Privacy Policy (Nigeria)

Prepared with regard to the Nigeria Data Protection Act 2023 (NDPA). Effective: 3 September 2026.

1. Data controller

The controller of your personal data is Social Business Global (International Social Benefit Association) (İstanbul, Türkiye). Contact for data matters: in-app support channels and the e-mail address on the hangel.org contact page.

2. What we process

• Account data: name, e-mail, phone number, country, language.
• Usage data: organisations you selected, affiliate-link clicks (click identifier), internal impact statistics.
• Technical data: device type, approximate IP-based location, security logs.
• Blood-donor data (only with separate explicit consent): blood group, city, availability. This is sensitive personal data under section 30 of the NDPA — processed solely for informational matching and never shared for commercial purposes.

3. Purposes and lawful bases

We process data on the lawful bases in section 25 of the NDPA: performance of contract (providing the service); your consent (blood-donor matching, marketing messages), withdrawable at any time; compliance with legal obligations; and our legitimate interest in platform security, balanced against your rights.

4. Sharing and cross-border transfers

• Infrastructure providers (hosting, analytics) — including Google Firebase; data may be stored on servers in the European Union and other jurisdictions. Cross-border transfers are made in line with sections 41–43 of the NDPA (adequacy or appropriate safeguards).
• Affiliate networks — technical click identifiers only, never your name.
• Organisations — aggregated indicators only.
• Public authorities — only upon a valid legal demand.

5. Retention

Account data is kept while your account exists and deleted or anonymised after deletion, unless a longer statutory period applies. Blood-donor data is deleted immediately upon withdrawal of consent.

6. Your rights

Under sections 34–36 of the NDPA you have the right to: be informed; access your data; correction and erasure; restriction and objection; data portability; withdraw consent; and lodge a complaint with the Nigeria Data Protection Commission (NDPC) or seek judicial redress.

7. Security and breaches

We apply encryption in transit, role-based access control and audit logging. Breaches likely to cause a high risk are notified to affected users and, where required by section 40 of the NDPA, to the NDPC.

8. Language and precedence

The binding version of this document is Turkish; this English version is provided for our users in Nigeria, and the hangel interface and documents are also available in Hausa.

9. Google user data

If you are an organisation administrator and connect a Google account to hangel, hangel uses the Google Meet and Google Drive permissions only to create meeting spaces for your online events, to read the attendance records of those spaces for attendance and participation certificates, and to store recordings made in hangel's own meeting room. Data received from Google APIs is not sold, not used for advertising and not used to train artificial intelligence models. Details: Privacy Policy — Google user data.

If you sign in with Google, hangel receives only your Google account identifier, verified e-mail address and name; if you connect Google Calendar, hangel writes the events you registered for only to a separate “hangel” calendar it creates in your account and does not access your other calendars.

In addition, any user may connect their own Google Drive with the drive.file permission only: hangel then fetches only the file you choose in the Google Picker into the action you started (it is not stored permanently) and, at your request, creates or updates in your own Drive a Google Doc or Sheet of content you can already see and download in the panel (project application, meeting notes, participant and attendance lists, etc.). If you pass a chosen file to an AI-powered action, its text is processed only for that request and is not used to train any model.

hangel's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

YouTube: if an organisation administrator connects their own YouTube channel, hangel uses the youtube.force-ssl permission only to create, start and end live broadcasts on that channel for Oda events; the stream key is kept only on the server. This feature uses YouTube API Services; by using it you agree to the YouTube Terms of Service. How Google processes data: Google Privacy Policy.

You can withdraw access with the disconnect button in the hangel panel or at https://myaccount.google.com/permissions.