Privacy Notice (NDPA 2023)

1. Why We Collect Your Data (Purpose of Processing)

The Future Now Roadshow collects and processes personal information strictly for:

• Administering event registrations and issuing verifiable QR admission tickets for regional stops.
• Evaluating challenge entries in Build for Oyo, Farm Smart Oyo, and Oyo's Most Creative against published criteria.
• Facilitating mentor matching and enterprise partnerships for shortlisted finalists.
• Compiling aggregated, anonymised impact reports on youth entrepreneurship across Oyo State's 33 LGAs.

2. Lawful Basis: Explicit & Informed Consent

Under Section 25 of the Nigeria Data Protection Act 2023, the lawful basis for our processing is your freely given, informed, and explicit consent. All optional items (such as programme updates or sharing contact details with corporate partners) are presented as unticked checkboxes. Nothing is shared with external partners without your separate, affirmative opt-in.

3. Data Minimisation & Prohibited Data

In accordance with our strict data protection principles, we adhere to absolute data minimisation:

• We only collect essential details required to manage event attendance and evaluate challenge submissions.
• We NEVER collect National Identity Numbers (NIN), Bank Verification Numbers (BVN), or financial account passwords.
• We do not collect sensitive government IDs, unnecessary biometric records, or irrelevant personal profiling data.
• Public voting identifiers (phone or email) are immediately hashed using cryptographic algorithms. Plaintext identifiers are never stored.

4. Security Architecture & Field-Level Encryption

Your data is protected at rest and in transit using bank-grade cryptographic standards:

• Field-Level Encryption: Sensitive PII fields (mobile numbers and dates of birth) are encrypted at the application level using AES-256-GCM before database insertion.
• TLS 1.3 Everywhere: All communications between your device and our servers are encrypted with modern TLS.
• Zero PII in Logs: Application and operational logs pass through automatic redaction filters preventing tokens, phone numbers, or emails from being written to stdout.
• Private Media Storage: Uploaded creative files are stored in private AWS S3 buckets and accessed only via short-lived signed URLs. EXIF geolocation data is stripped from uploaded images.

5. Retention & Scheduled Anonymisation

Personal data is retained for an administrative period of 24 months following the Grand Finale (until January 2029) to facilitate prize distribution, post-programme pilot tracking, and longitudinal impact reporting. Following this window, an automated anonymisation job purges all identifying names, contacts, and IP records while preserving statistical demographic totals. This job is disabled by default and requires Super Admin authorization.

6. Your Data Subject Rights (Self-Serve Tools)

Under the NDPA 2023, you hold full rights over your data. You can exercise these rights directly within your Participant Dashboard: