Under the NDPA, every data subject — beneficiaries and their guardians, donors, staff, volunteers, and partner-organization contacts — has the following rights over their own personal data. To exercise any of them, contact hello@eifeneighth.org, use the request form in Appendix E, or speak to any staff member, who will route the request appropriately.
Right
What it means
Confirmation and access
Ask whether we hold personal data about you, and get a copy of it.
Correction (rectification)
Ask us to correct inaccurate or incomplete personal data.
Erasure
Ask us to delete personal data that is no longer needed for the purpose it was collected for, subject to our statutory retention obligations (Section 13) — e.g., financial records cannot be deleted early where the law requires them to be kept.
Withdraw consent
Withdraw any consent given under Section 9, at any time (Section 9.7).
Object to processing
Object to processing based on legitimate interest (e.g., aggregate impact reporting); we will stop unless we have a compelling overriding reason or a legal obligation to continue.
Restriction
Ask us to limit how we use your data while a correction or objection is being resolved.
Data portability
Request your data in a structured, commonly used, machine-readable format, where technically feasible.
Protection from solely automated decisions
The Academy does not make any decision about a beneficiary, donor, or applicant using solely automated means without human involvement.
Lodge a complaint
Complain directly to the Academy (contact above), or to the Nigeria Data Protection Commission (NDPC), if you believe your rights have been violated.
15.1 How requests are handled today
The Academy does not yet operate a self-service beneficiary or donor portal — that is planned as a later phase of the operations platform. Until it exists, every rights request above is handled manually by staff, which is a deliberate, documented choice appropriate to the Academy's current size (roughly ten beneficiaries) rather than a gap: at this scale, manual handling is genuinely faster and more personal than a self-service system would be. We aim to acknowledge a request within 5 business days and resolve it within 30 days, or explain why more time is needed. This approach will be revisited — and self-service tools built — once program size or request volume make manual handling impractical.