Privacy Policy

Spendhood is a platform that enables nonprofit organizations in Nigeria to create and manage fundraising campaigns. For the purposes of the NDPA:

• Spendhood Ltd. (the Platform) acts as a data controller for personal data collected in connection with the operation, maintenance, and improvement of the platform itself (e.g., account registration data, platform analytics, and security logs).
• Individual Organizations using Spendhood act as independent data controllers for the personal data they collect through their campaigns, including donor names, donation amounts, and campaign-specific communications.

Spendhood may also act as a data processor on behalf of organizations when processing donations and managing campaign data on their instructions.

We may collect and process the following categories of personal data:

We process your personal data for the following purposes:

• Donation Processing: To facilitate, verify, and process donations made through the platform, including refund handling and dispute resolution.
• Campaign Management: To enable organizations to create, manage, and report on fundraising campaigns.
• Regulatory Compliance: To meet obligations under SCUML regulations, anti-money laundering (AML) requirements, and other applicable Nigerian laws, including verification via BVN/NIN where mandated.
• Communication: To send transactional notifications (donation receipts, campaign updates), marketing communications (with consent), and support responses.
• Platform Security: To detect and prevent fraud, unauthorized access, and other malicious activities.
• Service Improvement: To analyze usage patterns and improve the platform experience.

In accordance with the NDPA, we rely on the following legal bases for processing your personal data:

• Consent: Where you have given clear, informed, and freely given consent for specific purposes (e.g., marketing emails, non-essential cookies). You may withdraw consent at any time.
• Contractual Necessity: Where processing is necessary to perform a contract with you (e.g., processing a donation, providing donor dashboard access).
• Legal Obligation: Where processing is required to comply with Nigerian law (e.g., SCUML reporting, AML/KYC verification, tax record retention).
• Legitimate Interest: Where processing is necessary for our legitimate interests or those of a third party, provided such interests are not overridden by your rights (e.g., platform security, fraud prevention, service analytics).

We do not sell your personal data. We may share your data with the following categories of third parties:

• Payment Providers: Licensed payment processors (e.g., Paystack, Flutterwave) to securely process donations and refunds. These providers process your data under their own privacy policies and applicable regulations.
• Organizations on Spendhood: When you donate to a campaign, the relevant organization receives your name, email, donation amount, and any message you include.
• SCUML (Special Control Unit against Money Laundering):Transaction data may be shared as required by Nigerian anti-money laundering regulations.
• Nigeria Data Protection Commission (NDPC): Data may be disclosed to the NDPC in response to lawful requests, audits, or investigations.
• Service Providers: Cloud hosting, analytics, and email delivery providers who process data on our behalf under strict contractual safeguards.

Spendhood is hosted and operated primarily within Nigeria. However, certain third-party service providers (e.g., cloud infrastructure, analytics) may process data outside of Nigeria. Where cross-border transfers occur, we ensure:

• The destination country provides an adequate level of data protection, or
• Appropriate safeguards are in place, such as standard contractual clauses approved by the NDPC, or
• Your explicit consent has been obtained for the transfer.

We will inform you of any material changes to cross-border transfer arrangements via this policy or direct notification.

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy, or as required by law. Default retention periods are:

Organizations on Spendhood may configure their own retention periods for campaign-related data, subject to minimum regulatory requirements.

Under the NDPA, you have the following rights regarding your personal data:

• Right of Access: You may request a copy of the personal data we hold about you.
• Right of Correction: You may request correction of inaccurate or incomplete personal data.
• Right of Deletion (Erasure): You may request deletion of your personal data, subject to legal retention obligations.
• Right of Data Portability: You may request your data in a structured, commonly used, and machine-readable format.
• Right to Object: You may object to processing based on legitimate interest or for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, you may also contact us at privacy@spendhood.com. We will respond to verifiable requests within 30 days, or as otherwise required by the NDPA.

We use cookies and similar tracking technologies to operate and improve our platform. The categories of cookies we use are:

• Essential Cookies: Required for the platform to function (e.g., session authentication, security tokens, CSRF protection). These cannot be disabled.
• Analytics Cookies: Help us understand how users interact with the platform (e.g., page views, navigation patterns). These are enabled only with your consent.
• Functional Cookies: Remember your preferences and settings (e.g., language, display preferences). These are enabled only with your consent.

You can manage your cookie preferences at any time through your browser settings or via the cookie consent banner displayed on your first visit. Disabling certain cookies may affect platform functionality.

If you believe that your personal data has been processed in violation of the NDPA or this Privacy Policy, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).

For questions, requests, or complaints regarding this Privacy Policy or our data practices, please contact:

We will acknowledge receipt of your request within 7 business days and provide a substantive response within 30 days, in accordance with NDPA requirements.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

• Update the "Effective Date" and "Version" at the top of this page.
• Notify registered users via email or an in-platform notification.
• Where required by the NDPA, obtain your consent before applying changes that materially affect how your data is processed.