1.0 INTRODUCTION

At Merciheart, we provide this Privacy Notice ("Notice") to detail how we collect, use, and disclose information from our website and application visitors and donors. We are committed to safeguarding your data privacy in accordance with international standards on extant data privacy laws and practices. This notice covers your interactions with us through our website and mobile applications, as well as any financial donations processed on our online fundraising platforms.

TAKE NOTICE that prior to accessing, using any of our online platforms, or submitting any information through or in connection with our Services, you are required to review this Notice carefully. By virtue of accessing and using our platform or initiating any function thereon, you are deemed to have acknowledged that you have read, understood, and accepted that we may collect, use, and disclose personal data relating to you in accordance with the terms outlined in this Notice. To the extent permitted by applicable law, this Notice is governed by the English language version thereof, translations into other languages may be provided for convenience only. In the event of any inconsistency or conflict between the English version of this Notice and any translation thereof, the English version shall prevail.

2.0 OUR COMMITMENT TO YOUR PRIVACY

We devotedly prioritize the protection of your privacy and the careful handling of your personal information with due respect. We do not sell, rent, or otherwise transfer your personally identifiable information to any third party organizations for their marketing purposes. The identity of all donors shall be kept confidential, and we shall use your information exclusively for the internal purposes of this ministry.

3.0 INFORMATION WE COLLECT

We may collect information from you directly through various interactions, including when you:

3.1 Account and Profile Data We process your account data (like name and email address) and profile data (which may include name, address, telephone number, email, profile pictures, date of birth, and social media IDs). This data helps us operate our website, provide services, enable your use of our website, ensure the security of our website and services, maintain back-ups of our databases and monitor usage. Our legal basis for processing this data is our legitimate interest in properly administering our website and business.

3.2 Usage and Analytics Data Through our analytics tracking system, we collect usage data about your interactions with our website and services. This includes IP address, location, browser details, navigation paths, referral source, page views, and visit length. We use this data to analyze usage patterns and improve our website and services, based on our legitimate interest in monitoring and improving our online presence.

3.3 Financial Transactions and Communications We process transaction data (including donations) for record-keeping for communicating with you and keeping records. We use third-party payment processors to process financial information. Specifically, we use Paystack and Stripe for payments, analytics, and other business services. All sensitive financial data is tokenized and handled directly by the processor. The transaction data may include your contact details, your card details and the transaction details. Our payment processors collect personal data (including via cookies) like transaction details and device information. They use this data to operate, improve services, detect fraud, prevent losses, authenticate transactions, and analyze service performance. They act as both processors for us and independent controllers of the data they collect from you. You can learn more about Paystack and Stripe, and read its privacy policy at https://paystack.com/terms and https://stripe.com/privacy respectively. The transaction data may be processed for the purpose of keeping proper records of those transactions. Our legal basis for processing this data is our legitimate interest in properly administering our website and communications.

3.4 Communications We process correspondence data (communications you send us) for communicating with you and keeping records. Any content, including such comments, feedback, and notes that you choose to post on our publicly accessible platforms, are available to the public by default. Take care not to disclose information about yourself unless you intend for that data to become public. Please also be considerate and respectful of others while using our online platform to publish your opinions. Every information about donors shall be kept confidential except as required for the purpose of financial accountability and legal compliance. We reserve the right but do not have the obligation, to review and monitor publicly-available content, non-publicly available communications between partners, and any other content made on or through our Services, and to remove postings or content that may be viewed as inappropriate or offensive to others. Our legal basis for processing this data is our legitimate interest in properly administering our website and communications.

3.5 Enquiries and Notifications When you submit enquiries, we process that data to keep you informed about our news, mission needs, and involvement opportunities based on your consent. Similarly, if you subscribe to our notifications or newsletters, we process that data to send you relevant communications, also based on your consent.

3.6 Legal and Compliance Purposes We may process your personal data to establish, exercise, or defend legal claims, comply with legal obligations, or protect vital interests of you or others. Our legal basis for this processing is our legitimate interest in protecting legal rights and complying with law.

3.7 Further / Other Data Further to the specific data categories identified above, we also process any of your personal data in order to comply with a legal obligation that applies to us, or in order to protect your vital interests or the vital interests of another natural person.

• Open an account or access, use, interact with, or register with us;
• Donate to any of our mission works, organizations, or causes online or offline;
• Post comments, leave feedback, send thank-you notes, or communicate with other users via our online platforms;
• Complete surveys or questionnaires or provide feedback on our work;
• Request features like newsletters and updates;
• Contact us for troubleshooting, support, or other communications.

4.0 DATA DISCLOSURE

• 4.1 We may disclose your personal data to our partners in ministry for purposes consistent with this Notice, as to ensure continuance of our services set forth in this notice provided the same remains reasonably necessary for the purposes set out in this policy.
• 4.2 We may disclose your name, your unique ID, your email address and your address to our vendors so they can perform services for us. Examples of such functions include marketing, mailing information, data storage, security, identity verification, fraud prevention, payment processing, preventing fraud and misuse, legal services, database maintenance and other updates in accordance with your communication preferences as recorded in our system. Our website provider and host is Vercel. Our mailing lists are operated by IONOS. You can find our subcontractors' privacy policies and practices at: - Vercel (https://vercel.com/legal/privacy-policy) - IONOS (https://www.ionos.co.uk/privacy-policy)
• 4.3 As stated in 3.3 above, financial transactions relating to our website are handled by Paystack and Stripe. We may disclose transaction data to our payment services providers to the extent necessary for processing payments, handling refunds, and addressing complaints or queries related to payments and refunds. Details regarding the payment services providers' privacy policies and practices are available as stated in 3.3 above.
• 4.4 For the purposes of service delivery and to conduct analyses of user demographics, interests, and behavior in order to enhance our services, your data may be made accessible to our website provider. Use of personally identifiable data shall occur only to the extent necessary and in instances where the legitimate interests of our website provider are not outweighed by considerations of your privacy.
• 4.5 We may disclose your information in instances where you have provided consent to such disclosure. For example, in connection with certain mission work, we collaborate with third-party mission partners. Upon your consent to provide your contact information to a specific mission partner for the purposes of supporting specific mission work, we shall disclose the following information to said mission partner: your name, email address, and any other information you have provided in connection with your donation to the specific mission work.
• 4.6 We may transfer, disclose, and preserve your information to courts, law enforcement agencies, governmental or public authorities, tax authorities, or authorized third parties to the extent required or permitted by law. Such disclosure may occur where reasonably necessary: (i) to comply with our legal obligations; (ii) to respond to a valid legal request, such as a subpoena or court order; (iii) in connection with a criminal investigation or to address alleged or suspected illegal activity, or any activity that may expose us, you, our users, or the public to imminent harm or legal/regulatory liability; (iv) to respond to claims asserted against us; (v) to enforce and administer our Terms of Service or other policies; or (vi) to protect the rights, property, or personal safety of our mission work, missionaries, users, or members of the public.
• 4.7 Information is disclosed as stated in the Cookie Policy.

5.0 PUBLICLY ACCESSIBLE DATA

Certain data you submit may be publicly accessible (including, but not limited to, posts and comments). In connection with sponsoring a particular mission work, certain information will be made publicly available and may not be subject to protections under applicable data protection laws. We collect volunteered information through forums, surveys, customer support interactions, and submissions of ideas, feedback, or other communications. By providing such information, you acknowledge and agree that we are under no obligation to maintain confidentiality with respect to such information under applicable law. The terms of this section shall survive termination of your account or use of the service.

6.0 CHILDREN

Our services are not intended for use by individuals under the age of 18. Use of the services and/or submission of information by persons under 18 is prohibited. If you have reason to believe a child under 18 has provided personal information to us via our online platforms, please contact us at support@merciheart.org. We will delete such information from our databases to the extent required by applicable law. In the event you provide information regarding children under the age of 18, you represent and warrant that you are the child's parent or legal guardian, or that you have obtained the parent or legal guardian's authority and consent for us to access, disclose, and use such data in connection with our mission work.

7.0 LOCAL STORAGE AND DEVICE DATA

Merciheart does not currently use cookies for tracking or advertising purposes. However, we may use your browser's local storage to securely store small pieces of information on your device. This helps improve your experience by remembering preferences, keeping you signed in, and supporting essential platform functionality. The information stored is limited to what is necessary for the platform to function properly and is not used to track your activity across other websites. You can clear local storage at any time through your browser settings. Please note that doing so may affect certain features of the platform.

8.0 THIRD-PARTY WEBSITES

• 8.1 Our website contains hyperlinks to and details of third-party websites.
• 8.2 This Privacy Notice governs solely our websites and does not apply to the privacy policies governing third-party websites, even where links to such websites are provided by us. We disclaim responsibility for the privacy policies and practices of third-party websites. If you utilize any link on our website, we recommend that you review the privacy policy of the linked website prior to sharing any personal or financial data.
• 8.3 We maintain social media pages on platforms including Facebook, X, Instagram and Tiktok. This Policy addresses our use of data collected from these pages but does not govern how the providers of such social media websites use your information. You are advised to review the privacy policy of each social media website before sharing data and to utilize available privacy settings and reporting mechanisms to control the use of your data.

9.0 AMENDMENT

• 9.1 We reserve the right to update and modify this Policy from time to time. Any such updates shall be effective immediately upon posting of the revised Policy on our website.
• 9.2 It is the responsibility of the User to periodically review this Policy to ensure awareness of and concurrence with any amendments.
• 9.3 We may, as we deem fit, notify Users of material changes to this Policy via email or postal mail, in accordance with the communication preferences on file in our systems.

10.0 SECURITY

We may maintain data collected from you in both paper and electronic formats. While no data management system can ensure absolute security, we have implemented and continue to enhance technical and organizational safeguards designed to protect information submitted via our online platforms against loss, unauthorized access, disclosure, misuse, alteration, or destruction.

11.0 DATA TRANSFER

• 11.1 Merciheart is a global entity with headquarters in Nigeria. We may process and transfer your information in multiple countries and regions worldwide in connection with our operations. We have implemented appropriate cross-border data transfer mechanisms, such as Standard Contractual Clauses or other legally approved transfer methods, to ensure adequate protection for transfers of personal data in accordance with applicable data protection laws (including but not limited to the Nigeria Data Protection Regulation and GDPR, where applicable).
• 11.2 We employ technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, or destruction. These measures include (but are not limited to) encryption of data where appropriate, access controls, and regular reviews of our data handling practices to maintain compliance with applicable data protection laws.
• 11.3 You have rights regarding your personal data under applicable data protection laws, which may include rights to access, rectify, erase, restrict processing, object to processing, and data portability. If you wish to exercise any of these rights or have questions about how we handle your data, please contact us through the channels provided on our website.

12.0 OTHER APPLICABLE TERMS

Your access to, use of, and interaction with Merciheart's online platforms (collectively, the "Services") are subject to and governed by our Terms and Conditions (find here https://www.merciheart.org/terms "Terms"), along with any other supplemental terms, policies, or guidelines that we may make available or notify you of in connection with your use of the Services. By accessing or using the Services, you acknowledge that you have read, understood, and agree to be bound by these Terms and any such additional terms, policies, or guidelines. We reserve the right to modify these Terms at any time in accordance with the provisions set forth herein regarding amendments.

13.0 CONTACT ON DATA PRIVACY

Please be advised that our Privacy and Data Protection team are authorized to handle and respond to inquiries related solely to data privacy matters. If your email pertains to topics other than data privacy, you may not receive a response. For assistance with non-privacy related matters, please visit our Help Center.

To contact us regarding your personal data or data privacy matters generally, please email support@merciheart.org.

14.0 GENERAL CONTACT INFO

• 14.1 This website is the official online platform of Merciheart, a duly registered Incorporated Trustee in Nigeria under the Companies and Allied Matters Act. Our registration number is [9474239].
• 14.2 Our registered address and primary place of business is [3rd Floor, 102, St. Finbarrs Rd, Akoka, Lagos, Nigeria].
• 14.3 For any inquiries concerning this Privacy Notice or our data practices, you may reach us through the following channels: (a) Email: info@merciheart.org

15.0 INFORMATION UPDATE

Kindly notify us of any changes or updates required for the personal information we have on file for you

16.0 OPERATIONAL LIMIT

When you engage with our social media accounts, we operate as a data processor, not a data controller. As such, our legal obligations concerning this data are governed by the contract we hold with the relevant data controller (e.g., the social media platform itself).