Privacy Policy

ESICON Innovation is operated by Basmalat Nass Integrated Services Limited ([RC number, pending]), [Registered office address, pending]. We decide how and why your personal data is used, which makes us the data controller under the Nigeria Data Protection Act 2023 (NDPA).

For anything about your data, write to esiconinnovation@gmail.com.

When you create an account: your email address, a password (stored only as a secure hash we can't read), your account type and whether you're 18 or over.

When you sign in with Google: your name, email address and profile picture, as shared by Google.

When you complete your profile: your full name, phone number and state of origin, and, depending on who you are, your institution, faculty, department, level, matric number, NYSC status, skills, interests, portfolio link and LinkedIn link.

When you contact us: your name, email address, who you are and your message.

When you use the site: sign-in cookies that keep you logged in, your light or dark mode choice (stored only in your browser) and standard server logs such as IP address and browser type, which our hosting provider keeps for security.

We don't use advertising cookies or tracking analytics, and we don't sell personal data.

• To run your account and the platform, including matching you with suitable challenges. The legal basis is performing our agreement with you.
• To send account emails, such as sign-in codes, password resets and security alerts. Same legal basis.
• To answer your messages. The legal basis is our legitimate interest in replying to you.
• To keep the platform safe and prevent fraud and misuse. Legitimate interest.
• To meet our legal obligations, for example responding to lawful requests from authorities.
• For anything optional, such as newsletters if we offer them, we ask for your consent first, and you can withdraw it at any time.

Companies and organisations on the platform see your profile when you apply to one of their challenges or join a team working on it. They don't see your password, phone number or matric number unless you choose to share them.

Service providers process data for us under contracts that require them to protect it:

• Supabase, which stores our database and handles sign-in. Servers in Ireland (EU).
• Vercel, which hosts the website. Server code runs in Ireland, with copies of public pages served worldwide.
• Resend, which delivers our emails. Servers in the United States.
• Google, if you choose to sign in with Google.

We may also share data where the law requires it, or to protect someone's safety.

Our providers store data in the European Union and the United States. The NDPA allows this where the receiving country or provider gives adequate protection. We rely on our providers' data protection agreements and security commitments, and we'll update this section as the NDPC publishes further guidance.

• Account and profile data: while your account is open. When you delete your account, we remove it within 30 days.
• Contact messages: up to 12 months after we last reply.
• Server logs: around 30 days, as set by our hosting provider.
• Database backups: removed when the backups cycle out, usually within 30 days.

Under the NDPA you can:

• ask for a copy of the personal data we hold about you
• ask us to correct anything that's wrong
• ask us to delete your data
• ask us to stop or limit how we use it, or object to a use based on our legitimate interest
• receive your data in a format you can take elsewhere
• withdraw consent you've given, without affecting what we did before

Write to esiconinnovation@gmail.com and we'll reply within 30 days. If you're not happy with our answer, you can complain to the Nigeria Data Protection Commission (NDPC).

You must be at least 16 to use ESICON Innovation. If you're 16 or 17, you confirm at sign-up that a parent or guardian agrees to you creating an account. If we learn that someone under 16 has an account, or that a minor signed up without that agreement, we'll close the account and delete the data.

Data is encrypted in transit, passwords are hashed, and database rules stop each user reading anyone else's private profile. No system is perfectly secure. If a breach puts your rights at risk, we'll tell the NDPC within 72 hours and let you know without undue delay.

We'll update this page when our practices change and show the date at the top. If a change affects you significantly, we'll email you before it takes effect. See also our Terms of Service.