We take the privacy of everyone involved in the competition seriously — players, organisation representatives, staff and visitors. This notice explains, in plain language, what personal data this website and portal handle and what your rights are under the Nigeria Data Protection Act 2023 (NDPA).
1. Who we are
Eagle Wings International Ministry Katsina (“we”, “us”) organises the inter-organisation sports competition and runs this website and its member and admin portals. We are the data controller for the personal data described below.
Questions or requests about personal data: send us a privacy request.
2. What we collect
| Who | What | Where it comes from |
|---|---|---|
| Players | Name, position, jersey number, photo (optional), short bio (optional), iD number number, image of the iD number card, department and branch, date of birth (optional), eligibility decision. | The player or their organisation's representative, to prove the player is a genuine member. |
| Organisation representatives | Name, work email, phone, organisation, sign-in history, messages with the committee and chatroom messages. | The committee (account creation) and the representative. |
| Committee staff | Name, email, phone, role, sign-in history, security settings (two-step verification), and a record of actions taken in the portal. | The member. |
| Payments | Organisation, amount, reason, date, receipt number, payment method and reference. We never see or store card numbers — card and bank details go directly to our payment processor, Paystack. | The organisation and Paystack. |
| Visitors who contact us or subscribe | Name, email, phone and organisation (contact form, optional); email address (newsletter); your message. | You, when you submit a form. |
| Everyone | Technical data needed to run and secure the site: IP address, browser type, pages requested and timestamps (security and error logs). | Your browser, automatically. |
What is public: on the public website we show only a verified player's name, photo, team, position and match statistics. ID number numbers, ID-card images, dates of birth, phone numbers and contact details are never published.
3. Why we use it
- Running the competition — registering organisations, verifying that only genuine members play, scheduling fixtures, publishing results and awards (our legitimate interest, and the performance of our arrangement with participating organisations).
- Taking and recording payments — fees, fines and receipts (contract and legal obligation to keep financial records).
- Communicating with you — replying to messages, sending notices and receipts. Newsletters are sent only with your consent; you can unsubscribe at any time using the link in every email.
- Keeping the service secure — preventing fraud and abuse, and keeping an audit trail of who did what (our legitimate interest and legal duty to protect data).
We do not sell personal data, use it for advertising, or make decisions about people by automated means alone.
4. Who sees it
- Our committee and staff, according to their role — for example only administrators can see ID cards and verify players; editors cannot.
- The representative of your organisation can see your organisation's own squad and payments, and nobody else's private data.
- Service providers who process data for us: Paystack (payments), our email service provider (delivering messages and newsletters), and our web host. They may only use data to provide their service.
- Content and font providers — pages load fonts and code libraries from public CDNs (Google Fonts, jsDelivr, cdnjs), and videos from YouTube (using its privacy-enhanced mode). Your IP address is visible to these providers when your browser fetches those files.
- Authorities, where the law requires it.
5. Transfers outside Nigeria
Some providers named above (for example payment, email, CDN and video services) may process data on servers outside Nigeria. Where that happens we rely on providers that apply appropriate safeguards for personal data, as the NDPA requires.
6. How long we keep it
| Data | Kept for |
|---|---|
| Player records and ID-card images | While the player is part of the competition. They are deleted when a player is removed or on request (see below). |
| Payment and receipt records | For the financial record-keeping period required by law. |
| Messages, notifications and chatroom messages | Messages and notices until no longer needed for the season's administration; read notifications 180 days; chatroom messages 12 months. |
| Contact-form enquiries | Until handled; archived enquiries are deleted after 24 months. |
| Newsletter email address | Until you unsubscribe. |
| Security and audit log | Kept as an audit trail; not edited or deleted from the portal. |
| Sign-in attempts and payment-webhook logs | 2 days and 180 days respectively. |
| Backups | A rolling set of recent backups (about two weeks), stored privately. |
7. How we protect it
- Encrypted connections (HTTPS), hashed passwords, strong-password rules, sign-in rate limiting, automatic sign-out, and optional two-step verification for staff.
- ID number cards are stored in a private area that is not reachable by link; only authorised staff and the representative of the player's own organisation can open them, and staff views are recorded in the audit log.
- Role-based access, an audit log of actions, secrets (such as payment and email keys) stored encrypted, and regular private backups.
No system is perfectly secure. If a personal-data breach occurs that is likely to harm people, we will notify the Nigeria Data Protection Commission and the people affected as the law requires.
8. Your rights
Under the NDPA you can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct data that is wrong or incomplete;
- delete your data (for example, remove a player's record and ID-card image), unless we must keep it by law;
- restrict or object to how we use your data, and withdraw consent you gave (such as the newsletter);
- give you your data in a portable format.
If you are not satisfied with our response, you have the right to complain to the Nigeria Data Protection Commission (NDPC) — ndpc.gov.ng.
9. Cookies and local storage
We use only what is necessary — no advertising or tracking cookies and no third-party analytics:
- Session cookie (
rglcibn_sid) — keeps you signed in to a portal and protects forms against forgery. It is deleted when you close your browser. - Preferences stored in your browser (local storage) — your light/dark theme, the organisation you chose to follow, the time of your last visit (for “what's new”), popups you have dismissed, and whether you subscribed. These never leave your device and you can clear them in your browser settings.
- Embedded YouTube videos (privacy-enhanced mode) and Paystack's checkout may set their own cookies once you play a video or start a payment.
10. Changes to this notice
If we change how we use personal data we will update this page and its “last updated” date, and tell representatives and subscribers where the change is significant.