Privacy Policy

This Privacy Policy explains how FixNaija (“we,” “us,” or “our”) collects, uses, stores, and protects your personal data when you use the FixNaija platform, including the website, mobile applications, and APIs (collectively, the “Services”).

1. Introduction

---

FixNaija is a civic accountability and budget transparency platform that enables Nigerian citizens to post public infrastructure problems, track government responses, and monitor budget allocations. We are committed to protecting your privacy and handling your personal data responsibly.

This policy applies to all users of the Services — registered users, anonymous posters, government officials, and casual visitors. By using the Services, you consent to the data practices described in this policy.

2. Data We Collect

---

2.1 Account Registration Data

When you create an account, we collect:

• Full name
• Email address
• Phone number
• State and Local Government Area (LGA)
• Password (stored in hashed form — we never store plaintext passwords)

2.2 Post Data

When you submit a post, we collect:

• Post description, category, and severity level
• Photographs, videos, and voice recordings you upload
• GPS coordinates (with your device’s permission) to identify the precise location of the infrastructure problem
• State, LGA, and ward (assigned automatically or manually selected)

2.3 Device & Usage Data

We automatically collect:

• IP address
• Browser type and version, operating system
• Pages visited, features used, and timestamps
• Referring URL (how you arrived at the Platform)

2.4 Cookies

We use cookies and similar technologies. See Section 8: Cookies & Tracking for details.

2.5 Communication Data

If you contact us through the Contact Us form, we collect your name, email address, and message content.

3. How We Use Your Data

---

We use your personal data to:

• Operate the Platform — create and manage your account, process posts, assign posts to the correct government jurisdiction, and manage the public status timeline;
• Communicate with you — send status updates on your posts, respond to your enquiries, and deliver platform notifications;
• Generate analytics — produce aggregated, anonymised statistics and trend data on infrastructure issues across Nigeria;
• Ensure security — detect and prevent fraud, spam, abuse, and unauthorised access;
• Comply with legal obligations — respond to lawful requests from Nigerian courts or regulatory authorities.

4. Public vs. Private Data

---

4.1 What Is Public

• Post text, category, severity, and status updates
• Uploaded photographs, videos, and voice transcriptions
• GPS coordinates and map location of the posted issue
• Comments, upvotes, and petition signatures
• Display name (for registered users who do not choose anonymous submission)

4.2 What Remains Private

• Email address
• Phone number
• IP address
• Password (hashed)
• The identity of anonymous posters

5. Data Sharing

---

We may share your data in the following circumstances:

5.1 Government Officials

Posts are forwarded to the responsible government authority (LGA, State, or Federal) for response. Officials see the same public information as any visitor. They do not receive your private data (email, phone, IP) unless required by a lawful court order.

5.2 Journalists, Researchers & NGOs

As part of the Platform’s escalation and advocacy function, publicly available post data (not private personal data) may be shared with journalists, researchers, and civil society organisations to promote infrastructure accountability.

5.3 Service Providers

We use third-party services to operate the Platform (see Section 10). These providers process data on our behalf and are contractually obligated to protect it.

5.4 Legal Compliance

We may disclose data where required by Nigerian law, court order, or regulatory directive.

6. Data Retention

---

Data Type	Retention Period
Active account data	Retained while your account is active
Deleted account data	Personal data removed within 30 days of deletion request. Posts remain on the Platform in anonymised form (author shown as “Anonymous”) to preserve the public accountability record.
Contact form submissions	Retained for 2 years, then archived
Server logs & IP addresses	90 days
Posts & public timelines	Retained indefinitely as public record

7. Your Rights Under Nigerian Law

---

Under the Nigeria Data Protection Act (NDPA) and the Nigeria Data Protection Regulation (NDPR), you have the following rights:

• Right of Access — request a copy of the personal data we hold about you;
• Right to Rectification — request correction of inaccurate or incomplete personal data;
• Right to Deletion — request deletion of your account and personal data (posts will be anonymised, not deleted, to preserve the public record);
• Right to Restrict Processing — request that we limit how we use your data in certain circumstances;
• Right to Data Portability — request your data in a structured, machine-readable format;
• Right to Withdraw Consent — withdraw consent at any time (this does not affect the lawfulness of processing performed before withdrawal);
• Right to Lodge a Complaint — file a complaint with the Nigeria Data Protection Bureau (NDPB) if you believe your data rights have been violated.

To exercise any of these rights, contact our Data Protection Officer at [email protected] or via the Contact Us form.

8. Cookies & Tracking

---

8.1 Essential Cookies

These cookies are required for the Platform to function and cannot be disabled:

Cookie	Purpose	Duration
sessionid	User session management	2 weeks
csrftoken	Cross-site request forgery protection	1 year
fixnaija_consent	Stores your cookie preference	1 year

8.2 Analytics Cookies

With your consent, we use analytics cookies to understand how visitors use the Platform, which pages are most popular, and where users encounter issues. Analytics data is aggregated and does not identify individual users.

You can accept or decline analytics cookies via the cookie consent banner displayed on your first visit. You can change your preference at any time by clearing your browser cookies and revisiting the site.

8.3 No Advertising Cookies

FixNaija does not use third-party advertising cookies or tracking pixels. We do not sell your data to advertisers.

9. Security Measures

---

We implement the following security measures:

• Encryption in transit — all data is transmitted over HTTPS (TLS 1.2+);
• Encryption at rest — stored data is encrypted using industry-standard algorithms;
• Access controls — role-based access ensures that only authorised personnel can access personal data;
• Rate limiting — API and form endpoints are rate-limited to prevent brute-force and abuse attacks;
• Regular security reviews — we conduct periodic security assessments of the Platform.

9.1 Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights, we will:

1. Notify the Nigeria Data Protection Bureau (NDPB) within 72 hours of becoming aware of the breach;
2. Notify affected users without undue delay via the email address associated with their account;
3. Publish a public notice on the Platform if the breach affects a significant number of users.

10. Third-Party Services

---

We use the following third-party services. Your data may be processed by these providers in accordance with their own privacy policies:

• Cloudflare — CDN, DDoS protection, and SSL termination
• Google Cloud Platform — cloud computing and file storage (Google Cloud Storage)
• OpenStreetMap / Mapbox — map rendering and geo-visualisation
• Africa’s Talking / Twilio — SMS and communication delivery (when activated)
• Redis — caching infrastructure

11. Children’s Privacy

---

The Platform is intended for users aged 18 years and older. We do not knowingly collect personal data from children under 18. If you believe a minor has submitted personal data through the Platform, a parent or legal guardian may request its deletion by contacting our Data Protection Officer at [email protected].

12. Cross-Border Data Transfers

---

FixNaija’s primary infrastructure is hosted in data centres operated by Google Cloud Platform. Some third-party services (such as Cloudflare) may process data in locations outside Nigeria as part of their global infrastructure.

Where personal data is transferred outside Nigeria, we ensure that appropriate safeguards are in place in accordance with the Nigeria Data Protection Act, including standard contractual clauses and adequacy assessments.

13. Changes to This Policy

---

We may update this Privacy Policy from time to time. Material changes will be communicated through the Platform with at least thirty (30) days’ notice before taking effect. The “Effective Date” at the top of this page indicates when the policy was last revised.

Your continued use of the Platform after changes take effect constitutes acceptance of the revised policy.

14. Contact & Data Protection Officer

---

For any questions about this Privacy Policy, to exercise your data rights, or to raise a privacy concern, you may contact:

We aim to respond to all privacy-related enquiries within fourteen (14) business days.