Data processing summary

1. About this summary

This page summarises the data processing agreement (DPA) that forms part of every Evidtrail client contract. It is written to meet the Nigeria Data Protection Act 2023 (NDPA) and the GAID 2025. If this summary and a signed DPA differ, the signed DPA applies.

2. Roles

The client (a campaign, party or law firm) is the data controller. It decides which agents to recruit, what data to collect and how evidence is used. Evidtrail is the data processor and acts only on the client's documented instructions.

For its own business records, such as billing contacts and website requests, Evidtrail is a controller under its privacy notice.

3. Scope of processing

We process the following for the client:

Agent roster: names, phone numbers, polling unit assignments, appointment details and consent records.
Election-day activity: check-ins, location at capture, accreditation counts and incident reports.
Results and evidence: photos of signed result sheets, their fingerprints, comparisons with IReV uploads and chain-of-custody records.
Client users: the names, emails and access logs of campaign staff and lawyers who use the dashboard.

4. Purposes

We use client data only to run the client's agent operations, collect and seal evidence, compare results and prepare evidence packs for the client's lawyers. We never use it to contact, profile, target or pay voters, never sell it, and never use one client's data for another client or to train models for others.

5. Our commitments as processor

Process client data only on the client's written instructions, and tell the client if we believe an instruction breaks the law.
Make sure everyone with access is bound by confidentiality.
Help the client answer data subject requests, carry out impact assessments and deal with the NDPC.
Make available the information the client needs to show compliance, and allow reasonable audits on notice.

6. Security measures

Each client's data is kept in its own isolated workspace, enforced in the database, with per-client encryption keys.
Data is encrypted in transit and at rest.
Evidence is fingerprinted on the phone at capture and stored write-once, so the original cannot be changed or deleted during the retention period.
Access is least-privilege, needs multi-factor sign-in for staff, and every view, download and export of evidence is logged.
We notify the client of a personal data breach without undue delay and within 72 hours of becoming aware of it, with what we know and what we are doing about it.

7. Sub-processors

We use these sub-processors for client data. We tell clients in advance of adding or replacing one, so they can object.

Amazon Web Services: hosting, database and evidence storage. Primary in the Lagos Local Zone, Nigeria; encrypted backups and archive in Cape Town, South Africa.
Licensed SMS and USSD aggregators: carry messages from agents on basic phones. Nigeria.
Mailgun: account and notification emails to client users. [Mailgun region].
[Any further sub-processors, e.g. error monitoring, with location]

8. International transfers

Client data stays in Nigeria except for encrypted backups and the evidence archive in South Africa, and any transfers listed above. Each transfer relies on a basis allowed by the NDPA, such as contractual safeguards, and is recorded.

9. Agent consent

Before an agent's first capture, the Evidtrail app (or an SMS for basic phones) explains in plain language what is collected, why, who sees it and how long it is kept, and asks the agent to agree. We record the time, the version of the wording shown and the device, and the client can see each agent's consent record.

An agent can withdraw consent at any time through the app, by SMS or through the campaign. Evidence already sealed stays under the client's legal hold, as the agent is told before agreeing.

10. End of engagement

When the engagement ends, the client chooses to receive a full export of its data and evidence packs, or to have it deleted. We delete or return the data within [30] days of the client's choice, and delete backups on their normal cycle, unless the law requires us to keep it.

Evidence under legal hold is kept until the hold ends: by default 24 months after the result is declared, longer if the client's lawyers extend it for a pending petition or appeal. When the hold ends we delete the evidence and confirm it to the client in writing.

11. Contact

Data Protection Officer: [DPO name], [DPO email], [registered address]. To get the full DPA, ask your account lead or email [email protected].