01
Overview and scope, link to this section
In shortThis notice covers spelagos.org. It does not cover SPE International, employers, or other sites we link to.
SPE Lagos Section 61 is the data controller for the personal information described in this notice. It applies to this website and to the section activities administered through it: membership, technical meetings and events, the job board, scholarships, forms and enquiries.
It does not apply to SPE International's own systems, which are governed by SPE International's privacy policy; to employers who receive your application through the job board and become independent controllers of it; or to any third-party website we link to.
Each section below opens with a short plain-English summary. The summaries are a reading aid; where one differs from the text beneath it, the text governs.
02
Information we collect, link to this section
In shortMostly what you type in: account details, your professional profile, event registrations and payment references. Some is collected automatically by the server.
| Category | What it includes | Where it comes from |
|---|---|---|
| Account | Name, email address, phone number, password (stored only as a hash), account status | You, at sign-up |
| Professional profile | Professional summary, work experience, education, licences and certifications, skills, languages, portfolio links | You, on the profile page |
| Documents | CVs and résumés, certificates, supporting documents attached to an event registration, company logos | You, by upload |
| Job activity | Roles saved, applications submitted, application answers, application status | You, and the employer who updates the status |
| Membership and events | SPE membership number and grade, section of record, registrations, ticket references, attendance | You, and SPE International's membership register |
| Payments | Amount, currency, payment reference, gateway status, date. We never receive or store card numbers, CVVs or bank credentials. | The payment gateway |
| Forms and enquiries | Answers you give to a section form, and the content of messages sent through the contact or enquiry forms | You |
| Technical | IP address, browser and device type, pages requested, timestamps, referring page, error logs | Collected automatically by our servers |
Please do not send us sensitive information you were not asked for
We do not need your health details, religion, ethnicity, political views, biometric data or bank account credentials to run any service on this site. Do not include them in a CV, a form answer or a message. If you send them anyway, we will delete them.
03
How we use your information, and our lawful basis, link to this section
In shortTo run your account, your registrations and your applications; to keep the site secure; and, if you agree, to send you section news.
The Nigeria Data Protection Act 2023 requires us to have a lawful basis for every use of your information. Ours are set out below.
| What we do | Why | Lawful basis |
|---|---|---|
| Create and maintain your account and profile | So you can log in, keep your details current and use member services | Performance of a contract with you |
| Process membership dues and event payments | To take payment, confirm it, issue tickets and keep financial records | Contract, and legal obligation for tax and accounting records |
| Share your profile and CV with an employer you apply to | To progress the application you chose to submit | Steps taken at your request before a contract |
| Verify your membership standing with SPE International | To grant member pricing and member-only access correctly | Contract, and our legitimate interest in administering the section |
| Run events, forms, scholarships and mentoring programmes | To administer entries, seats, documents and outcomes | Contract, or your consent where participation is voluntary |
| Send service messages: tickets, receipts, password resets, changes to an event | You need these to use what you signed up for | Contract |
| Send section news, event invitations and job alerts | To keep members and subscribers informed | Your consent, withdrawable at any time |
| Keep the site secure, investigate abuse and prevent fraud | To protect members, employers and the section | Legitimate interest, and legal obligation |
| Produce anonymous statistics on attendance, applications and reach | To plan programmes and report to the board and to SPE International | Legitimate interest: the output identifies no one |
| Respond to a regulator, a court order or a lawful request | Because we must | Legal obligation |
Where we rely on consent (for newsletters, job alerts or optional programme participation), you can withdraw it at any time without affecting anything done before you withdrew. Every marketing email carries an unsubscribe link.
06
Transfers outside Nigeria, link to this section
In shortSome of our providers, and SPE International, are outside Nigeria. We only transfer data where the Act allows it.
SPE International is based in the United States, and some of our hosting, storage and email providers operate servers outside Nigeria. Where personal information leaves Nigeria we rely on one of the grounds in Part VIII of the Nigeria Data Protection Act 2023: an adequacy determination by the Nigeria Data Protection Commission, contractual safeguards binding the recipient to an equivalent standard of protection, or your explicit consent where neither applies.
You may ask us which safeguard covers a particular transfer, and we will tell you.
07
How long we keep it, link to this section
In shortOnly as long as we need it. Financial records are kept for six years because the law requires it.
| Record | Kept for |
|---|---|
| Account and profile | While your account is open, then 12 months after closure so it can be restored if closed in error |
| CVs and uploaded documents | Until you delete them, or 24 months after your last login, whichever comes first |
| Job applications | 24 months from submission, so you keep a record of where you applied |
| Event registrations and attendance | 3 years, for programme planning and reporting |
| Payment and financial records | 6 years from the end of the financial year, as required by Nigerian tax and company law |
| Enquiries and correspondence | 2 years from the last message in the thread |
| Server and security logs | 90 days, except where a log is retained for an active investigation |
| Marketing consent records | Until you withdraw consent, plus 2 years as proof that consent was given |
When a retention period ends we delete the record or irreversibly anonymise it. Anonymised statistics (attendance counts, application volumes) are kept indefinitely and cannot be traced back to you.
08
How we protect your information, link to this section
In shortEncryption in transit, hashed passwords, role-based access, and a 72-hour breach notification commitment.
- All traffic to and from this site is encrypted in transit with TLS.
- Passwords are stored as salted hashes. Nobody at the Section can read your password, and we will never ask you for it.
- Access to member records is limited to the officers and volunteers who need it for their role, and is logged.
- Uploaded documents are held in access-controlled storage and served only to you and to an employer you applied to.
- Card and bank details are handled entirely by the payment gateway and never reach our systems.
No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and tell affected individuals without undue delay where the risk is high.
09
Your rights, link to this section
In shortYou can ask for a copy of your data, correct it, delete it, object to a use, or take it elsewhere. It is free, and we answer within 30 days.
Under the Nigeria Data Protection Act 2023 you have the right to:
- be told what we hold about you and why, and to receive a copy of it;
- have inaccurate or incomplete information corrected; much of this you can do yourself on the profile page;
- have information erased where we no longer have a lawful reason to keep it;
- restrict how we use it while a dispute about its accuracy or our basis is resolved;
- object to processing based on our legitimate interests, and to stop direct marketing at any time;
- receive the information you gave us in a structured, machine-readable format, or have it sent to another controller where technically feasible;
- withdraw consent at any time, where consent is the basis we relied on;
- complain to the Nigeria Data Protection Commission.
Making a request
- Email the section office with “Data protection request” in the subject line, from the address on your account.
- Tell us which right you are exercising and what the request covers. If it concerns an event or payment, quote the reference.
- We may ask one question to confirm your identity, never your password.
- We respond within 30 days. If a request is genuinely complex we may extend once by a further 30 days and will tell you why.
Exercising a right costs nothing. We may refuse a manifestly unfounded or excessive request, or one that is repeated without cause, and we will explain why and how to challenge that decision.
10
If you use the job board, link to this section
In shortEmployers only see your details after you apply to their role, and they become responsible for what they do next.
Creating a profile does not expose it to employers. Saving a role tells no one. Information reaches an employer only when you submit an application, and then only that employer.
The employer receives your name and contact details, your profile, the CV attached to the application and your answers to the employer's questions. From that moment the employer is an independent controller: its own privacy notice governs how long it keeps your application and who inside the organisation sees it. Ask the employer directly to delete an application it holds - deleting it from your account here does not withdraw the copy already sent.
We keep our own record of which roles you applied to, and the status the employer reports, so that your application history stays accurate.
11
Students and young people, link to this section
In shortUnder-18s take part through a student chapter or with a guardian's consent, and we collect only what the programme needs.
Some section programmes (scholarships, school outreach, student chapter activities) involve people under 18. Where they do, we collect information through the school, university or student chapter, or with the consent of a parent or guardian, and we limit it to what the programme requires: name, institution, level of study, contact details and academic records relevant to an award.
Accounts on this site are not intended for under-16s. A parent or guardian who believes a child has registered can write to the section office and we will delete the account.
12
Automated decisions and profiling, link to this section
In shortA person makes every decision that affects you. No algorithm does.
We do not make decisions about membership, scholarships, event admission or job applications by automated means alone, and we do not profile you for advertising. Where the site sorts or filters listings, that is a display convenience only; selection decisions are made by people at the Section, or by the employer.
13
Changes to this policy, link to this section
In shortNew version posted here, with the date at the top. Material changes get 14 days' notice.
We review this notice at least once a year and whenever we introduce a service that changes how we handle personal information. The current version, its number and its effective date are always at the top of this page. Where a change materially affects your rights we will give at least 14 days' notice by email to account holders or by a notice on the site.
14
Contact and complaints, link to this section
In shortCome to us first. If we do not put it right, the Nigeria Data Protection Commission will hear you.
Questions about this notice, or a complaint about how we have handled your information, should go to the section office in the first instance. Mark data protection matters clearly in the subject line so they reach the right person.
If you are not satisfied with our response, you may complain to the Nigeria Data Protection Commission, the supervisory authority for data protection in Nigeria. Complaining to us first does not affect that right.
Talk to the section office
Put “Data protection request” in the subject line and write from the address on your account, so we can find your record and reply to the right person.