Data Protection & NDPR/NDPC Compliance

Excella Digital is committed to protecting the personal data of every Urgent2k user — beneficiaries, donors, and visitors — in accordance with the highest standards prescribed by Nigerian law. We treat data protection not as a compliance checkbox but as a core product principle.

Under the NDPA 2023, you have the following rights:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — correct inaccurate or incomplete personal data.
• Right to erasure — request deletion of your data where there is no compelling legal reason for continued processing.
• Right to restriction — request that we limit processing in certain circumstances (e.g., while a dispute is being resolved).
• Right to data portability — receive your data in a structured, commonly used, machine-readable format.
• Right to object — object to processing based on legitimate interest or for direct marketing (we do not engage in direct marketing based on personal data).
• Right to withdraw consent — withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right not to be subject to automated decision-making — request human review of any decision made solely by automated processing that significantly affects you.

To exercise any right, email our Data Protection Officer at dpo@excelladigital.com. We will respond within fourteen (14) days.

We engage the following categories of processors, each bound by a DPA:

• Payment processor — Flutterwave (payment initiation and settlement).
• Identity verification — authorised NIN verification API providers.
• Cloud infrastructure — hosting and database services with data centres that meet international security standards.
• Communication — email and SMS delivery providers for transactional notifications.

No processor has access to more data than strictly necessary for their specific function.

Personal data is primarily stored and processed within Nigeria. Where infrastructure necessitates transfer to servers outside Nigeria, we ensure:

• The receiving country provides adequate data protection, or
• Appropriate safeguards are in place (contractual clauses, DPAs), and
• The transfer is lawful under Section 43 of the NDPA 2023.

We do not transfer data to jurisdictions that fail to meet NDPC adequacy standards without explicit user consent.

We conduct Data Protection Impact Assessments before introducing new features or processing activities that may pose a high risk to data subjects. DPIAs are documented internally and available for review by the NDPC upon request.

Excella Digital has appointed a Data Protection Officer responsible for:

• Monitoring compliance with the NDPA, NDPR, and internal data protection policies.
• Serving as the point of contact for data subjects exercising their rights.
• Liaising with the NDPC on audits, complaints, and breach notifications.
• Conducting internal training and awareness programmes.

Contact the DPO at dpo@excelladigital.com.

If you believe your data protection rights have been violated, you may:

1. Contact our DPO at dpo@excelladigital.com — we will investigate and respond within 14 days.
2. If unsatisfied, lodge a formal complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

This data protection notice may be updated from time to time to reflect changes in law, technology, or our business practices. Material changes will be communicated via in-app notification or email. The "Last updated" date at the top of this page will always reflect the most recent revision.