LegitGood privacy policy

1. Who we are and what this policy covers

LegitGood is a platform that connects verified African NGOs, the funders who back them, and the donors who give to them. The platform is available at legitgood.org and is operated by The Luminary Project (“we”, “us”, “our”).

This policy explains what personal data we collect, why we collect it, how we use and share it, and the rights you have over it. It applies to everyone who uses the platform, including NGO team members and administrators, funders and their representatives, donors, and visitors to the site.

We are committed to complying with the Nigeria Data Protection Act 2023 (NDPA) and the regulations and guidance issued by the Nigeria Data Protection Commission (NDPC). Where users, funders, or donors are located in the European Economic Area or the United Kingdom, we apply standards consistent with the EU and UK General Data Protection Regulation (GDPR) to their personal data.

2. The information we collect

We collect the following categories of information:

• Account information. Name, email address, phone number, password, role, and the organisation you belong to.
• Organisation verification documents. To verify an NGO’s registration and standing, we collect documents the organisation uploads or is asked to provide — for example certificate of incorporation (CAC), tax identification number, board or leadership list, audited financial statements, strategic plans, and other supporting records relevant to eligibility. These are reviewed by our team directly, not by an automated third-party identity provider.
• Organisation profile information. Registration details, registration numbers, sector, country, leadership, programme descriptions, impact metrics, and any documents an organisation uploads to support its verification or public profile.
• Donation and payment information. Donor name, email address, donation amount, currency, transaction records, and records of the platform fee deducted from each donation. Card and bank details are collected and processed by our payment processor, Paystack. We do not store full card numbers or bank credentials.
• Grant information. Grant opportunities posted by funders, applications submitted by NGOs, supporting documents, and communications relating to a grant.
• Operational data entered by NGOs. Programme records, activity logs, donor relationship records, and financial records that NGOs enter into the platform to run their organisations. NGOs are the controllers of this data and we process it on their behalf.
• Communications. Messages you send to us, support requests, and feedback.
• Technical and usage data. IP address, device and browser information, pages visited, and actions taken on the platform, collected through logs and cookies.

3. How we use your information and our lawful bases

We use personal data for the following purposes and rely on the following lawful bases under the NDPA and, where applicable, the GDPR:

• To provide the platform. Creating and managing accounts, operating the grant pipeline, donor management, and financial tools, and enabling donations and grant applications. Lawful basis: performance of a contract.
• To verify organisations. Reviewing an NGO’s registration documents and organisation profile before it is published as verified. Lawful basis: legitimate interests in maintaining a trusted platform, and legal obligation where verification is required by law.
• To process payments and collect our fee. Facilitating donations through Paystack, deducting the platform fee, keeping transaction records, and providing settlement statements to organisations. Lawful basis: performance of a contract and legal obligation.
• To communicate with you. Service messages, security alerts, support responses, and, with your consent where required, product updates and newsletters. Lawful basis: performance of a contract, legitimate interests, or consent.
• To keep the platform safe. Detecting fraud, abuse, and security incidents, and enforcing our terms. Lawful basis: legitimate interests and legal obligation.
• To improve the platform. Analysing usage to fix problems and improve features. Lawful basis: legitimate interests.
• To comply with the law. Responding to lawful requests from regulators, courts, and law enforcement. Lawful basis: legal obligation.

4. Verification

Verification is central to how LegitGood works. When an NGO submits registration and financial documents, we use them only to confirm the organisation’s legitimacy and eligibility, to review its public profile, and to maintain the integrity of the platform. Verification records are kept secure, access to them is restricted to our team, and the underlying documents are never displayed publicly. A verified badge on a profile indicates that our verification checks were completed on the current version of each document. It does not disclose the documents themselves.

5. Payments and donations

Donations made through the platform are processed by Paystack. When you pay, your payment details are submitted directly to Paystack and are subject to Paystack’s own privacy policy. We do not hold funds. A platform fee — a flat 9% of the donation, capped at 100,000 naira or 100 US dollars per transaction, as published at legitgood.org/pricing — is deducted automatically at the point of payment, unless the donor chooses at checkout to cover it, in which case the receiving organisation receives the full gift. This fee is how the platform stays free for NGOs to use.

We receive and retain transaction records, such as the payer’s name, email address, amount, fee deducted, and the receiving organisation, so that donors can track their giving and organisations can manage their funding and donor relationships.

Donors should be aware that when they give to an organisation, that organisation will receive their name, email address, and transaction details, and will process that information as a data controller under its own responsibilities.

6. How we share information

We do not sell personal data. We share it only in the following circumstances:

• On the platform, as designed. Verified organisation profiles are visible to funders, donors, and the public. Grant applications and related documents are shared with the funder that posted the grant. Donor details are shared with the organisation that receives the funds.
• Service providers. We use third parties to provide hosting and infrastructure, payment processing, email delivery, and analytics. They process personal data on our instructions and under contracts that protect it.
• Legal and safety. We may disclose information where required by law, to respond to lawful requests, to protect the rights, safety, or property of our users or the public, or to enforce our terms.
• Corporate events. If The Luminary Project restructures, merges, or transfers the platform to another organisation, personal data may be transferred as part of that event, subject to this policy.

7. International transfers

Our service providers may store or process data outside Nigeria, including in countries that do not have data protection laws equivalent to the NDPA or the GDPR. Where we transfer personal data internationally, we do so in accordance with the NDPA and, where applicable, GDPR transfer rules, using safeguards such as contractual protections and transfers to countries with adequate levels of protection.

8. How long we keep information

We keep personal data only for as long as it is needed for the purposes described in this policy, and afterwards for as long as we are required to keep it by law, for example for financial record keeping, tax, and anti fraud purposes. Transaction and fee records are retained to meet accounting and audit obligations. Verification records are retained for as long as the related account is active and for a limited period afterwards to meet legal and audit obligations. When data is no longer needed, we delete it or anonymise it.

9. Security

We use technical and organisational measures appropriate to the risk to protect personal data, including encryption in transit, access controls, and restricted access to verification records. No platform can guarantee absolute security, so we encourage you to use a strong password and to contact us immediately if you suspect unauthorised access to your account.

10. Your rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you and receive a copy of it.
• Correct personal data that is inaccurate or incomplete.
• Delete your personal data in certain circumstances.
• Object to or restrict certain processing, including processing based on legitimate interests.
• Withdraw consent at any time where processing is based on consent.
• Receive your personal data in a portable format where technically feasible.
• Lodge a complaint with the Nigeria Data Protection Commission or, if you are in the EEA or the UK, with your local data protection authority.

To exercise any of these rights, contact us using the details in section 15. We will respond within the timelines required by applicable law. Note that where NGOs enter data about their own donors or beneficiaries into the platform, the NGO is the controller of that data and requests should be directed to the NGO. We will assist NGOs in responding where we can.

11. Children

The platform is not directed at children and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Cookies and similar technologies

We use cookies and similar technologies to keep you signed in, remember your preferences, secure the platform, and understand how it is used. You can control cookies through your browser settings. Blocking essential cookies may prevent parts of the platform from working.

13. Third party links and services

The platform contains links to third party sites and services, including the websites of organisations, funders, and Paystack. This policy does not cover those third parties and we are not responsible for their privacy practices. Review their policies before providing them with personal data.

14. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you through the platform or by email before the changes take effect. The effective date at the top of this policy shows when it was last revised. See also our terms and conditions.

15. How to contact us

If you have questions about this policy or how we handle personal data, or if you want to exercise your rights, contact:

The Luminary Project, operator of LegitGood

Email: privacy@legitgood.org

If you are not satisfied with our response, you may complain to the Nigeria Data Protection Commission at ndpc.gov.ng or, if you are in the EEA or the UK, to your local supervisory authority.