Privacy notice

1. Who we are

This website is run by Lumiere Resources Ltd, registration number RC 9972804, of 9 Obigbo Street, Old GRA, Aba, Abia State, Nigeria ("we", "us"). We decide how your personal data is used, so we are the "data controller" under the Nigeria Data Protection Act 2023 (NDPA).

Lumiere Advisory is the consultancy of Lumiere Resources. The Lumiere Leadership Academy, Women in Leadership and Governance and the Lumiere Leadership Network are nonprofit initiatives affiliated with Lumiere Resources whose registration is in progress. They are not yet separate legal persons, so Lumiere Resources Ltd is the data controller for the website, applications, payments, programme administration and the messages we send about them. When an initiative is registered we will review who decides how your data is used; it may become a controller itself, alone or jointly with us, and we will update this notice before anything changes.

Contact for privacy questions: privacy@lumiereresources.org. Data protection contact: [name and role].

2. What we collect and why

When you apply to a programme. Your full name, date of birth, gender, country and city or state, email, phone, school, organisation or employment, your answers about your motivation and goals, your availability and device access, and, for a women's programme, your declaration. We use it to decide whether you are eligible and to review your application. Your date of birth is used only to check the age rule on the programme start date. We use your email and phone number to send you messages about your application, payments and sessions, including short text messages; these never contain payment links and are never marketing, and you can reply STOP to stop the texts. Our basis: your consent, and taking the steps you ask for before you join a programme.

Hardship, access and scholarship answers (optional). Any barrier to taking part, whether you ask for a scholarship or financial help, and the reasons you give. This can reveal sensitive information about you. We use it only to support you and to decide on fee reductions. Only the programme manager and the Executive Director see it, never the reviewers who score applications. We collect it only if you tick a separate consent box on the form, which is never ticked for you. You can apply without giving it, and you can withdraw your consent at any time. Our basis: your explicit consent.

If you join the Lumiere Leadership Network. The Network is a Christian-faith community, so joining it may reveal your religious beliefs. We ask for your separate, express consent on the joining form and record when you gave it. Joining is optional and is never a condition of the Lumiere Leadership Academy or Women in Leadership and Governance.

Your consent is recorded. For each consent you give on our forms we keep the date and time and the version of this notice you were shown.

When you pay. The amount, currency, date, payment reference and the type of payment method, as returned by our payment provider. We never see your card number. We use it to record your payment, send a receipt and keep our accounts. Our basis: contract and our legal obligations.

When you take part in a programme. Attendance at sessions, notes by the programme manager, our messages to you, and your outcome. We use it to run the programme, track the attendance needed to graduate and support you.

When you contact us or ask for a consultation. Your name, organisation, email, phone and message. We use it to reply to you. Our basis: our legitimate interests in answering enquiries and your consent. A newsletter is separate, opt-in and unticked by default.

Staff and reviewers. Name, work email, role, sign-in activity and a log of what they view or change. We use it to keep applicant data secure.

Photos and testimonials. Only if you agree on our separate consent form, which lets you choose each use separately (for example the website but not social media, or a quote without your full name). Agreeing is never a condition of a place, a scholarship or taking part. You can withdraw at any time by email to privacy@lumiereresources.org or through our online form: we stop any new use straight away and remove what we control online within [14] days. Printed material already handed out cannot always be recalled, and copies others have shared on social media are governed by those platforms' own policies and cannot always be retrieved.

We do not ask for proof of gender, religion or political views. If you choose to tell us about health, disability or access needs, we use it only to help you take part, and it does not affect scoring.

3. Who sees your data

• Reviewers who score applications see your answers but not your email, phone number or hardship answers.
• Programme managers and the Executive Director see contact details and hardship answers for the programmes they run.
• Everyone with access signs in with a password and a code from an authenticator app, and what they do is recorded.
• We do not sell your data. We do not share data between our programmes or entities without your consent, except as needed for Lumiere Resources to collect payments for them.

4. Service providers and transfers outside Nigeria

We use the following providers to run the website. They process data only on our instructions.

• Database: Supabase, stored in the United Kingdom (London).
• Website hosting: Vercel, United States; pages may be served from its data centres in other countries.
• Payments: Paystack, Nigeria. Card details go to Paystack, never to us.
• Email delivery: Twilio SendGrid, United States.
• Text messages (SMS): Twilio, United States.
• Spam protection on our forms, domain and email routing: Cloudflare, which operates worldwide.
• Live sessions: Zoom, United States.

So your data may be stored in or reached from the United Kingdom, the United States and other countries. Under section 41 of the NDPA we transfer it only where it will be adequately protected: we rely on [the transfer basis for each provider, for example the provider's data processing agreement and its contract terms, to be confirmed by our lawyer]. We keep a record of these transfers. You can ask us for details at privacy@lumiereresources.org.

5. How long we keep it

• Unsuccessful applications: [12 months] after the decision, then deleted.
• Selected applicants and participants: the programme plus [3 years], then deleted or anonymised.
• Payment and accounting records: [6 years].
• Hardship, access and scholarship answers: removed 30 days after we send you the outcome of your application, or, if you receive a scholarship, 30 days after the programme ends.
• Applications you start but do not send: deleted after 30 days.
• Staff activity logs: [12 months].
• Newsletter list: until you unsubscribe.
• Photos and testimonials: until you withdraw consent, and removed within [14] days.

6. How we protect it

• The site uses HTTPS. Card details are entered on our payment provider's secure page and never reach our servers.
• Staff accounts need a password and an authenticator code, lock after repeated wrong attempts, and sessions expire.
• Our database is reachable only through our private server.
• We limit who sees sensitive answers and keep a log of access.
• No system is perfectly secure. If a personal data breach is likely to put people's rights and freedoms at risk, we will tell the Nigeria Data Protection Commission within 72 hours of becoming aware of it. If it is likely to put you at high risk, we will tell you immediately, in plain language, with what happened and what you can do. We keep a record of every breach and what we did about it.

7. Your rights

Under the NDPA you can ask us to give you a copy of your data, correct it, delete it, restrict or stop us using it, move it to another provider, and withdraw your consent at any time (withdrawing does not affect use before then). To ask, write to privacy@lumiereresources.org. We will reply within [30 days]. You may also complain to the Nigeria Data Protection Commission.

If you live outside Nigeria, the data protection law of your own country may also apply to you. For example, where the UK or EU General Data Protection Regulation applies to our processing, we will meet our obligations under it; whether it applies depends on the circumstances.

8. Children

You must be 18 or over to apply to the Lumiere Leadership Academy or Bloom and Blossom. Where a programme includes secondary-school students under 18, they never sign up with us directly: they take part through their school with a parent or guardian's written consent, we collect only what is needed, and we do not send them marketing. Our information for young people and their parents explains this in plain words.

9. Automated checks

The website automatically checks the age rule from your date of birth and the programme start date, and tells you if you are not eligible. A person reviews every other decision. We do not use automated profiling to select participants.

10. Cookies

We use only the cookies needed for the site to work: keeping staff and applicants signed in, and, on our forms, Cloudflare's spam check. These are strictly necessary, so they do not need your consent. We do not use analytics, advertising or tracking tools of any kind. If we ever add one, it will stay off unless you choose to accept it, with a clear choice to accept, reject or manage it, and we will update this notice first.

If you save an application to finish later, your answers are kept in your own browser on that device, and on our server only if you ask us to email you a link.

11. Changes

We will post any changes here and update the date above.