Privacy Policy

The Ondo State Sustainable Cocoa Multi-Stakeholder Platform ("OSCP", "the Platform", "we") takes the privacy of everyone who interacts with this website and our services seriously. This policy explains what personal data we collect, why, how it is used, with whom it is shared, and the rights you have over it.

This policy is intended to align with the Nigeria Data Protection Act (NDPA) 2023 and the Nigeria Data Protection Regulation (NDPR), and to reflect standards consistent with the principles of the EU General Data Protection Regulation (GDPR), given the involvement of EU-funded partners.

1. Who we are

The OSCP is a multi-stakeholder platform coordinated by a Secretariat based in Akure, Ondo State, Nigeria. The Platform is jointly supported by the European Union and the German Federal Ministry for Economic Cooperation and Development (BMZ) and is implemented in part by GIZ under the VACE – Value Chains for Agribusiness, Climate & Employment Programme.

For any questions or requests regarding this policy or your personal data, contact the OSCP Secretariat at:

• Address: Secretariat, Alagbaka, Akure, Ondo State, Nigeria
• Phone: +234 803 472 9424 / +234 706 594 9966

2. What personal data we collect

We collect personal data in the following circumstances:

When you contact us via this website (via the Contact form): your full name, organisation, email address, phone number (if provided), and the content of your message.

When you apply for OSCP membership (via the linked Google Form managed by the Secretariat), you will be asked to provide your name, contact details, organisation, stakeholder category and, because the Platform is designed to be inclusive and to track representation across the cocoa value chain, voluntary demographic information, including gender, age group, and disability status.

Automatically, when you use this website: standard technical information, such as your device type, browser, approximate location, and pages visited, collected via basic web analytics.

3. Why we collect it, and our lawful basis

We collect personal data only for specific, legitimate purposes:

• To respond to enquiries submitted through the Contact form
• To review and process membership applications
• To communicate with members about Platform activities, meetings, and events
• To report on Platform representation and inclusion to funders and stakeholders (in aggregate, non-identifying form)
• To improve the Platform's website and services

Our lawful bases for processing under the NDPA include your consent (freely given when you complete a form), the performance of tasks in the public interest (platform coordination and inclusive representation), and our legitimate interests in operating and improving the Platform, balanced against your rights.

Sensitive personal data (including disability status and, in the Nigerian regulatory context, age category) is collected only when you voluntarily provide it, solely for the purposes stated above (particularly inclusion monitoring), and is handled with additional care.

4. Who we share it with

We do not sell your personal data. We share it only in these circumstances:

• The OSCP Secretariat: staff responsible for platform administration have access to submitted data as necessary to perform their role.
• Google (as a data processor): the membership registration form is hosted on Google Forms, so form responses are stored on Google infrastructure subject to Google's own privacy terms. Contact form submissions may also be processed through third-party services in a similar way.
• Funding partners (EU, BMZ, GIZ): we may share aggregated, non-identifying reports on membership composition and Platform activity for reporting and accountability purposes. Individual personal data is not shared with funders unless legally required or with your explicit consent.
• Legal or regulatory authorities: where required by Nigerian law or a valid legal process.

We do not transfer personal data outside Nigeria except to the extent that our third-party service providers (such as Google) store data on international infrastructure. In such cases, we rely on those providers' compliance with recognised international data protection standards.

5. How long we keep your data

We retain personal data only for as long as necessary for the purposes it was collected:

• Contact form submissions: retained for up to 24 months, then deleted unless they form part of an ongoing engagement
• Membership records: retained for the duration of your membership and for a reasonable period afterward for institutional record-keeping
• Analytics data: retained in aggregated form as necessary for reporting

6. Your rights

Under the NDPA, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data, subject to legal or contractual retention requirements
• Object to certain uses of your data, including for direct communications
• Withdraw consent at any time, where processing is based on your consent
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your rights have been violated

To exercise any of these rights, contact the Secretariat using the details in Section 1. We will respond within the timeframes required by the NDPA.

7. How we protect your data

We take reasonable technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure, alteration, and destruction. These include secure data storage, restricted access on a need-to-know basis, and use of reputable third-party services with their own security commitments.

However, no method of transmitting or storing data over the internet is entirely secure. We cannot guarantee absolute security, and we encourage you to think carefully before sharing sensitive information through any online form.

8. Cookies and analytics

This website uses a small number of essential cookies to function correctly, and may use basic analytics tools to understand how visitors use the site. We do not use cookies for advertising or third-party tracking.

9. Children

This Platform is designed for adult stakeholders in the cocoa value chain. We do not knowingly collect personal data from anyone under 18 years old. If you believe we have inadvertently collected such data, please contact us and we will delete it.

10. Changes to this policy

We may update this policy from time to time. Material changes will be reflected in the "Last updated" date above, and where appropriate, we will notify members directly.

11. Contact

Questions, requests, or concerns about this policy or your personal data should be directed to the OSCP Secretariat:

• Address: Secretariat, Alagbaka, Akure, Ondo State, Nigeria
• Phone: +234 803 472 9424 / +234 706 594 9966