Privacy Policy

1. Controller and processor roles

For data about our direct customers and website visitors (for example, community administrators who sign up), Kommunity is the data controller. For personal data that a community uploads about its own members, the community (through its admins) is the data controller and Kommunity acts as a data processor, handling that data only to provide the Service and on the community's instructions.

2. Contact

For any privacy question or to exercise your rights, contact us at hello@akenrose.com, call +234 708 974 1989, or write to us in Lagos, Nigeria. If you are a member of a community, you can also contact your community's admin, who controls your data on the Service.

3. Data we collect

• Account data: name, email address, phone number, password (stored only as a secure hash), and role.
• Member data (on behalf of communities): names, contact details, dates of birth, addresses, chapter or group, membership status, and similar details a community chooses to record.
• Payment data: records of dues, donations, and top-ups — amounts, dates, and references. Card and bank credentials are collected and processed directly by Paystack; we do not store full card numbers.
• Communications: emails and SMS we send on your or your community's behalf, and messages you send us.
• Usage and device data: log data such as IP address, actions taken, and timestamps, used to run and secure the Service.

4. How we use data and our lawful basis

Under the NDPA, we rely on one or more of these lawful bases:

• Performance of a contract — to provide the Service to you and your community.
• Consent — where you or a community member has given consent (for example, to receive certain messages); consent can be withdrawn at any time.
• Legitimate interests — to secure, maintain, and improve the Service, and to prevent fraud and abuse, balanced against your rights.
• Legal obligation — to meet requirements under applicable law.

5. Sharing and service providers

We do not sell personal data. We share it only with service providers who help us run the Service, under contracts that require them to protect it and use it only as instructed. These include:

• Paystack — to process payments and settlements;
• Our email provider — to deliver transactional and community emails;
• Our SMS provider — to deliver text messages when SMS is enabled;
• Our hosting and database providers — to store and run the Service securely.

We may also disclose data where required by law, to enforce our Terms, or to protect the rights and safety of users and the public.

6. International transfers

Some of our providers process data outside your country. Where personal data is transferred across borders, we take steps required by the NDPA and applicable law to ensure it remains adequately protected, such as relying on adequacy, appropriate contractual safeguards, or your consent.

7. Data retention

We keep personal data for as long as needed to provide the Service and for a reasonable period afterwards, or longer where the law requires (for example, financial records). Communities can update or delete member records, and you can ask us to delete your account data, subject to legal retention requirements.

8. Security

We use technical and organisational measures to protect personal data, including encryption in transit, hashed passwords, access controls, and least-privilege handling of sensitive data such as bank details. No system is perfectly secure, but we work continuously to protect your information.

9. Your rights

Subject to the NDPA and applicable law, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• request deletion of your data;
• object to or restrict certain processing;
• withdraw consent where processing is based on consent;
• request a portable copy of data you provided; and
• lodge a complaint with a supervisory authority (see below).

If you are a community member, requests about your membership data are usually best directed to your community's admin (the controller); we will assist them as processor.

10. Children's data

Administrator accounts are for adults (18+). Some communities may record data about members who are minors. Where they do, the community is responsible for obtaining any consent required from a parent or guardian under the NDPA and applicable law. We do not knowingly use children's data for any purpose beyond providing the Service to the community.

11. Cookies and similar technologies

We use only the cookies and local storage needed to sign you in and keep the Service working (for example, to maintain your session). We do not use third-party advertising cookies.

12. Data breaches

If a personal data breach occurs that is likely to result in harm, we will act promptly to contain it and will notify the relevant supervisory authority and affected people as required by the NDPA and applicable law.

13. Complaints

If you have a concern we have not resolved, you may complain to the Nigeria Data Protection Commission (NDPC), or to the data protection authority in your own country. We would appreciate the chance to address your concern first — please contact us at hello@akenrose.com.

14. Changes to this policy

We may update this Policy from time to time. We will post the updated version here with a new effective date and, for material changes, take reasonable steps to notify you.