Privacy Policy

1. Introduction

Reconciliation Christian Centre (RCC) Gombe is committed to protecting your privacy. This Privacy Policy explains how we collect, use, process, and safeguard personal data in compliance with the **EU General Data Protection Regulation (GDPR)** and the **Nigeria Data Protection Act (NDPA) 2023**.

2. Lawful Bases for Processing

We only process your personal data when we have a valid legal basis. These include:

• Consent: When you voluntarily submit requests, subscribe to updates, or agree to cookies.
• Contract: Necessary to complete transactions you initiate, such as donations or volunteer registrations.
• Legal Obligation: To satisfy tax, accounting, or regulatory requirements in Nigeria (e.g. reporting audits to the Corporate Affairs Commission).

3. Data We Collect

We collect the following personal identifiers when you interact with our digital platform:

• Giving & Finance: Full Name, Email, Phone Number, Payment Method, transaction references, and amount. *Note: We never collect or store card numbers directly; all online transactions are processed securely by licensed gateways (Paystack and Flutterwave).*
• Prayer Requests & Testimonies: Name, Email, and details of the request/testimony you choose to provide.
• Contact & Visit Planning: Name, Email, and message contents.

4. Security & PII Encryption at Rest

To secure your data, we apply industry-standard **privacy by design** principles. All highly sensitive personal identifiers (such as donor phone numbers, email addresses, and full names on giving logs) are automatically **encrypted at rest** at the application layer before being written to our database using advanced authenticated encryption protocols (AES-256).

5. Data Retention

We do not store your data longer than necessary. Financial transaction records are retained for a minimum of 7 years to satisfy local financial and legal obligations. Personal profiles, contact form submissions, and prayer logs are permanently erased or anonymized within 30 days of receiving a valid deletion request.

6. Data Subject Rights

Under the NDPA 2023 and GDPR, you possess the following rights regarding your personal information:

• Right of Access: Request a description or copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal information.
• Right to Portability: Request that we export your data in a structured, machine-readable format.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal records.
• Right to Object: Object to or restrict the processing of your data.

To exercise any of these rights, please email our Data Protection Officer at the address below.

7. Contact Our Data Protection Officer (DPO)

For any inquiries, requests, or questions regarding this Privacy Policy or your data protection rights, please contact our designated DPO: