Privacy Policy

1. Introduction

Welcome to C&S Youth Connect, the digital home of The International Youth Fellowship, Cherubim & Seraphim Unification Church. We are committed to protecting your personal information and respecting your privacy.

This Privacy Policy explains what information we collect when you use our platform, why we collect it, how we keep it safe, and the choices and rights you have regarding your personal data.

2. Named legal framework

The primary data-protection framework governing this platform is the Nigeria Data Protection Act 2023 (NDPA) and applicable Nigeria Data Protection Commission (NDPC) regulations and directives, including the NDP Act General Application and Implementation Directive (GAID) 2025. This is the fellowship's primary governance baseline. Where members are located in other jurisdictions, the fellowship assesses applicable obligations in accordance with its governance policies. This policy is updated when applicable requirements change.

3. Who this policy applies to

This policy applies to everyone who interacts with C&S Youth Connect:

• Registrants and members — youth members aged 15 to 50 who create an account.
• Visitors — anyone browsing the public sections of the platform.
• Donors — individuals making donations to fellowship projects.
• Diaspora members — Nigerian nationals and chapter members residing outside Nigeria.

4. What personal information we collect

• Registration data — name, email address, date of birth.
• Profile data — chapter/church affiliation, education level (optional) and profession/occupation (optional).
• Identity data — a permanent Member ID (auto-generated, which never changes).
• ID card data — if you apply for a digital ID card: card number, design type, and issue/expiry dates.
• Event data — event registrations and attendance records.
• Payment data — transaction records (amount, currency, purpose, payment reference). We do not store full card numbers; these are held securely by our authorized payment processors.
• Donation records — history of financial contributions.
• Communications — notifications and announcements you receive.
• Minor authorization records — for members under 18, the version and timestamp of the dual authorization provided.
• Technical data — IP address (strictly for security/fraud prevention), device type, and session data.

5. Why we collect it & lawful basis

Under the NDPA 2023, we must have a lawful basis to process your data:

6. How we protect your information

• Encryption — data is encrypted at rest and in transit (TLS/SSL).
• Secure credentials — passwords are stored only as secure cryptographic hashes.
• Access controls — strict, role-based minimum-necessary access. Verification reviewers, for instance, only see the minimum data required to verify membership (DOB, phone and email are closed by default).
• Audit logging — sensitive actions are securely logged in an append-only format to ensure accountability.

7. Who can see your information

We do not sell your personal data to third parties. Access is strictly limited:

• Internal roles — authorized fellowship personnel (e.g. Secretariat, verification officers) access data only on a minimum-necessary basis. Verification evidence relies on a controlled reference model rather than a broad document repository.
• Service providers — trusted data processors who provide necessary infrastructure, such as payment processors and email delivery services. They process data only on our instructions.
• Other members — basic profile information (like your name and chapter) may be visible to other authenticated members to facilitate fellowship.

8. Children and young people (under 18)

C&S Youth Connect welcomes youth from age 15. Protecting our younger members is a critical priority.

• Minimum age — you must be at least 15 years old to register.
• Dual authorization — for anyone under 18, registration requires dual authorization. Both the minor and a parent/legal guardian must separately and explicitly tick to provide affirmative authorization before an account can be created. Neither box is pre-ticked.
• Minor media gate — registration authorization does not allow the public display of a minor's identifiable image or details. Any public display requires a further, specific consent step.
• Parent/guardian rights — parents or guardians can contact us to query, update, or withdraw authorization regarding their child's account. Withdrawal leads to account closure, though certain legal, audit, or accountability records may be lawfully retained per our retention schedule.
• Coming of age — when a minor reaches 18, their dual-authorization record is superseded by their own adult authorization upon their next login or policy update.

9. International members and diaspora

Our platform is operated by a Nigerian-registered organization. We serve a global fellowship, including diaspora members in the UK, US, Canada, EU and elsewhere. Depending on the nature and circumstances of processing, UK data-protection law or the EU GDPR may apply; we assess applicability based on our actual activities and evolving requirements. We do not sell personal data. Applicable contractual and transfer mechanisms are verified and documented for international service providers before production processing.

A dedicated cross-border data assessment informs this section internally. It is a working governance document, not yet through final legal review, so it is not published on this site; contact us at support@cnsunificationyouth.org for more detail on international transfers.

10. Your rights

Under the NDPA 2023 (and applicable international laws), you have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — request that we correct inaccurate or incomplete data.
• Erasure — request deletion of your data, subject to our retention obligations.
• Restriction — request that we limit how we use your data.
• Data portability — receive your data in a structured, machine-readable format, where applicable.
• Object — object to processing based on legitimate interests.
• Withdraw consent — where processing is specifically based on consent, withdraw it at any time.

How to exercise these rights. Contact us at support@cnsunificationyouth.org. We handle every request through our data-subject request process (§14) and respond within the period required by applicable law.

11. Data retention

We retain data using a structured category model (R1–R6) to keep data only as long as necessary. While your account is active, the retention clock for deletion does not run.

• Operational data (R2). When your account closes or membership ends, ordinary personal profile and activity data is retained for a general period of 3 years from when the relationship ends, after which it is securely deleted or anonymized.
• Accountability trace (R3). Verification decisions and authorization records are kept as a minimum necessary trace to prove historical processing decisions.
• Financial & legal (R4). Payment and transaction records are kept only as long as strictly required by applicable law or our processor relationships.
• Security & audit (R5). Security logs are append-only and kept as a minimum trace to investigate and prove security events.
• Legal hold (R6). If a legal hold is in place, relevant data is preserved until the hold is released.

Backup data follows a separate, short-term lifecycle and is never used as a long-term personal-data archive.

12. Cookies and technical data

C&S Youth Connect uses secure session cookies strictly for authentication and keeping you logged in securely. We do not use advertising cookies or third-party tracking scripts. Session data is ephemeral and is cleared when you log out or when your session expires.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make significant changes, we notify you by posting an announcement on the platform or sending an email.

14. How to contact us & regulatory authorities

If you have questions, concerns, or wish to exercise your rights, contact us at support@cnsunificationyouth.org.

Regulatory authorities

• Nigeria — you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.
• UK members — Information Commissioner's Office (ICO) at ico.org.uk.
• EU members — your relevant national supervisory authority.