Every use of personal data described in this policy rests on one of the lawful bases recognized under the NDPA: consent, performance of a contract, compliance with a legal obligation, protection of vital interests, performance of a task in the public interest, or the Academy's legitimate interests (weighed against the data subject's rights and never used to override them). The table below maps our main processing activities to their basis.
Processing activity
Data involved
Lawful basis
Running the beneficiary program: intake, cohort assignment, mentorship, outcome tracking
Beneficiary data (Section 7.1)
Performance of a service the beneficiary (or their guardian, if a minor) has asked to take part in; legitimate interest in operating the program responsibly
Showing an individual beneficiary's name, photo, or story publicly
Beneficiary identifying data
Explicit, opt-in consent only (Section 9.2) — never legitimate interest or any other basis
Aggregate, anonymized impact reporting (counts, rates, cohort-level outcomes)
De-identified beneficiary data
Legitimate interest in donor and public transparency, bounded by anonymization thresholds (Section 9, Section 16)
Recording and acknowledging donations, tracking fund balances
Donor and donation data
Performance of the giving arrangement with the donor; legal obligation (financial record-keeping, CAMA annual returns, tax and audit requirements)
Anti-money-laundering reporting to SCUML/EFCC where required
Donor and donation data
Legal obligation under the Money Laundering (Prevention and Prohibition) Act 2022
Naming a donor publicly (e.g., an “our supporters” page)
Donor identifying data
Explicit, opt-in consent only (Section 9.3)
Naming a partner organization or showing its logo publicly
Organization data
Explicit, opt-in consent only, given by the organization (Section 9.4)
Staff, program staff, finance staff, and mentor accounts and access control
Internal user data
Performance of the working/volunteer relationship; legitimate interest in system security and accountability
Responding to a data-subject rights request or a legal request (e.g., a court order)
Whatever data is relevant to the request
Legal obligation
Basic website analytics
Aggregate visitor data
Legitimate interest, kept to the minimum needed to understand site usage