Privacy notice

1. Who we are

Evidtrail is an election-evidence service for campaigns, parties and their lawyers in Nigeria. It is built and run by Protomated, operating in Nigeria as [registered company name, RC number], [registered address] ("Evidtrail", "we", "us").

This notice explains how we handle personal data when you visit evidtrail.com, ask for a demo, apply to our partner programme, or work as a polling agent for a campaign that uses Evidtrail. It is written to meet the Nigeria Data Protection Act 2023 (NDPA) and the General Application and Implementation Directive (GAID) 2025.

Our Data Protection Officer is [DPO name], who you can reach at [DPO email]. Our registration with the Nigeria Data Protection Commission (NDPC) is [NDPC registration number].

2. What we collect

When you book a demo or apply as a partner, we collect what you type into the form:

Demo bookings: your name, role, phone number, email address, the race you're booking for, state, constituency, rough number of polling units, who referred you, how you heard about us, and whether you are already recruiting agents or contested a 2023 result.
Partner applications: your agency's name, your name, email and phone number, the number of clients you have by race type, the regions you work in and the partner tier you're interested in.
For every form: the page you sent it from, the referring site and any campaign tags in the link (utm codes), and the time you sent it.
Your IP address, which we hold in memory for a few minutes to stop automated abuse of the forms. We don't store it with your request.

3. Data we process for our clients

When a campaign uses Evidtrail, it decides what data goes in and why. For that data the campaign is the controller and we are its processor: we act only on its written instructions, under a data processing agreement.

This covers the campaign's polling agents (name, phone number, assigned polling unit, consent record, and the time and location of each check-in) and what agents capture on election day: photos of signed result sheets, vote counts and incident reports.

We never collect voter data of any kind. Evidtrail does not hold voter registers, voter card numbers, NINs, biometrics or contact lists of voters, and it does not message, target or pay voters.

4. Why we use it and on what basis

We don't use your data for advertising, sell it, or share it with other campaigns. You can withdraw your consent at any time by emailing us; this doesn't affect what we did before you withdrew it.

To reply to your demo request or partner application, arrange calls and send you the sample evidence pack. Basis: your consent, given on the form, and our legitimate interest in responding to people who contact us.
To decide who on our team should follow up, using the details you give (for example, the size of your race). This is not automated decision-making with legal effect: a person always reviews and contacts you.
To run the service for clients and their agents. Basis: performance of our contract with the client, on the client's instructions as its processor.
To keep the site and service secure and to meet legal obligations, including record-keeping and responding to lawful requests. Basis: legal obligation and legitimate interests.

5. Sensitive data

Working as an agent for a candidate or party can reveal political opinion, which the NDPA treats as sensitive personal data. We handle it with extra care:

Agents give explicit consent, through the campaign, before their data is used. The consent is recorded with the agent's record.
We collect only what agent operations and evidence need, and nothing about how anyone voted.
Each campaign's data sits in its own workspace. Rival campaigns, partners and other clients can never see it.
Data is encrypted in transit and at rest, access is limited to named staff, and every view, download and export of evidence is logged.
We completed a data protection impact assessment on [DPIA date], before processing this data.

6. Who we share it with

We use a small number of service providers who process data for us under contract:

Twenty (CRM), which stores demo and partner requests. Hosted in [Twenty hosting region].
Mailgun, which sends confirmation and notification emails. Hosted in [Mailgun region].
Cloudflare, which delivers the website, protects it from attacks and provides cookieless analytics.
Amazon Web Services, which hosts the client platform and evidence (see below).
Licensed SMS and USSD aggregators, which carry agents' messages from basic phones.

7. Where data is stored and transfers

Client and agent data is stored primarily in Nigeria, in Amazon Web Services' Lagos Local Zone. Encrypted backups and the write-once evidence archive are kept in AWS's Cape Town region in South Africa, under keys we control.

Some of the providers above, including the CRM and email services that handle website requests, may process data outside Nigeria. Where data leaves Nigeria we rely on the transfer bases in the NDPA, such as adequate protection in the receiving country, contractual safeguards, or your consent, and we record each transfer.

8. How long we keep it

Demo and partner requests: up to 24 months after our last contact with you, unless you become a client or partner, in which case we keep them for the length of that relationship plus 6 years for legal and tax records.
Client and agent data: for the engagement, then deleted or returned to the client as the contract sets out.
Election evidence: kept under legal hold through petitions and appeals, by default 24 months after the result is declared, longer if the client's lawyers extend the hold for an active case.
Security logs: up to 12 months.

9. Your rights

Under the NDPA you can ask us to give you a copy of your personal data, correct it, delete it, restrict or object to how we use it, or move it to another provider, and you can withdraw consent at any time.

To use these rights, email our Data Protection Officer at [DPO email] or write to us at the address above. We may ask you to confirm your identity. We reply without undue delay and within the time the NDPA allows.

If you are a polling agent, your campaign controls your data. Ask the campaign first; we will help it respond, and we will pass on any request you send to us.

You can also complain to the Nigeria Data Protection Commission at ndpc.gov.ng.

10. Website analytics and cookies

evidtrail.com sets no cookies and uses no advertising or retargeting pixels. We use Cloudflare Web Analytics, which counts visits without cookies and without identifying you.

When you close the notice about this page, your browser stores a note that you've seen it (local storage, key "et-notice-v1"). It never leaves your device.

11. Security and breaches

We protect data with encryption, separate workspaces per client, least-privilege access and audit logs. If a breach is likely to put your rights at risk, we report it to the NDPC within 72 hours of becoming aware of it and tell the people affected without undue delay. Where we are a processor, we tell the client so it can do the same.

12. Children

Evidtrail is for campaigns, lawyers and agencies. It is not meant for anyone under 18, and we don't knowingly collect their data.

13. Changes to this notice

We will update this notice when our practices change and show the new version and date at the top. If a change materially affects how we use data you have already given us, we will tell you before it takes effect.

14. Contact

Data Protection Officer: [DPO name], [DPO email], [registered address].

General questions: [email protected], or call or WhatsApp 0814 405 8486.