Privacy Policy – NEXORA FUND

1

Who We Are

NexoraFund is a grant-matching and NGO support platform accessible at nexorafund.org, developed and operated by Sponsorbridge Ltd, a consulting firm registered in the Federal Republic of Nigeria.

For the purposes of this Privacy Policy, Sponsorbridge Ltd is the Data Controller responsible for determining how and why your personal data is processed. When we say "we", "us", or "our", we mean Sponsorbridge Ltd operating the NexoraFund platform.

📌 This policy explains what personal and organisational data we collect, why we collect it, how we use and protect it, and what rights you have under the Nigeria Data Protection Act 2023 (NDPA) and applicable international standards.

By using the NexoraFund platform, you acknowledge that you have read and understood this Privacy Policy.

2

Data We Collect

We collect the following categories of information when you use NexoraFund:

A. Information You Provide Directly:

Full name and job title of the account representative.
Organisation name, registration number, and country of operation.
Email address, phone number, and physical address.
Organisation documents uploaded for NGO verification (e.g. certificates of incorporation, tax exemption letters).
Grant proposals, project descriptions, and supporting materials submitted via the platform.
Billing details (processed and stored securely by our payment provider; we do not store full card numbers).
Communications you send to our support or legal team.

B. Information Collected Automatically:

IP address, browser type, operating system, and device identifiers.
Pages visited, features used, time spent on the platform, and click activity.
Referral source (how you found us).
Session logs and error reports for platform diagnostics.
Cookie identifiers and tracking pixels (see Section 10).

C. Information from Third Parties:

Verification data from third-party document authentication services.
Public registration data from government or NGO databases to cross-check submitted credentials.
Payment status and transaction data from our payment processor.

3

How We Use Your Data

We use your data only for the purposes described below. We do not use your data for any purpose beyond what is necessary to deliver the platform's services.

Account Management: To create, maintain, and secure your account on the platform.
NGO Verification: To review and authenticate submitted documents as part of our verification programme.
AI-Powered Grant Matching: To analyse your organisation's profile and match it with relevant grant opportunities using our matching algorithms.
Service Communications: To send you grant alerts, application updates, platform notifications, and account-related emails.
Customer Support: To respond to your queries, complaints, and requests via email or the platform dashboard.
Billing & Payments: To process subscription payments and manage your billing history.
Platform Improvement: To analyse usage patterns and improve the platform's features, design, and AI accuracy.
Legal Compliance: To comply with applicable Nigerian law, regulatory obligations, and lawful requests from authorities.
Fraud Prevention: To detect, investigate, and prevent fraudulent activity, data breaches, and misuse of the platform.

✅ We will never use your data for unsolicited advertising, sell it to third-party marketers, or share it for purposes not described in this policy.

4

Legal Basis for Processing

Under the Nigeria Data Protection Act 2023 (NDPA), we are required to have a valid lawful basis for processing personal data. Our lawful bases are:

Contractual Necessity: Processing your data is necessary to perform the contract between you and Sponsorbridge Ltd (i.e. providing the NexoraFund platform services).
Legitimate Interests: We process certain data (e.g. usage analytics, fraud detection) based on our legitimate interest in maintaining a safe, functional, and effective platform — provided these interests are not overridden by your rights.
Consent: Where we process data based on your consent (e.g. marketing emails), you may withdraw consent at any time without affecting the lawfulness of prior processing.
Legal Obligation: We may process and retain data where required by Nigerian law, court order, or regulatory authority.

📌 Where we rely on consent, you have the right to withdraw it at any time by emailing legal@nexorafund.org or updating your notification preferences in the dashboard.

5

Data Sharing & Third Parties

We do not sell, rent, or trade your personal data. We may share your data with the following trusted third parties only where strictly necessary:

Payment Processors: To handle subscription payments securely. They are contractually bound to use your data only for payment processing.
Cloud Infrastructure Providers: Our platform is hosted on secure cloud infrastructure. All providers are contractually required to maintain appropriate security standards.
Verification Partners: Third-party services used to authenticate NGO documents and registration credentials.
Analytics Tools: Aggregated, anonymised usage data may be processed by analytics platforms to help us improve the platform.
Legal & Regulatory Authorities: Where required by Nigerian law, court order, or to protect the rights, property, or safety of NexoraFund, Sponsorbridge Ltd, or other users.
Professional Advisors: Solicitors, auditors, or consultants who are bound by confidentiality obligations.

All third parties we work with are required to handle your data in accordance with applicable data protection laws and our data processing agreements.

🚫 We will never share your organisation's private documents, proposals, or grant application content with any funder or third party without your explicit consent.

6

International Data Transfers

NexoraFund serves users in over 40 countries. As a result, your data may be transferred to and processed in countries outside the Federal Republic of Nigeria, including countries within the European Union, the United Kingdom, and the United States.

Whenever we transfer your data internationally, we ensure appropriate safeguards are in place, including:

Standard contractual clauses (SCCs) approved by relevant data protection authorities.
Transfers only to countries or organisations that provide an adequate level of data protection.
Encryption of data in transit using industry-standard TLS/SSL protocols.

🌍 We are committed to ensuring your data is protected to the same standard regardless of where it is processed, consistent with the NDPA 2023 and GDPR principles.

7

Data Retention

We retain your personal and organisational data only for as long as necessary to fulfil the purposes described in this policy, or as required by law.

Active Accounts: Data is retained for the duration of your account's activity.
Closed Accounts: Upon account closure, data is deleted or anonymised within 30 days, subject to legal retention obligations.
Verification Documents: Retained for up to 3 years from submission date for audit and compliance purposes.
Billing Records: Transaction records are retained for 7 years in accordance with Nigerian financial regulations.
Support Communications: Retained for up to 2 years from the date of the last interaction.
Legal Hold: Where data is subject to ongoing legal proceedings or regulatory investigation, it will be retained until the matter is resolved.

After retention periods expire, data is securely deleted or anonymised so it can no longer identify you.

8

Security Measures

Protecting your data is a core priority for NexoraFund and Sponsorbridge Ltd. We employ the following security measures:

🔒 256-bit SSL/TLS Encryption for all data transmitted between your device and our servers.
🛡️ At-rest encryption for all stored data, including documents and personal details.
🔐 Role-based access controls (RBAC) to ensure only authorised personnel can access sensitive data.
🔄 Regular security audits and vulnerability assessments of our infrastructure.
📊 Intrusion detection systems to monitor for unauthorised access attempts.
💾 Regular backups stored in geographically distributed, encrypted locations.
👤 Two-factor authentication (2FA) available and recommended for all user accounts.

⚠️ While we take all reasonable measures to protect your data, no system is 100% immune to breaches. In the event of a data breach affecting your rights, we will notify you and the relevant authority within 72 hours as required by the NDPA 2023.

9

Your Data Rights

Under the Nigeria Data Protection Act 2023 (NDPA) and applicable international standards, you have the following rights regarding your personal data:

👁️

Right to Access

Request a copy of all personal data we hold about you.

✏️

Right to Rectification

Request correction of any inaccurate or incomplete data.

🗑️

Right to Erasure

Request deletion of your personal data ("right to be forgotten").

⏸️

Right to Restrict

Request that we limit how we process your data in certain circumstances.

📦

Right to Portability

Receive your data in a structured, machine-readable format.

🚫

Right to Object

Object to processing based on legitimate interests or for direct marketing.

To exercise any of these rights, please email legal@nexorafund.org with your request. We will respond within 30 days. We may ask you to verify your identity before processing the request.

📌 You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your data rights have been violated.

10

Cookies & Tracking Technologies

NexoraFund uses cookies and similar tracking technologies to enhance your experience on the platform. Here is a summary of the types of cookies we use:

Strictly Necessary Cookies: Essential for the platform to function. These cannot be disabled (e.g. session cookies, authentication tokens).
Functional Cookies: Remember your preferences such as language settings, dashboard layout, and login state.
Analytics Cookies: Collect anonymised data on how users interact with the platform to help us improve performance and usability.
Marketing Cookies: Used only with your explicit consent to deliver relevant content and measure the effectiveness of our communications.

You can manage your cookie preferences at any time via:

The cookie settings banner displayed on your first visit to the platform.
Your browser settings — most browsers allow you to block or delete cookies.
Emailing legal@nexorafund.org to opt out of non-essential tracking.

⚠️ Disabling strictly necessary cookies may impair the functionality of the platform and prevent you from accessing certain features.

11

Children's Privacy

NexoraFund is a professional B2B platform designed exclusively for organisations, NGOs, and individuals aged 18 years and above. We do not knowingly collect, process, or store personal data from individuals under the age of 18.

If you believe that a minor has submitted personal data to our platform without appropriate consent, please contact us immediately at legal@nexorafund.org and we will take steps to delete the information promptly.

12

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

Update the Effective Date at the top of this page.
Send a notification email to all registered users.
Display a prominent notice on the platform dashboard.

Your continued use of the platform after changes take effect constitutes your acceptance of the updated Privacy Policy. If you do not agree, you must cease using the platform and close your account.

The current version of this policy will always be available at nexorafund.org/privacy-policy.

13

Contact Us

If you have any questions, concerns, or requests related to this Privacy Policy or how we handle your data, please contact our Data Protection team:

📧 Email: legal@nexorafund.org
🌐 Website: nexorafund.org/contact-us
🏢 Data Controller: Sponsorbridge Ltd, Federal Republic of Nigeria
⚖️ Regulatory Authority: Nigeria Data Protection Commission (NDPC)

⚖️ We aim to respond to all data-related requests within 30 days. For urgent matters, please include "DATA REQUEST – URGENT" in your email subject line and we will prioritise your case.

You also have the right to escalate unresolved complaints to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.