Rejista Data Protection Policy

1. Purpose

The purpose of this Data Protection Policy is to outline how Rejista manages, protects, and processes personal data in compliance with:

• Nigeria Data Protection Regulation (NDPR)
• General Data Protection Regulation (GDPR) (where applicable)
• International best practices in data protection.

This policy applies to all employees, contractors, administrators, and third parties handling personal data on behalf of Rejista.

2. Scope

This policy applies to all personal data collected, stored, or processed through the Rejista App, including but not limited to:

• Names
• Emails
• Phone numbers
• Location data
• Uploaded receipts/proof of payment

3. Data Protection Principles

Rejista adheres to the following principles:

1. Lawfulness, Fairness, and Transparency – Data is collected with user consent and used only for legitimate purposes.
2. Purpose Limitation – Data is collected only for dues/levies management and payment verification.
3. Data Minimization – Only necessary information is collected.
4. Accuracy – Users can update their information to ensure accuracy.
5. Storage Limitation – Data is retained only while the account exists; deleted accounts are permanently erased.
6. Integrity and Confidentiality – Data is protected with encryption, access control, and secure cloud storage.
7. Accountability – Rejista ensures compliance and documents all data-handling activities.

4. Legal Basis for Processing

Rejista processes personal data under the following lawful bases:

• Consent: Users provide explicit consent during registration.
• Contractual Necessity: Data is required to provide Rejista's services.
• Legal Obligation: Data may be retained or shared if required by law.

5. Data Subject Rights

Rejista ensures that all users can exercise their rights, including:

• Access – Request a copy of their personal data.
• Correction – Update or correct their information.
• Deletion – Delete their account and associated data.
• Objection – Withdraw consent for data processing.
• Data Portability (GDPR) – Request transfer of their data to another platform.

6. Data Security Measures

To protect personal data, Rejista implements:

• Encryption for data at rest and in transit.
• Access Controls limiting access to authorized personnel.
• Secure Cloud Hosting with trusted providers.
• Regular Backups and monitoring.
• Incident Response Plan in case of breaches.

7. Data Retention Policy

• User data is retained only for the lifetime of the account.
• When a user deletes their account, all personal data is permanently erased from Rejista systems within 30 days.
• Logs and audit trails may be retained for compliance purposes but anonymized where possible.

8. Data Breach Management

• Any data breach will be investigated within 72 hours.
• Affected users and regulators will be notified where required (GDPR/NDPR).
• Measures will be taken to prevent recurrence.

9. Roles and Responsibilities

• Data Protection Officer (DPO): Responsible for overseeing compliance and handling data subject requests.
• Employees and Admins: Must follow this policy and ensure confidentiality of user data.
• Third-Party Providers: Must comply with Rejista's data protection standards.

10. Compliance and Review

• Rejista complies with NDPR, and aligns with GDPR principles for international users.
• This policy will be reviewed annually or whenever there are regulatory changes.

11. Contact Information

For data protection inquiries or complaints, contact: