Privacy Policy
Last updated: October, 2026.
The Stephen Asom Foundation collects personal information in order to run its scholarship, mentorship and training programmes. This page explains exactly what we collect, why, how long we keep it, and what you can ask us to do with it.
We have written it to describe what this website actually does, rather than in general terms. If anything here is unclear, write to us at contact@stephenasomfoundation.org and we will explain it.
Who we are
The Stephen Asom Foundation, [REGISTERED ADDRESS], Nigeria. Registration number [RC NUMBER].
For questions about your information, contact contact@stephenasomfoundation.org.
What we collect, and why
When you write to us
Our contact form asks for your name, email address, subject and message. We also record the IP address the message was sent from, to help us identify automated spam.
We use this only to reply to you and to keep a record that you contacted us.
When you apply for a scholarship
Our application form asks for:
- The student’s full name, date of birth, current school, current class and state
- The parent or guardian’s full name, phone number and email address
- A written statement about why the student should be considered
- Optionally, a file containing the student’s most recent results
- Which programme the application is for
We also record the IP address of the submission.
Applications are usually about a child. We ask that a parent or guardian completes the form, or that the student completes it with their guardian’s knowledge, and the form asks you to confirm this before it can be submitted. Our approach to children’s information is set out in our Child Safeguarding Statement.
We use this information to assess the application, to contact the guardian about it, and — if the application succeeds — to administer the scholarship, including paying fees directly to the school.
When you donate
Donations are processed by [Paystack / Flutterwave]. Your card details are never sent to this website and we never see them. You enter them on the payment provider’s own secure page.
After a payment completes, we receive and store: the amount, the transaction reference, and the name and email address you gave the payment provider. We use these to record the donation, to send you a receipt or acknowledgement, and to keep accurate financial records.
The payment provider processes your card information under its own privacy policy, which we encourage you to read.
When you join our mailing list
We collect your email address and use it only to send our termly update. Every email includes a link to unsubscribe.
When you simply browse the site
Our hosting provider keeps standard server logs, which include IP addresses, for security and troubleshooting.
This site remembers your choice of light or dark appearance in your own browser. That preference stays on your device, is not sent to us, and identifies nobody.
Where applicants’ files are kept
Results files uploaded with an application are stored in a folder on our server that is configured to refuse public access, with a randomised filename. They are not placed in the website’s ordinary media library, which would make them reachable by anyone who guessed the address.
Only signed-in foundation staff can open them, through an access-checked link.
We take this seriously because these documents identify a child by name, school and results.
How long we keep information
| What | How long |
|---|---|
| Enquiries through the contact form | 2 years from your last contact |
| Unsuccessful applications | 12 months after the decision |
| Successful applications and scholarship records | For the duration of the scholarship, then 7 years |
| Results files uploaded with applications | Deleted once the application is decided, unless the scholarship is awarded |
| Donation records | 7 years, to meet financial record-keeping obligations |
| Mailing list | Until you unsubscribe |
[CONFIRM THESE PERIODS WITH THE FOUNDATION — they should reflect what you actually do, not what sounds reasonable.]
Who we share it with
We do not sell your information, and we do not share it for marketing.
We share it only where necessary:
- With schools, where a scholarship is awarded — the student’s name and the fees being paid, so the school can apply the payment correctly.
- With mentors, where a scholar is matched — a mentor receives the scholar’s first name, school and year group, and contact is arranged through the foundation rather than directly.
- With our payment provider, to process donations.
- With our auditors, as part of the annual audit.
- Where the law requires it, or where we believe a child is at risk of harm. Our safeguarding statement explains this.
Your rights
Under the Nigeria Data Protection Act 2023, you can ask us to:
- Tell you what information we hold about you
- Correct anything that is wrong
- Delete information where we no longer need it
- Stop using it for a particular purpose
- Provide a copy of what you gave us
Write to contact@stephenasomfoundation.org and we will respond within 30 days. We may need to confirm who you are before acting, particularly where a request concerns a child.
If you are not satisfied with our response, you can complain to the Nigeria Data Protection Commission.
Keeping information safe
The site runs over an encrypted connection. Access to applications, enquiries and donation records requires a password-protected account. Uploaded files are held in a non-public folder as described above.
No system is perfectly secure. If a breach ever affected your information, we would tell you and the Nigeria Data Protection Commission as the law requires.
Changes to this policy
If we change how we handle information, we will update this page and change the date at the top. Where a change is significant, we will say so on the site rather than relying on you to notice.
For the developer — delete this note before publishing.
This policy is written to match what the site genuinely does, which makes it more accurate than a generic template. It is not legal advice and I am not a lawyer.
Have it reviewed before launch. Two things make that more important than usual here: the foundation processes children’s personal data, and the Nigeria Data Protection Act 2023 has specific requirements around consent and data controller registration that may apply.
Fill in every [BRACKETED] item. Confirm the retention periods describe what the foundation will actually do — a policy that promises deletion that never happens is worse than no policy. And name the real payment provider once you have chosen one.