PARO Foundation Privacy Policy

Effective Date: 1^st of January, 2021

Last Updated: 1^st of April, 2026

1. Introduction

Welcome to the PARO (Patrick and Rose Origbe) Foundation (“we,” “our,” “us”). We are a registered non-governmental organization in Nigeria committed to empowering youths through education and supporting women through health sensitization and breast cancer care.

We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, process, share, and safeguard your information in compliance with the Nigeria Data Protection Act (NDPA) 2023, the General Application and Implementation Directive (GAID) 2025, and other applicable data protection laws in Nigeria.

2. The Information We Collect

We only collect personal data that is necessary to fulfill our mission. Depending on how you interact with us (as a scholarship applicant, patient seeking assistance, donor, or volunteer), we may collect the following categories of data:

• Identity Data: First name, last name, date of birth, gender, and photographic identification.
• Contact Data: Email address, phone number, physical address, and next of kin details.
• Academic Data: School name, matriculation number, course of study, and academic transcripts (for scholarship applicants).
• Financial Data: Bank account details (for scholarship disbursements or financial aid) and payment card details (for donors, processed securely by third-party payment gateways).
• Sensitive Personal Data (Health Data): Medical history, breast cancer diagnosis, doctor’s reports, and treatment plans (specifically for women applying for our health treatment programs).

3. Lawful Basis and Purpose for Processing Data

Under the NDPA, we must have a lawful basis to process your personal data. We process your data under the following legal grounds:

• Consent: You have given clear consent for us to process your personal data for a specific purpose (e.g., subscribing to our newsletter or applying for health assistance).
• Contractual Necessity: Processing is necessary to fulfill an agreement with you (e.g., awarding a scholarship or processing a donation).
• Legal Obligation: We need to comply with the law (e.g., maintaining financial records for the government).
• Vital Interests: Processing is necessary to protect someone’s life (e.g., emergency medical interventions).

How We Use Your Data:

• To review and process scholarship applications.
• To verify medical diagnoses and fund breast cancer treatments.
• To process donations and issue receipts.
• To send updates on foundation activities, sensitization campaigns, and impact reports.

4. Processing of Sensitive Personal Data

Because our mission involves assisting women diagnosed with breast cancer, we collect health-related data. Under the NDPA, this is classified as Sensitive Personal Data.

• We will never collect or process your health data without your explicit, written consent.
• Health data is strictly confidential, stored with extra security encryption, and only accessible by authorized medical review personnel within the Foundation.

5. Children’s Privacy and Age Verification

In compliance with Section 31 of the NDPA regarding the privacy rights of children:

• If a scholarship applicant or beneficiary is a child or lacks the legal capacity to consent, we require explicit, verifiable consent from a parent or legal guardian.
• We apply appropriate age-verification mechanisms before processing data related to youths.

6. Data Sharing and Third Parties

We do not sell, trade, or rent your personal data. We may only share your data with trusted third parties under strict confidentiality agreements, including:

• Partner Hospitals & Doctors: For the verification and administration of breast cancer treatments.
• Educational Institutions: To verify the academic standing of scholarship applicants.
• Service Providers: Payment processors, IT support, and hosting platforms that help us operate our website safely.
• Regulatory Authorities: If required by law, court order, or to comply with the Nigeria Data Protection Commission (NDPC).

7. Data Security

We implement robust technical and organizational measures to protect your personal data against unauthorized access, accidental loss, alteration, or disclosure. This includes secure servers, SSL website encryption, and restricted access controls for our staff and volunteers.

8. Data Retention

We will only retain your personal data for as long as reasonably necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting, or reporting requirements. Once the data is no longer needed, it will be securely destroyed or anonymized.

9. Your Rights as a Data Subject

Under Sections 34–38 of the NDPA, you hold the following rights regarding your personal data:

1. Right to be Informed: To know how your data is being used (as explained in this policy).
2. Right of Access: To request a copy of the personal data we hold about you.
3. Right to Rectification: To request correction of inaccurate or incomplete data.
4. Right to Erasure (Right to be Forgotten): To request the deletion of your data when there is no lawful justification for us to keep it.
5. Right to Restrict Processing: To ask us to suspend the processing of your data.
6. Right to Data Portability: To request the transfer of your data to you or a third party in a structured, machine-readable format.
7. Right to Object: To object to our processing of your data, particularly for direct marketing or fundraising appeals.
8. Right to Withdraw Consent: Where we rely on consent to process your data, you can withdraw it at any time.

To exercise any of these rights, please contact us using the details below.

10. Data Breach Notification

In the unlikely event of a personal data breach that risks your rights and freedoms, we will notify you and the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of the breach, in accordance with the NDPA.

11. Changes to This Privacy Policy

We may update this policy periodically to reflect changes in our practices or updates to the NDPA and GAID 2025 regulations. We will notify you of any significant changes by posting the updated policy on our website.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please contact our Data Protection Officer (DPO) at:

PARO Foundation

• Email: info@parofoundation.org
• Phone: +234 703 118 4766
• Office Address: Plot 26, Uloho Avenue, Opposite Ufor Hospital,
  Ughelli, Delta State.