Privacy & Data Protection Policy

This policy describes how [OPERATING ENTITY LEGAL NAME — LEGAL COUNSEL REVIEW REQUIRED: confirm the registered entity operating OnCampusDaily before publishing], operating as "OnCampusDaily", collects, uses, shares, and protects personal data when you use the OnCampusDaily platform (web and, in the future, mobile). It is written with the Nigeria Data Protection Act 2023 (NDPA) in mind. LEGAL COUNSEL REVIEW REQUIRED: the operating entity's formal registration status with the Nigeria Data Protection Commission, and whether a Data Protection Officer or compliance registration is required given the platform's scale, have not been independently confirmed.

For most processing described in this policy, OnCampusDaily acts as the data controller — it decides why and how personal data is processed. Where a third-party processor (for example, a payment provider or email provider) acts only on OnCampusDaily's instructions, it acts as a data processor; see section 8 for how these providers are used.

• Account and profile data: display name, email address, avatar, and university/campus association you provide.
• Verification data: for student verification — registered name, department, level, course of study, study mode, and course-representative review notes; for identity verification — the document/information you submit for manual review. This is sensitive information, handled with restricted access (see section 10).
• Content you create: marketplace listings, service and business listings, event and program listings, publisher content, community posts, reviews, and the messages you send other users.
• Transaction and wallet data: wallet ledger entries (credits/debits and their reasons), ticket purchases, order records, and payment references from our payment provider (not full card/bank credentials, which the payment provider holds).
• Verification/organizer records: organizer profile information, campaign/advertising submissions, and the agreements you have accepted (see the Legal & Policies center).
• Usage data: which listings, services, businesses, events, and programs you view, searches you perform, and contact/share actions you take — used to operate features, power trust-and-safety tools, and inform internal analytics.
• Technical data: session identifiers, device/browser information from standard web request headers, and IP-based signals used narrowly to enforce rate limits against abuse (for example, repeated failed logins or message spam) — not retained as a general activity profile.
• Reports and complaints: content you submit when reporting another user or piece of content, or when submitting a privacy, moderation, or intellectual-property complaint.

We use personal data to: operate the Platform's features (marketplace, services, businesses, events/ticketing, programs, messaging, wallet); review verification requests; moderate reported content and enforce our policies; detect and prevent fraud and abuse; process payments and ticket issuance; provide customer support; and understand platform usage through internal analytics.

Each use has a lawful basis under the NDPA: performing our contract with you (operating the account and features you use); your consent (for example, optional marketing communications, or specific verification steps); a legal obligation (for example, retaining transaction records); or our legitimate interests in operating a safe, functioning platform (for example, fraud prevention and security logging), balanced against your rights. Where consent is the basis, you may withdraw it at any time as described in section 12 — this does not affect processing already carried out.

We do not sell personal data, and we do not share it with advertisers beyond the aggregated, privacy-protective analytics described in section 6.

The Platform uses cookies and similar technologies for authentication, security, and preferences, and, where enabled, for analytics. See the Cookie Policy for the categories used, their duration, and how to manage them.

If you interact with sponsored content, we record that interaction (for example, an impression or click) to support the advertising system described in the Advertising & Sponsored Content Agreement. Advertisers receive aggregated, non-identifying campaign performance data — see section 6. We do not share your individual profile, message contents, or identity with advertisers.

Advertisers may receive aggregated analytics about their campaigns, such as impressions, clicks, general campaign performance, and, where the underlying numbers are large enough to avoid re-identifying an individual, aggregated department-level or level/year audience characteristics.

Advertisers never receive: private message contents, verification/KYC documents, passwords or credentials, individual transaction details, an individually identifiable behavioral profile, or any data granular enough to reasonably re-identify a specific person from an aggregate figure. Aggregation and minimum-group-size safeguards are part of how this analytics reporting is built, not an afterthought.

We share personal data only as needed to operate the Platform, with:

• Payment providers, to process wallet funding and other payments (see the Payment & Refund Policy for their role).
• Email providers, to send transactional and, where you have consented, marketing communications.
• Cloud hosting and storage providers, to run the Platform and store the content and data described above.
• Identity-verification providers, where a specific verification flow uses one.
• Universities or institutions, only where legitimately required for a verification process you have initiated (for example, confirming a course representative's own status) — not as a general data feed, and never as part of the "no institutional affiliation" relationship described in the Independent Platform Notice.
• Regulators and law enforcement, only as described in section 9 and the internal Law Enforcement & Government Request Procedure.
• Professional advisers (lawyers, auditors) bound by confidentiality, where necessary for a legal, tax, or audit purpose.

We do not sell personal data or share it with data brokers.

Some of the providers in section 7 (for example, cloud hosting, analytics, or email infrastructure) may process data outside Nigeria. LEGAL COUNSEL REVIEW REQUIRED: whether the specific providers currently used require additional safeguards under the NDPA's cross-border transfer requirements (such as an adequacy finding, standard contractual clauses, or another recognized transfer mechanism) has not been confirmed for each provider and should be reviewed before this policy is relied upon as final.

We do not disclose personal data to a government authority or law-enforcement body merely because a request is made. Requests are reviewed against the internal Law Enforcement & Government Request Procedure, which requires a valid legal basis (such as a court order or another legally binding request) before disclosure, except in a genuine emergency involving risk to life, in which case disclosure is still logged and reviewed after the fact.

We retain personal data only as long as needed for the purpose it was collected, plus any period required by law or for legitimate fraud-prevention, financial-record, or dispute-resolution purposes. Verification/KYC data is held with more restricted access than ordinary account data and is not visible to moderators or administrators who do not need it for their role.

Deleting your account removes or anonymizes your profile and content where reasonably possible, but some records — transaction and ticketing history, moderation records, and records needed to resolve an active dispute or comply with a legal obligation — are retained for the applicable retention period even after account closure, consistent with section 11's approach to deletion requests. LEGAL COUNSEL REVIEW REQUIRED: specific retention periods for financial/transaction records under applicable Nigerian tax and financial-record-keeping law have not been confirmed and should be set with counsel's input.

Subject to applicable law and the retention exceptions in section 10, you may request: access to the personal data we hold about you; correction of inaccurate data; deletion of your data; restriction of processing; objection to processing based on our legitimate interests; portability of data you provided, in a structured format, where technically feasible; and withdrawal of consent, where consent is the basis for a specific processing activity.

You can submit any of these requests through the Privacy Requests feature in your account settings, or by emailing [PRIVACY_CONTACT_EMAIL — set in packages/constants/src/legal/contacts.ts before publishing]. We will acknowledge your request, and — where we cannot fully action it because of a retention exception in section 10 — explain which exception applies and why. We do not automatically delete data that must legally be retained for fraud prevention, financial records, active disputes, security, or another regulatory requirement; instead we explain the applicable exception.

If you are unsatisfied with our response, you have the right to complain to the Nigeria Data Protection Commission or another competent authority, and this policy's complaint process does not remove that right.

We apply role-based database access controls (row-level security) so a user can generally only see their own data or data they are authorized to see; least-privilege access for staff and administrators, especially for verification/KYC data and privacy requests; server-side validation and authorization on every sensitive action (never trusting a client-supplied role, price, ownership claim, or payment outcome); and rate limiting against abuse. No system is perfectly secure, and we cannot guarantee absolute security, but we take these measures seriously and continually review them.

If a personal-data breach occurs that is likely to result in a risk to your rights, we will assess it, take steps to contain and remediate it, and notify the Nigeria Data Protection Commission and affected individuals as required by the NDPA. LEGAL COUNSEL REVIEW REQUIRED: the exact notification timelines and thresholds under the NDPA's breach-notification requirements should be confirmed and built into our internal incident-response procedure before this policy is relied upon as final.

LEGAL COUNSEL REVIEW REQUIRED: see section 4 of the Terms of Service. Where a user is legally a minor, additional safeguards for their personal data may be required under the NDPA and the Child's Rights Act; this has not been independently confirmed and should be reviewed before this policy is relied upon as final.

Where you have opted in, we may send you marketing communications about the Platform. You can opt out at any time using the unsubscribe mechanism in the message or through account settings. Transactional communications (for example, a ticket confirmation or a security notice) are not marketing and continue regardless of marketing preferences, as they are necessary to provide the service you requested.

We may update this policy from time to time; the version number and dates at the top of this document reflect the current version. Material changes will be highlighted, and where required, we will seek renewed acceptance as described in the Legal & Policies center.

Privacy questions and rights requests: [PRIVACY_CONTACT_EMAIL — set in packages/constants/src/legal/contacts.ts before publishing]. General legal questions: [LEGAL_CONTACT_EMAIL — set in packages/constants/src/legal/contacts.ts before publishing].