.

We maintain administrative, technical, and physical controls designed to protect your Personal Data. We protect against loss or theft, as well as against any unauthorised access, risk of loss, disclosure, copying, misuse, or modification. Some of the security measures we may implement include secure servers, firewalls, data encryption and granting access only to specific employees in order to fulfil their job responsibilities.

If you wish to exercise any of the rights set out above or have any query or complaint in respect of this Privacy Policy or how we process your personal data, please contact our Data Protection Officer by emailing:

📧 ethics@shewriteswoman.org

We take your privacy seriously, and so should you have any privacy-related issues in respect of our data processing activities, we appreciate the chance to deal with your concerns before you take other legal steps available to you.

In the event that you have any complaint concerning how we process your Personal Data or any difficulty in exercising your right through any channels, including the above contact details, we kindly request that you escalate this through any other dispute resolution channels which we have provided in any of our terms and agreements with you.

Where we are unable to resolve this dispute within the agreed time with you after this escalation, you have the right to make a complaint to the Nigeria Data Protection Commission (NDPC), the national data protection authority in Nigeria.

She Writes Woman Mental Health Initiative reserves the right to alter this policy for the purposes of advancing data privacy rights, public interest, or complying with lawful directives of the Federal Government in line with the NDPA and other data protection regulations. It is your responsibility to review the amended Privacy Policy. This Privacy Policy governs the use of personal data by us, unless otherwise agreed through a written contract.