1. Introduction
This policy explains how EZER handles personal information. It is written to meet the Nigeria Data Protection Act 2023 (NDPA) and the standards set by the Nigeria Data Protection Commission (NDPC).
We have kept it short and plain. If anything is unclear, ask us.
2. Who controls the information
There are two roles here, and the difference matters:
- Your ministry decides whose records go into EZER, what is recorded, and why. Your ministry is the data controller for those records.
- We hold and process those records on your ministry’s instructions, so that the service works. We are the data processor.
- We are the controller for the ministry’s own sign-in and subscription details.
If you are a member of a ministry and want to know why your details are held, please ask your own ministry first, because they decide that.
3. What we hold
| Category | What it covers |
|---|---|
| Sign-in and ministry details | Ministry name, city, contact person, email address, phone number, and the plan chosen |
| Ministry records | The names, contact details, family groupings, attendance and notes that your ministry chooses to enter |
| Stewardship records | Amounts received and spent, with categories and dates, as entered by your ministry |
| Subscription status | Whether a payment succeeded, and when the plan renews |
| Technical logs | The records needed to keep the service running and secure |
Passwords. We never see or store your password in readable form. It is held only as a secure one-way hash, which means we cannot read it, recover it, or tell anyone what it is. If you forget it, you reset it.
Card details. We never receive or store card numbers. Payment details go directly to our payment provider and never reach us.
4. Why we use it, and our lawful basis
| Purpose | Lawful basis under the NDPA |
|---|---|
| Providing the service to your ministry | Performance of a contract |
| Taking subscription payments | Performance of a contract; legal obligation |
| Keeping the service secure | Legitimate interest |
| Answering support requests | Performance of a contract |
| Meeting tax and regulatory duties | Legal obligation |
| Sending service notices, such as policy or price changes | Legitimate interest; legal obligation |
We do not sell personal data. We do not rent, trade or disclose it for anyone else’s marketing, advertising or profiling.
5. The providers that run the service
EZER runs on standard internet infrastructure. Like every online service, it depends on a small number of specialist providers for hosting, database storage and payment processing. They act only on our instructions, are bound by contract to protect the data, and are not permitted to use it for their own purposes.
That is the full extent of it. Beyond those providers, we do not give your information to anyone.
Some of these providers operate servers outside Nigeria. Where information is transferred abroad, we rely on the safeguards permitted by section 41 of the NDPA, including contractual protections requiring an adequate level of protection.
We may disclose information where the law requires it, or to establish or defend a legal claim. We will tell you if that happens, unless the law prevents us. You may ask us at any time for details of the providers we use.
6. How long we keep it
- While your subscription is active: we keep your records so the service works, and you can export them at any time.
- After cancellation: your records stay available for export for 30 days.
- After that: we begin deleting them. Deletion completes within 90 days of cancellation, unless the law requires us to keep something longer.
- Financial records: kept for the period Nigerian law requires.
- Backups: may hold copies for a short further period before being overwritten on their normal cycle.
You can ask for earlier deletion at any time.
7. Your rights under the NDPA
If your personal information is held in EZER, you have the right to:
- Be informed about how it is used;
- Access a copy of it;
- Correct anything inaccurate or incomplete;
- Erasure, where there is no continuing lawful reason to keep it;
- Restrict or object to certain processing;
- Portability, to receive it in a commonly used format;
- Withdraw consent at any time, where we relied on consent;
- Complain to the Nigeria Data Protection Commission.
To exercise a right, write to hello@ezerng.com. We respond within 30 days. If a ministry entered the information, we will normally refer you to that ministry, because they control those records, and we will help them respond.
8. How we protect it
- All traffic is encrypted in transit using HTTPS.
- Passwords are stored only as secure one-way hashes.
- Every ministry’s records are isolated from every other ministry’s at the database level.
- Permissions are enforced by the database itself, so a person cannot reach information outside their role.
- Access to live systems is limited to the people who need it.
No system is perfectly secure. If a breach occurs that is likely to cause harm, we will notify the NDPC and those affected, as the NDPA requires.
10. Changes to this policy
We will update this policy as the service and the law develop. Material changes will be notified by email or in the app at least 30 days in advance. The date at the top always reflects the current version.
11. Contact and complaints
For any privacy question or request, contact us at hello@ezerng.com.
If you are not satisfied with our response, you may complain to the Nigeria Data Protection Commission (NDPC).