Privacy Policy

The Rotary Club of Victoria Island is the Data Controller for personal data processed in connection with our activities. Our details are:

As a Data Controller, we determine the purposes and means of processing your personal data and are responsible for ensuring that processing is carried out lawfully, fairly, and transparently in accordance with the NDPR 2019.

Depending on how you interact with the Club, we may collect and process the following categories of personal data:

a. Identity and contact data

• Full name, title, and professional designation
• Email address, telephone number, and postal address
• Employer or business name and professional classification
• Photograph or profile image (where voluntarily provided)

b. Membership and service data

• Membership application details and classification
• Attendance records and committee participation
• Rotary membership ID and club history
• Service project involvement and volunteer records

c. Financial and donation data

• Donation amounts and payment references (we do not store full card details)
• Bank transfer records where applicable
• Receipts and grant application information

d. Communications data

• Messages sent to us via our contact form, email, or WhatsApp
• Records of correspondence including responses we send
• Event RSVPs and meeting attendance confirmations

e. Website usage data

• IP address and browser type
• Pages visited, referring URLs, and time spent on the site
• Device type and operating system
• Cookie identifiers (see Section 10)

f. Sensitive personal data

We do not ordinarily collect sensitive personal data (as defined under NDPR Article 2.10) such as health information, religion, ethnicity, or biometric data. Where such data is strictly necessary (e.g., health information for a project beneficiary), we will obtain your explicit consent in writing before processing it and apply additional safeguards.

We collect personal data through the following means:

• Directly from you — when you complete our contact form, RSVP for an event, apply for membership, make a donation, email or WhatsApp us, or speak with a club officer.
• Rotary International systems — member data may be shared with us by Rotary International or District 9112 through the Rotary club management platform in line with Rotary International's own privacy policy.
• Automatically — when you visit our website, we collect technical and usage data via cookies and server logs (see Section 10).
• Third parties — we may receive your data from a Rotarian who refers you as a prospective member, from event co-organisers, or from partner organisations involved in joint service projects.

Under NDPR Article 2.2, we must have a lawful basis for every instance of personal data processing. We rely on the following bases:

We will tell you which lawful basis we rely on when we first collect your data, or on request.

We use personal data for the following purposes, each matched to a lawful basis:

We do not sell, rent, or trade your personal data. We may share it only in the following circumstances and only to the extent necessary:

Rotary International and District 9112

As an affiliated Rotary club, we share member data with Rotary International (headquartered in Evanston, Illinois, USA) and District 9112 for club management, reporting, and governance purposes. Rotary International operates under its own privacy policy and applicable data protection laws.

Service providers and processors

We engage trusted third-party service providers who process data on our behalf under written data processing agreements, including:

• Email and communication platforms
• Payment processors (for donations)
• Cloud storage and website hosting providers
• Event management tools

All processors are required to maintain appropriate security measures and may not use your data for their own purposes.

Project partners

Where we collaborate with healthcare institutions (e.g., LUTH), schools, or NGOs on service projects, we may share beneficiary data strictly as needed to deliver the project. We ensure such partners uphold equivalent data protection standards.

Legal and regulatory disclosure

We may disclose your data to law enforcement, regulators, or courts where required by Nigerian law, a court order, or to protect the rights, property, or safety of the Club, our members, or the public.

Your personal data may be transferred to and processed in countries outside Nigeria, including the United States (Rotary International headquarters) and other countries where our service providers operate.

In accordance with NDPR Article 2.11, we ensure that any transfer of personal data outside Nigeria is subject to adequate safeguards, including:

• Standard contractual clauses approved by NITDA or an equivalent competent authority
• The recipient country providing an adequate level of data protection
• Your explicit consent where required

By using our website or providing your data to us, you acknowledge that your data may be transferred internationally in the circumstances described above.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our standard retention periods are:

At the end of the retention period, data is securely deleted or anonymised. You may request early deletion of your data — subject to our legal obligations — using the contact details in Section 14.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, alteration, or disclosure, in line with NDPR Article 2.6. These measures include:

• Encrypted storage and transmission (HTTPS/TLS) of data on our website
• Access controls limiting data access to authorised personnel on a need-to-know basis
• Regular review of data access privileges
• Secure disposal of physical records containing personal data
• Staff awareness of data protection obligations

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify NITDA within 72 hours of becoming aware of the breach, as required by the NDPR, and will notify affected individuals without undue delay where required.

Our website uses cookies and similar technologies to ensure it functions correctly and to understand how visitors use it. A cookie is a small text file placed on your device when you visit a website.

Types of cookies we use

Managing cookies

You may control cookies through your browser settings. Most browsers allow you to refuse cookies, delete existing cookies, or be notified before a cookie is set. Disabling strictly necessary cookies may affect website functionality.

We do not use cookies for advertising or profiling purposes, and we do not share cookie data with third-party advertisers.

Under NDPR Article 3.1(9) and the NDPR Implementation Framework 2020, you have the following rights regarding your personal data:

To exercise any of these rights, please contact our Data Protection Officer using the details in Section 14. We will respond within 30 days. We may need to verify your identity before processing your request.

We will not charge a fee for requests unless they are manifestly unfounded or excessive.

We are committed to protecting the privacy of children. Our website is not directed at children under the age of 13, and we do not knowingly collect personal data from children under 13 without verifiable parental or guardian consent.

For youth programmes (Interact Club for ages 12–18 and Rotaract Club for ages 18–30):

• We collect only the minimum data necessary to administer the programme.
• For participants under 18, we obtain written consent from a parent or guardian before collecting or processing personal data.
• Youth data is retained separately and subject to additional access controls.
• Parents and guardians may exercise data subject rights on behalf of their children by contacting us.

If we discover that we have inadvertently collected data from a child under 13 without consent, we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the NDPR regulatory framework. We will notify you of material changes by:

• Posting the updated policy on this page with a new "Last updated" date
• Sending an email notification to active members and newsletter subscribers

We encourage you to review this policy periodically. Continued use of our website or services after a change constitutes acceptance of the updated policy, where permitted by law.

Data Protection Officer

We have designated a Data Protection Officer (DPO) responsible for overseeing compliance with this policy and the NDPR. To exercise your data rights, ask a question, or raise a concern:

Response timelines

We will acknowledge your request within 5 business days and provide a full response within 30 days. If we require additional time (up to 60 days total for complex requests), we will notify you of the extension and the reason.

Right to complain to NITDA

If you are not satisfied with how we have handled your personal data or your request, you have the right to lodge a complaint with Nigeria's supervisory authority:

We would, however, appreciate the opportunity to address your concerns before you approach NITDA, so please contact us first.