Privacy notice

1. Who is responsible for your data

Data controller: Office of the Special Assistant to the President on Capacity Development, acting in conjunction with and under the supervision of the Office of the Secretary to the Government of the Federation.

Address for correspondence: Outstanding item — the controller’s postal address is to be supplied by the Office and is published in this notice when it is. Correspondence in the meantime is received at dpo@cdtin.org.

Data Protection Officer: Appointment outstanding — the Office is required to appoint a Data Protection Officer and to publish and register their details. That appointment has not yet been made. Until it is, data-protection correspondence is received at dpo@cdtin.org and is handled by the implementing office. This notice is updated with the officer’s name on appointment.

Registration with the Nigeria Data Protection Commission: Registration pending — a controller that processes the personal data of more than two hundred people within six months is a data controller of major importance under the Act, and nominations to this scheme pass that threshold whatever the final intake turns out to be. The registration number is published in this notice as soon as it is issued.

2. What this notice covers

This notice covers personal data processed through this platform and through the delivery of the Agriculture, Digital and Business Development Skills Pilot Scheme in Nasarawa State: nomination and selection, verification, training delivery, assessment, certification, monitoring and evaluation, and publicity. It applies to nominees, to participants, and to the officers who countersign nominations.

3. The personal data collected

Only what the scheme needs is collected. The categories are:

From a nominee

• Identity: full name, date of birth, gender, National Identification Number, state of origin, and Local Government Area of residence.
• Contact: residential address, phone number, email address.
• Background: highest qualification, institution attended, and a description of relevant experience.
• Inclusion monitoring: disability status, and the accommodation you need in order to take part.
• Stream-specific detail — for agriculture: whether you are a practising farmer, your cooperative, your access to farmland and the size of your holding; for digital: your intended use of digital skills and your prior computer experience; for business development: your type of business, how long it has traded, whether it is registered, and a band for its monthly turnover.
• Declaration: your acceptance of the declaration, the name you declared under, and the date and time of the declaration.

From the nominating authority

• Name, designation, organisation, address, phone number and email address of the officer.
• The countersignature decision, the name signed, any reason given for declining, and any scan of an official stamp that is uploaded.

Generated during delivery

• Cohort assignment, attendance by training day, assessment attempts and scores, lesson progress on the online platform, and certificate details including serial number and verification code.
• Photographs and film taken at training events in which you may be identifiable.
• Where a participant account is created: email address, password held only as a cryptographic hash, and session records.

Technical data

• The IP address and browser identification recorded at the point of submission, and security and audit logs recording actions taken on records by named staff.

4. Why the data is used, and the lawful basis for each purpose

The Act requires a lawful basis for each purpose, and each purpose is stated separately below.

Two things, and only two, run on consent: the use of your photograph, and contact for the tracer study. They are asked for separately from each other and from the nomination itself; there is no single box that agrees to everything. Refusing either, or withdrawing either later, has no effect whatsoever on your nomination, your place, your training or your certificate. Withdrawal does not undo processing that was lawful before you withdrew.

5. The National Identification Number

The NIN is the most sensitive identifier the scheme handles, and it is treated as such. It is encrypted where it is stored, using a key held outside the application. It is never displayed in full on any screen — only the last few digits are shown — and it is never written into a web address, never included in a report or an export, and never written to a log. Verification against the National Identity Management Commission is carried out by the programme office after submission, as a back-office step; it is not a gate on submitting your nomination.

6. Sensitive personal data

Disability status and accommodation needs are health-adjacent and attract heightened protection. They are collected for one reason: to deliver the commitment that not less than 50 per cent of participants are women, youth and persons living with disabilities, and to make the venue, the seating and the field practicals usable by you. Access is restricted to the staff who arrange delivery, the data is excluded from routine exports and reporting, and it is reported only as an aggregate.

7. Who the data is shared with

• The Office of the Secretary to the Government of the Federation, as the supervising office, in cohort and consolidated reports.
• The National Identity Management Commission, or a licensed verification provider acting for the programme, for identity verification only.
• Hostinger (hosting) — acting as a processor, only on the controller’s written instructions, and not for any purpose of its own.
• Facilitators and training providers engaged for your cohort, limited to the attendance, assessment and accommodation information needed to teach and assess you.
• Independent auditors and, where the law requires it, regulators or law enforcement.

Personal data is never sold, never rented, and never used for advertising. It is not shared with political organisations. No third-party analytics, advertising or social media service runs on this site.

8. Transfers outside Nigeria

This site is built to keep data in as few places as possible: it makes no third-party requests at all — no external fonts, no analytics, no maps, no content delivery network, no social media embeds. Every image, style and script is served from this domain.

Some infrastructure that supports the service may nonetheless be operated from outside Nigeria — the hosting provider’s servers or backup storage, and the provider used to deliver email. Where that results in a transfer of personal data outside Nigeria, the transfer is disclosed to the Commission at registration and is made only on a basis the Act permits, under a written agreement imposing the same protections that apply here. You may ask the Data Protection Officer where your data is held.

9. How long the data is kept

“Retained indefinitely, in case it is useful” is not a retention schedule and is not applied here.

10. How the data is protected

• The National Identification Number is encrypted at rest and masked everywhere it is displayed.
• Passwords are stored only as cryptographic hashes and are never recoverable.
• Access is limited to named staff by role, and actions taken on records are logged.
• The site is served over an encrypted connection and blocks third-party content by policy.
• A breach that is likely to risk your rights and freedoms is reported to the Nigeria Data Protection Commission within 72 hours of the Office becoming aware of it, and where the risk is high, you are told directly and in plain language.

11. Cookies

Only strictly necessary cookies are used: one to keep you signed in if you hold an account, and one to protect forms against cross-site request forgery. There are no analytics cookies, no advertising cookies and no third-party cookies, which is why this site does not show you a cookie banner — there is nothing to consent to.

12. Automated decisions

No decision producing a legal or similarly significant effect on you is made by automated means alone. Screening, shortlisting and cohort assignment are carried out by programme staff. Automated checks are used only to flag duplicate or incomplete records for a person to look at.

13. Your rights

Under the Nigeria Data Protection Act 2023 you have the right to:

• be told what personal data is held about you, and to be given a copy of it;
• have inaccurate data corrected, and incomplete data completed;
• have data erased where it is no longer needed for the purpose it was collected for;
• restrict or object to processing in the circumstances the Act allows;
• receive data you provided in a portable form, and to have it transmitted to another controller where that is technically feasible;
• withdraw a consent at any time, as easily as it was given;
• complain to the Nigeria Data Protection Commission.

How to exercise a right. Write to the Data Protection Officer at dpo@cdtin.org, saying what you want and giving your application reference if you have one. Your identity is checked before any data is released or changed — this protects you. A request is answered within one month; if a request is complex the period may be extended, and you are told why before the month is out. There is no charge, unless a request is manifestly unfounded or excessive, in which case you are told the reason and the alternative.

If you hold an account, some of these rights can be exercised directly: you can see your own application record and its progress at the status page.

14. Complaints

If you are not satisfied with how your personal data has been handled, tell the Data Protection Officer first — most problems are resolved that way. You have the right, at any time and without going through that step, to complain to the Nigeria Data Protection Commission, the regulator for data protection in Nigeria, through the complaint channels the Commission publishes at ndpc.gov.ng.

15. Changes to this notice

This notice is version 2026-08-v1. It is updated when the processing changes — including when the Data Protection Officer is appointed and when the Commission issues the registration number. Where a change materially affects you, participants and nominees are told directly rather than left to notice the change here. The version under which you gave any consent is recorded against that consent.