CSRiseCSRise

CSRISE TECHNOLOGY LTD

Privacy Policy

Draft for legal review — not yet in effect.

This draft reflects the CSRise Corporate Impact Operating System. It replaces the earlier crowdfunding and escrow text and must be reviewed by qualified Nigerian counsel before it is published or relied on.

1. Introduction

CSRise Technology Ltd (“CSRise”, “we”, “us”, or “our”) operates the CSRise Corporate Impact Operating System (the “Platform”). Companies use it to govern CSR spending and to keep evidence of what happened with it. Implementing partners use it to submit evidence for projects a company has assigned to them.

This Privacy Policy explains what personal data we collect, how we use it, who we share it with and your rights. It applies to Customer Users, implementing-partner Users and visitors to our website, and is intended to comply with the Nigeria Data Protection Act 2023 (NDPA) and applicable Nigeria Data Protection Regulation (NDPR) requirements. For account and billing data CSRise decides how the data is used. For project and evidence data entered by a Customer or its partners, CSRise generally processes the data on the Customer’s behalf.

2. Information We Collect

2.1 Customer Users

  • Name, work email address, job title, role in the Platform and, where provided, phone number.
  • Sign-in and security data, including two-factor authentication status and recovery events.
  • Approvals, comments and decisions you make, recorded in the audit trail.

2.2 Implementing Partners and Their Users

  • Name, work email address, job title and role.
  • Organisation details: name, CAC or registration number, tax identification number, and supporting documents such as registration or tax certificates and board resolutions.
  • Referee contacts, where a Customer’s due diligence requires them.
  • Bank account details in the organisation’s name, used so the Customer can record and reconcile payments to the partner.

2.3 Project, Evidence and Payment Records

  • Mandates, allocations, milestones, acceptance criteria, evidence (documents, photographs, receipts, attendance records), review decisions and clarification messages.
  • Payment records: amount, date, recipient, bank transfer reference and receipt.
  • Evidence may contain personal data about beneficiaries or other third parties. The Customer and partner must have a lawful basis for including it.

2.4 Subscription and Billing Data

  • Billing contact details and subscription history. Card or bank payments to CSRise are processed by Paystack; CSRise does not store full card or bank account numbers.

2.5 Collected Automatically

  • Log and device data such as IP address, browser type and pages visited.
  • Audit records of material actions: who acted, when, on what, the previous and new state, and the reason given.

3. How We Use Your Information

We use the information we collect to:

  • Create and manage accounts, roles and invitations.
  • Provide the Platform: mandates, allocations, milestones, evidence review, approvals, payment records, reconciliation and reporting.
  • Maintain the audit trail and enforce access, approval and separation-of-duties controls.
  • Support Customers in checking implementing partners before approving them.
  • Bill for subscriptions and respond to support requests.
  • Detect, investigate and prevent fraud, misuse and security incidents.
  • Comply with legal and regulatory obligations, including responding to lawful requests.
  • Improve and maintain the security and functionality of the Platform.

4. Legal Basis for Processing

We process personal data on the basis of: (a) performance of a contract, to provide the services requested; (b) your consent, where we ask for it; (c) legal obligation; and (d) our legitimate interests, including security, fraud prevention and improving our services. [For counsel to confirm the basis for each category of data, and for processing carried out on a Customer’s behalf.]

5. How We Share Your Information

We do not sell personal data. We may share information with:

  • The Customer concerned. A Customer’s authorised Users can see the partner information, evidence and payment records for projects within that Customer’s portfolio.
  • Implementing partners. A partner’s Users see only the projects assigned to that partner. They do not see a Customer’s mandates or other partners.
  • Paystack, to process subscription and other approved payments to CSRise.
  • Service providers that support our operations, such as hosting, communications and analytics, under obligations to protect the data.
  • CSRise support staff, only through authorised, read-only, time-limited and audited access.
  • Regulators or law enforcement, where required by law or needed to investigate suspected unlawful activity.

Information is not published publicly by default.

6. Data Retention

We keep personal data as long as needed to provide the Platform, meet legal and regulatory obligations, resolve disputes and enforce our agreements. Audit records and payment records are kept for the period needed to support the Customer’s accountability and record-keeping obligations. [Retention periods and end-of-subscription handling to be confirmed by counsel and set out in the subscription agreement.]

7. Data Security

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse or alteration, including role-based access controls, separation between Customers, two-factor authentication and encrypted transmission of sensitive data. No system is completely secure and we cannot guarantee absolute security.

8. Your Rights

Subject to applicable law, you may have the right to:

  • Access the personal data we hold about you.
  • Request correction of inaccurate or incomplete data.
  • Request deletion, subject to legal retention requirements and the audit-trail needs described above.
  • Withdraw consent where processing is based on consent.
  • Object to or request restriction of certain processing.

For data a Customer controls, we may refer your request to that Customer. Requests can be made using the details in Section 10, or via our data protection officer.

9. Children’s Privacy

The Platform is not directed at, and we do not knowingly collect personal data from, individuals under 18 as Users. Evidence may relate to beneficiaries who are minors. Partners must submit only what is necessary, with appropriate consent and safeguards. If we learn that we have collected a minor’s data in error, we will take steps to delete it.

10. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, services or legal requirements. We will post the updated Policy with a revised effective date.

11. Contact Us

For questions about this Privacy Policy or to exercise your data rights, please contact:

CSRise Technology Ltd
Akure, Ondo State, Nigeria
support@csrise.africa