CSRise Technology Ltd — Privacy Policy

1. Introduction

CSRise Technology Ltd ("CSRise", "we", "us", or "our") operates a CSR (Corporate Social Responsibility) crowdfunding platform (the "Platform") that connects donors, campaign organisers, and beneficiaries around verified social impact projects across education, healthcare, community development, and related causes.

This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and the rights you have over your data. This Policy applies to all Users of the Platform, including donors, campaign organisers, and visitors to our website, and is intended to comply with the Nigeria Data Protection Act 2023 (NDPA) and applicable Nigeria Data Protection Regulation (NDPR) requirements.

2. Information We Collect

2.1 Information Donors Provide

• Name, email address, and phone number (where provided at checkout).
• Payment information, processed directly by our payment processor, Paystack (CSRise does not store full card or bank account numbers).
• Donation history and any messages or comments left on a campaign.

2.2 Information Campaign Organisers Provide

• Identity information: full name, date of birth, ID type and number, and phone number.
• Reference contacts: names, phone numbers, emails, and relationship of two named references.
• For organisations (NGOs/corporates): organisation name, CAC/registration number, tax identification number, and supporting documents such as NGO certificate, tax certificate, bank statement, and board resolution.
• Bank account details, used to verify the account holder's name and to process fund disbursements.
• Campaign content: descriptions, images, milestone plans, and proof-of-fund-usage documents (receipts, photos, reports) submitted in connection with a campaign.

2.3 Information Collected Automatically

• Log and device data, such as IP address, browser type, and pages visited, collected when you use the Platform.
• Transaction and activity data, such as funding activity, withdrawal requests, and account verification status.

3. How We Use Your Information

We use the information we collect to:

• Create and manage User accounts, and verify the identity of campaign organisers before they can receive disbursed funds.
• Process donations and disburse funds to verified organisers via our payment processor, Paystack.
• Operate fraud prevention and anti-money laundering (AML) controls, including automated risk-scoring of projects and withdrawals and velocity checks on transaction patterns.
• Review and verify milestone completion and fund-usage evidence submitted by organisers.
• Handle disputes and refund requests submitted through our in-platform dispute system.
• Communicate with Users about their account, a campaign, a donation, or a support request.
• Comply with legal, regulatory, and payment-partner obligations, including responding to compliance reviews from Paystack or other partners.
• Improve and maintain the security and functionality of the Platform.

4. Legal Basis for Processing

We process personal data on the basis of: (a) your consent, where you have provided information voluntarily to create an account, make a donation, or start a campaign; (b) performance of a contract, to provide the services you request; (c) legal obligation, including identity verification and AML/compliance requirements; and (d) our legitimate interests, including fraud prevention, platform security, and improving our services.

5. How We Share Your Information

We do not sell personal data. We may share information with:

• Paystack, our payment processor, to process donations, verify bank details, and disburse funds to organisers.
• Verification and identity providers engaged to confirm the identity or registration details of campaign organisers.
• Regulators, law enforcement, or payment partners, where required by law or where necessary to investigate suspected fraud, money laundering, or a violation of our Acceptable Use Policy.
• Service providers who support our operations (e.g., hosting, communications, or analytics providers), under obligations to protect the data they process on our behalf.

Campaign organisers' publicly listed campaign information (name, campaign description, progress updates) may be visible to donors and the public as part of normal Platform operation. Donor identity is not shared with organisers beyond what is necessary to process a donation, unless the donor chooses to make their contribution public.

6. Data Retention

We retain personal data for as long as necessary to provide our services, comply with legal and regulatory obligations (including AML and financial record-keeping requirements), resolve disputes, and enforce our agreements. Verification documents and transaction records are retained for the period required under applicable Nigerian financial and data protection regulations.

7. Data Security

We implement technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, or alteration, including access controls, encrypted transmission of sensitive data, and automated monitoring for suspicious account or transaction activity. No system is completely secure, and we cannot guarantee absolute security of information transmitted to the Platform.

8. Your Rights

Subject to applicable law, you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of your data, subject to our legal and regulatory retention obligations.
• Withdraw consent, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.
• Object to or request restriction of certain processing activities.

Requests can be made by contacting us using the details in Section 11 below.

9. Children's Privacy

The Platform is not directed at, and we do not knowingly collect personal data from, individuals under the age of 18. If we become aware that we have inadvertently collected data from a minor, we will take steps to delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. We will post the updated Policy on the Platform with a revised effective date. Continued use of the Platform after changes take effect constitutes acceptance of the updated Policy.

11. Contact Us

For questions about this Privacy Policy or to exercise your data rights, please contact:

CSRise Technology Ltd
Akure, Ondo State, Nigeria
support@csrise.africa