HEKA’S HOPE HAVEN INITIATIVE
PRIVACY AND DATA PROTECTION POLICY
Effective Date: 27 July 2026
Last Updated: 27 July 2026
1. INTRODUCTION
Heka’s Hope Haven Initiative (“Heka’s Hope Haven”, “we”, “us” or “our”) is committed to protecting the privacy, dignity, safety and personal information of everyone who interacts with us.
We provide free emotional support and confidential legal guidance to victims and survivors of violence, abuse, harassment, intimidation and trauma. Because of the nature of our work, we may receive highly personal and sensitive information.
This Privacy Policy explains how we collect, use, store, protect and disclose personal information and the rights available to individuals whose information we process.
This Policy applies to information collected through our website, online forms, live chat, helpline, email, social media interactions, referrals, support services, legal guidance services, events, programmes and other interactions with Heka’s Hope Haven.
We process personal data in accordance with the Nigeria Data Protection Act 2023 (“NDP Act”), applicable regulations and directives issued by the Nigeria Data Protection Commission (“NDPC”), including the General Application and Implementation Directive 2025 (“GAID”), and other applicable Nigerian laws.
2. WHO WE ARE
Heka’s Hope Haven Initiative
2nd Floor, Sovereign Trust House
Alagbaka, Akure
Ondo State, Nigeria
Email: support@hekashopehaven.org
Website: hekashopehaven.org
For data-protection enquiries, requests or complaints, please contact us using the above email address.
For the purposes of applicable data-protection legislation, Heka’s Hope Haven will generally act as the Data Controller in respect of personal information it determines the purposes and means of processing.
Where another organisation processes personal information on our behalf, that organisation may act as a Data Processor.
3. OUR COMMITMENT TO PRIVACY
We are committed to ensuring that personal information is:
- processed fairly, lawfully and transparently;
- collected for specified, explicit and legitimate purposes;
- adequate, relevant and limited to what is necessary;
- accurate and kept up to date where necessary;
- retained only for as long as reasonably necessary;
- protected against unauthorised or unlawful processing, loss, destruction, damage or disclosure; and
- processed in a manner that respects the rights, dignity and safety of the individual.
These principles reflect the data-processing principles under the NDP Act.
4. WHAT PERSONAL INFORMATION WE MAY COLLECT
Depending on how you interact with Heka’s Hope Haven, we may collect some or all of the following:
4.1 Identification and contact information
- name;
- telephone number;
- email address;
- residential or contact address;
- age or date of birth;
- gender where relevant; and
- other information necessary to identify or communicate with you.
4.2 Support and case information
Where you voluntarily seek assistance from us, we may receive information concerning:
- experiences of violence, abuse, harassment, intimidation or exploitation;
- trauma and emotional wellbeing;
- family or relationship circumstances;
- safeguarding concerns;
- information concerning alleged perpetrators or other individuals;
- information relating to children or vulnerable persons;
- details of incidents or events;
- information provided during counselling or emotional-support interactions;
- information relevant to legal guidance or referrals; and
- information necessary to assess your support needs.
4.3 Sensitive personal information
The nature of our work means that some information provided to us may constitute sensitive personal data or otherwise require enhanced protection.
This may include information concerning:
- physical or mental health;
- sexual or intimate matters;
- experiences of abuse or violence;
- biometric information where applicable;
- information concerning children;
- criminal allegations or offences;
- religious or other personal information where voluntarily provided; and
- other information requiring heightened protection under applicable law.
We will only collect and process such information where there is an appropriate lawful basis and where the processing is necessary and proportionate to the purpose for which it is undertaken.
5. HOW WE COLLECT INFORMATION
We may collect information:
- directly from you;
- through our website;
- through our live chat;
- through telephone or helpline conversations;
- through email;
- through online or physical forms;
- when you attend our programmes or events;
- through referrals from partner organisations;
- from authorised representatives acting on your behalf;
- from publicly available sources where lawful and appropriate; or
- from other persons where permitted by law and necessary for safeguarding, legal or other legitimate purposes.
We will endeavour to collect information directly from you wherever reasonably practicable.
6. OUR PURPOSES FOR PROCESSING PERSONAL INFORMATION
We may process personal information for purposes including:
A. Providing support
To:
- respond to enquiries;
- provide emotional support;
- provide confidential guidance;
- assess support needs;
- make appropriate referrals;
- arrange follow-up support;
- assist victims and survivors; and
- provide information about available services.
B. Legal guidance and referrals
To:
- understand the circumstances presented to us;
- provide general legal guidance within the scope of our services;
- identify appropriate legal or professional referral pathways;
- assist with referrals to relevant authorities, professionals or organisations where appropriate; and
- maintain necessary records of assistance provided.
C. Safeguarding and protection
To:
- identify and respond to serious safeguarding concerns;
- protect children and vulnerable persons;
- respond to situations involving serious or immediate risk of harm;
- prevent or reduce the risk of serious injury, abuse or loss of life; and
- take appropriate protective action where legally justified.
D. Administration
To:
- manage our organisation;
- maintain appropriate records;
- communicate with service users, volunteers, staff and partners;
- administer programmes;
- monitor and improve our services;
- manage complaints and enquiries; and
- comply with applicable legal and regulatory requirements.
E. Security and fraud prevention
To:
- protect our systems and premises;
- prevent misuse of our services;
- investigate suspected fraud or abuse;
- maintain information-security controls; and
- detect, prevent or respond to unlawful activity.
F. Organisational reporting and research
We may use anonymised or appropriately de-identified information to:
- evaluate our programmes;
- understand service needs;
- prepare reports;
- improve our services;
- support research; and
- demonstrate the impact of our work.
We will not publish information that identifies a survivor or service user without an appropriate lawful basis and, where required, their consent.
7. LAWFUL BASES FOR PROCESSING
We will only process personal data where an appropriate lawful basis exists under the NDP Act.
Depending on the circumstances, this may include:
- your consent;
- performance of a contract or steps taken at your request;
- compliance with a legal obligation;
- protection of vital interests;
- performance of a task carried out in the public interest;
- legitimate interests, where permitted and appropriate; or
- another lawful basis recognised by applicable law.
We will determine the appropriate lawful basis according to the particular processing activity.
Where consent is the lawful basis, consent will be obtained through an affirmative and informed action. Silence, inactivity or a pre-ticked box will not be treated as consent.
You may withdraw consent where processing is based on consent. Withdrawal will not affect processing that was lawfully carried out before withdrawal.
8. CONSENT AND SENSITIVE INFORMATION
Where you contact Heka’s Hope Haven for support, you may voluntarily disclose information of a highly personal nature.
We will not require you to disclose information that is unnecessary for the service you are seeking.
Where consent is required, we will:
- explain what information is being collected;
- explain why it is required;
- explain how it may be used;
- identify relevant recipients where applicable;
- explain relevant risks;
- obtain affirmative consent; and
- provide a reasonable opportunity to withdraw consent where applicable.
Consent will be requested in clear and accessible language.
9. CONFIDENTIALITY
We recognise that confidentiality is fundamental to the trust placed in Heka’s Hope Haven.
Information provided to us will ordinarily be treated as confidential and will only be accessed by persons who have a legitimate need to access it.
Our staff, volunteers, advisers and other authorised persons may be subject to confidentiality obligations.
However, confidentiality is not absolute.
We may disclose relevant information without your consent where disclosure is:
- required by law;
- necessary to comply with a lawful order or legal obligation;
- necessary to protect your vital interests;
- necessary to protect another person’s vital interests;
- necessary to prevent serious and immediate harm;
- necessary for safeguarding a child or vulnerable person;
- necessary to prevent or investigate serious unlawful conduct;
- necessary to establish, exercise or defend legal rights; or
- otherwise permitted or required by applicable law.
Where possible and appropriate, we will discuss such disclosure with you before making it.
However, we may not notify you beforehand where doing so could increase the risk of harm, compromise a lawful investigation, place another person at risk, or otherwise be unlawful or inappropriate.
10. SERIOUS RISK OF HARM
Heka’s Hope Haven exists to support people experiencing difficult and potentially dangerous circumstances.
If we reasonably believe that you or another person is at serious and immediate risk of harm, we may disclose relevant information to an appropriate person, emergency service, healthcare professional, law-enforcement agency, safeguarding authority or other appropriate organisation where this is necessary and proportionate to protect life or prevent serious harm.
We will seek to limit any disclosure to information that is reasonably necessary for the protective purpose.
Where the circumstances permit, we will explain the reason for the disclosure to you.
11. CHILDREN AND YOUNG PERSONS
We recognise that children require additional protection.
Where we process information relating to a child, we will comply with applicable requirements concerning children’s personal data, including requirements relating to parental or guardian consent where consent is the applicable lawful basis.
We may process information concerning a child without parental or guardian consent where permitted or required by law, including where processing is necessary to protect the child’s vital interests, for appropriate social care or safeguarding purposes, or in connection with legal proceedings.
Where appropriate, we will take reasonable steps to verify age and any required parental or guardian authorisation.
The safety and best interests of children will remain a primary consideration in our safeguarding practices.
12. INFORMATION ABOUT OTHER PEOPLE
If you provide us with personal information concerning another person, including a child, family member, alleged perpetrator, witness or other third party, you should only provide information that is relevant and necessary.
Where appropriate, we may process such information without obtaining the person’s consent where a lawful basis exists, including where processing is necessary for safeguarding, legal, vital-interest or other lawful purposes.
13. WHO MAY RECEIVE PERSONAL INFORMATION?
We may share relevant information with:
- authorised Heka’s Hope Haven staff and volunteers;
- professional advisers;
- legal professionals;
- counsellors or mental-health professionals;
- healthcare professionals;
- safeguarding organisations;
- law-enforcement agencies;
- emergency services;
- government or regulatory authorities;
- trusted referral partners;
- technology, hosting, communications and IT service providers;
- auditors and professional service providers; and
- other persons or organisations where permitted or required by law.
We will only share information where there is an appropriate lawful basis and, where appropriate, only the information reasonably necessary for the relevant purpose.
14. REFERRALS
Where we believe another organisation or professional can provide more appropriate assistance, we may recommend or facilitate a referral.
Where consent is required, we will seek your consent before sharing your personal information.
Where disclosure is permitted without consent because of a serious safeguarding, vital-interest or legal concern, we may make the referral without consent where necessary and proportionate.
15. THIRD-PARTY SERVICE PROVIDERS
Heka’s Hope Haven may use trusted third-party service providers to support our operations.
These may include providers of:
- website hosting;
- cloud storage;
- email;
- telephone and helpline services;
- live-chat platforms;
- case-management systems;
- online forms;
- cybersecurity;
- analytics;
- IT support; and
- other administrative or technical services.
Where a third party processes personal data on our behalf, we will take reasonable steps to ensure that appropriate contractual, technical and organisational safeguards are in place.
Third-party processors will not be permitted to use personal information for unrelated purposes where prohibited by law or our agreement with them.
16. INTERNATIONAL TRANSFERS
Some of our technology or service providers may process personal information outside Nigeria.
Where personal data is transferred outside Nigeria, Heka’s Hope Haven will comply with applicable requirements governing cross-border transfers under the NDP Act and relevant NDPC directives.
Depending on the circumstances, this may include reliance on:
- an adequacy decision;
- an approved cross-border data-transfer mechanism;
- appropriate contractual or other safeguards;
- consent where legally appropriate;
- vital-interest grounds;
- legal claims;
- public-interest grounds; or
- another lawful basis recognised under applicable law.
Where required, we will take appropriate steps to ensure that transferred information continues to receive adequate protection.
17. DATA SECURITY
We take reasonable technical and organisational measures to protect personal information against:
- unauthorised access;
- unauthorised disclosure;
- accidental loss;
- destruction;
- alteration;
- misuse;
- unlawful processing; and
- other forms of data compromise.
Depending on the circumstances, safeguards may include:
- access controls;
- passwords and authentication;
- role-based access;
- secure storage;
- confidentiality obligations;
- staff training;
- secure communications;
- device security;
- backups;
- appropriate encryption;
- secure disposal;
- incident-management procedures; and
- regular review of our security practices.
No electronic communication or storage system can be guaranteed to be completely secure. You should therefore avoid providing unnecessary sensitive information through unsecured channels.
18. PERSONAL DATA BREACHES
A personal data breach may include accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.
If a breach occurs, Heka’s Hope Haven will:
- take reasonable steps to contain and investigate the incident;
- assess the potential impact and risks to affected individuals;
- take measures to reduce or remedy harm;
- make any notification required to the NDPC or another competent authority;
- notify affected data subjects where required by law and appropriate; and
- maintain appropriate records of the incident and remedial action.
We will handle breaches in accordance with applicable NDP Act and NDPC requirements.
19. DATA RETENTION
We will not retain personal data for longer than is reasonably necessary for the purpose for which it was collected, unless a longer retention period is required or permitted by law.
Our intended retention periods include:
Type of information | Indicative retention period |
|---|---|
General website enquiries | Up to 12 months after the enquiry is closed |
Live-chat records | Up to 12 months after closure, unless required for safeguarding or legal purposes |
Helpline/support records | Up to 24 months after the support relationship ends, subject to safeguarding/legal requirements |
Case and safeguarding records | As required by applicable law, safeguarding requirements and legitimate organisational needs |
Legal/referral records | For as long as reasonably necessary for the relevant matter and applicable legal requirements |
Consent records | For as long as necessary to demonstrate lawful processing and compliance |
Staff/volunteer records | For the duration of the relationship and thereafter for the period required by law or legitimate organisational requirements |
Financial/accounting records | For the period required by applicable financial, tax or legal requirements |
Where information is no longer required, we will securely delete, destroy or anonymise it.
Retention periods may be extended where reasonably necessary for legal claims, investigations, safeguarding, regulatory requirements or other lawful purposes.
20. YOUR DATA PROTECTION RIGHTS
Subject to applicable legal conditions and exemptions, you may have the right to:
20.1 Right to be informed
To receive clear information about how and why your personal information is processed.
20.2 Right of access
To request access to personal information we hold about you.
20.3 Right to rectification
To request correction of inaccurate or incomplete personal information.
20.4 Right to erasure
To request deletion of personal information where applicable.
This right is not absolute. We may retain information where we have a lawful reason to do so.
20.5 Right to restriction
To request restriction of processing in circumstances permitted by law.
20.6 Right to object
To object to certain processing of your personal information where applicable.
20.7 Right to data portability
Where applicable, to receive personal information in a structured, commonly used and machine-readable format and request its transfer to another controller.
20.8 Right to withdraw consent
Where processing is based on consent, you may withdraw that consent.
20.9 Rights concerning automated decision-making
Where applicable, you have rights concerning decisions based solely on automated processing that produce legal or similarly significant effects.
20.10 Right to complain
You may complain to Heka’s Hope Haven about how your personal information has been handled.
You may also lodge a complaint with the Nigeria Data Protection Commission (NDPC) where you believe your data-protection rights have been infringed.
21. HOW TO EXERCISE YOUR RIGHTS
To exercise your data-protection rights, please contact:
Data Protection/Privacy Contact
Heka’s Hope Haven Initiative
2nd Floor, Sovereign Trust House
Alagbaka, Akure
Ondo State, Nigeria
Email: support@hekashopehaven.org
Please provide sufficient information to enable us to identify you and understand the nature of your request.
We may need to take reasonable steps to verify your identity before releasing, correcting or deleting personal information.
We will respond to requests within the timeframe required by applicable law.
Where a request cannot be fulfilled, we will explain the applicable reason, subject to lawful exemptions.
22. COMPLAINTS
If you have concerns about the way Heka’s Hope Haven has handled your personal information, please contact us first at:
support@hekashopehaven.org
We will investigate complaints fairly and take appropriate remedial action where necessary.
You also have the right to lodge a complaint with the Nigeria Data Protection Commission.
Nigeria Data Protection Commission (NDPC)
No. 12 Dr Clement Isong Street
Asokoro, Abuja, Nigeria
Email: info@ndpc.gov.ng
Website: ndpc.gov.ng
23. LIVE CHAT AND ONLINE COMMUNICATION
Our live chat may allow visitors to communicate with Heka’s Hope Haven in real time.
Visitors should avoid providing unnecessary personal information.
Before using the chat, visitors may be presented with a consent and privacy notice explaining:
- what information may be collected;
- the purpose of processing;
- confidentiality;
- the circumstances in which information may be disclosed;
- the user’s rights; and
- how to contact Heka’s Hope Haven.
Because the chat may concern sensitive matters, Heka’s Hope Haven will take reasonable measures to restrict access to chat records.
24. HELPLINE PRIVACY
Where you contact our helpline, information you voluntarily provide may be recorded where necessary for service delivery, safeguarding, referrals, quality assurance, legal compliance or other lawful purposes.
Where call recording is used, callers will be informed where required by law.
Where information is not required to be recorded, we will seek to minimise unnecessary recording of personal information.
Information obtained through the helpline will be handled confidentially, subject to the safeguarding and serious-risk exceptions described in this Policy.
25. COOKIES AND WEBSITE TECHNOLOGIES
Our website may use cookies and similar technologies.
These may include:
- strictly necessary cookies;
- preference cookies;
- analytics cookies; and
- other technologies used to maintain website security or functionality.
Where consent is required, we will seek consent before placing or using non-essential cookies.
You may be able to manage cookie preferences through your browser or our website’s cookie-management tools.
Third-party services used on our website may have their own privacy and cookie policies.
26. THIRD-PARTY WEBSITES AND LINKS
Our website or communications may contain links to third-party websites, organisations or services.
Heka’s Hope Haven is not responsible for the privacy practices of third-party websites.
You should review the privacy policy of any external website before submitting personal information to it.
27. SOCIAL MEDIA
We may operate or maintain social-media accounts and may receive information when individuals interact with us through those platforms.
Social-media platforms are independent data controllers in respect of their own services.
Information posted publicly on social-media platforms may be visible to other users.
Please do not post confidential information about yourself or another person in public comments or messages.
28. PHOTOGRAPHS, STORIES AND TESTIMONIALS
Heka’s Hope Haven may wish to publish photographs, testimonials, survivor stories or other material to raise awareness or demonstrate the impact of our work.
We will not publish identifiable survivor information for publicity purposes without an appropriate lawful basis and, where required, informed consent.
Where consent is requested for publication, it will be separate from consent required to receive support.
A person will not be denied support because they refuse permission for their story, photograph or testimonial to be used for publicity.
Where possible, anonymisation or de-identification will be considered as an alternative to publication of identifiable information.
29. DIRECT MARKETING
We will not use personal information for direct marketing without an appropriate lawful basis.
Where consent is required, you will be able to withdraw it.
You may opt out of marketing communications at any time by contacting us or using the unsubscribe mechanism provided in the communication.
30. AUTOMATED DECISION-MAKING AND PROFILING
Heka’s Hope Haven does not currently intend to make decisions about service users based solely on automated processing that produce legal or similarly significant effects.
If this changes, we will provide appropriate information about the processing, its significance and likely consequences and any applicable rights before undertaking such processing.
31. STAFF, VOLUNTEERS AND CONFIDENTIALITY
All staff and volunteers who have access to personal information are expected to respect confidentiality and comply with Heka’s Hope Haven’s data-protection and information-security requirements.
Access to sensitive information will be limited according to role and legitimate need.
Staff and volunteers must not:
- disclose confidential information without authority;
- use service-user information for personal purposes;
- discuss identifiable cases unnecessarily;
- copy or remove information without authorisation; or
- retain personal information outside approved systems.
Any suspected breach must be reported promptly in accordance with our internal procedures.
32. DATA PROTECTION BY DESIGN
Heka’s Hope Haven will seek to incorporate privacy and data-protection considerations into new services, programmes, technology and processes.
Where processing is likely to create a high risk to individuals, we will consider appropriate risk assessments and, where necessary, a Data Protection Impact Assessment (DPIA) or equivalent assessment.
Particular care will be taken where processing involves:
- sensitive personal information;
- children;
- survivors of violence or abuse;
- large-scale personal data;
- systematic monitoring;
- new technologies; or
- information that could expose an individual to serious harm if compromised.
33. DATA MINIMISATION
We will seek to collect only information that is reasonably necessary for the purpose for which it is being collected.
You are not required to provide information that is irrelevant to the service you are requesting.
Where possible, we will use anonymised or de-identified information for reporting, research, statistics and service evaluation.
34. ACCURACY OF INFORMATION
We seek to maintain accurate and appropriate records.
You may request correction of information that is inaccurate, incomplete or misleading.
Where information relates to an incident or allegation, we may retain the original information while recording corrections, clarifications or the fact that the information is disputed.
35. INFORMATION RELATING TO ALLEGED PERPETRATORS OR THIRD PARTIES
Heka’s Hope Haven may receive personal information about individuals who are not themselves service users, including alleged perpetrators, witnesses, family members or other third parties.
Such information will be processed only where there is an appropriate lawful basis and will be handled carefully, particularly where disclosure could create risks to the survivor, witness, child or another person.
36. NO GUARANTEE OF ABSOLUTE CONFIDENTIALITY
While we take confidentiality and information security seriously, no communication system can be guaranteed to be completely secure.
Accordingly, Heka’s Hope Haven cannot guarantee absolute confidentiality where:
- disclosure is required by law;
- disclosure is necessary to prevent serious and immediate harm;
- disclosure is necessary to protect a child or vulnerable person;
- disclosure is necessary to comply with a lawful order;
- information has been voluntarily made public by the individual; or
- another lawful exception applies.
37. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time to reflect:
- changes in our services;
- changes in technology;
- changes in applicable law;
- regulatory guidance;
- changes in our data-processing practices; or
- improvements to our privacy and security procedures.
The latest version will be made available through our website.
Where a material change significantly affects how we process personal information, we will take reasonable steps to notify affected individuals where required.
38. CONTACT US
If you have any questions about this Privacy Policy or how Heka’s Hope Haven handles personal information, please contact us.
Heka’s Hope Haven Initiative
Ondo State, Nigeria
Email: support@hekashopehaven.org
Website: hekashopehaven.org
Privacy and Data Protection Enquiries:
support@hekashopehaven.org
39. REGULATORY CONTACT
The supervisory authority responsible for data protection in Nigeria is:
Nigeria Data Protection Commission (NDPC)
No. 12 Dr Clement Isong Street
Asokoro, Abuja, Nigeria
Email: info@ndpc.gov.ng
Website: ndpc.gov.ng
40. IMPORTANT NOTICE TO USERS
Heka’s Hope Haven Initiative provides emotional support, confidential guidance, referrals and other assistance within the scope of its services.
Our online chat, helpline and other communication channels should not be treated as emergency services.
If you or another person is in immediate danger, seek appropriate emergency assistance without delay.
By using our services, you acknowledge that while we will make every reasonable effort to maintain confidentiality, information may be disclosed where necessary and lawful to protect life, prevent serious harm, safeguard a child or vulnerable person, comply with the law or otherwise fulfil a lawful obligation.