TOS & PP

PRIVACY POLICY

Kindly and carefully review our privacy policy and terms of service below

ABOUT WoPU

Built from the market, the workshop, the farm, the road, and the office.

Working People United (WoPU) is a grassroots movement shaped by the strength, resilience, and aspirations of ordinary Nigerians. It brings together workers, artisans, traders, farmers, professionals, transporters, and other citizens whose labour powers the nation

ABOUT WoPU

Built from the market, the workshop, the farm, the road, and the office.

EFFECTIVE 2026

WORKING PEOPLE UNITED PRIVACY POLICY

1. WHO WE ARE (DATA CONTROLLER)

This policy explains how [FULL LEGAL ENTITY NAME] ("Working People United", "WoPU", "we", "us", "our"), collects, uses, stores, shares, and protects your personal data when you register as a member or use our website https://www.workingpeopleunited.org (the "Site").

We are the Data Controller responsible for your personal data under the Nigeria Data Protection Act 2023 ("NDPA") and the NDPC General Application and Implementation Directive 2025 ("GAID").

2. SCOPE

This policy applies to all members, prospective members, and visitors whose personal data we process. It applies to data subjects in Nigeria and is intended to meet the requirements of the NDPA and GAID.

3. THE PERSONAL DATA WE COLLECT

When you register for membership and use your member profile, we collect:

Identity & contact data

First name, last name
Date of birth
Gender
Email address
Phone number
Residential address
State of residence, state of origin, state chapter, Local Government Area (LGA), ward
Profile photograph

Membership & engagement data

Occupation (and association, where provided)
Membership ID, membership card details, and issue date
Referral information (your referral link and, where applicable, the member who referred you)

Government identifiers & financial data

National Identification Number (NIN)
Voter's Identification Number (VIN / voter's card number)
Bank name, bank account name, and bank account number

Consent & technical data

Your consent record and the date/time it was given
Records generated automatically by our systems and our website host (see Section 13)

We do not knowingly collect data from anyone under 18 years of age. Membership registration is restricted to persons aged 18 and above (see Section 12).

4. HOW WE COLLECT YOUR DATA

We collect personal data directly from you when you complete the membership registration form, update your member profile, or otherwise communicate with us. Some technical data is collected automatically by our website host when you use the Site (see Section 13).

5. Why we use your data and our lawful bases (NDPA s.25)

We only process your personal data where the NDPA permits. The lawful bases we rely on are:

Purpose

Create and manage your membership; issue and verify your membership card
Communicate with you about the movement and campaigns
Operate the referral programme
Prevent fraud, duplicate registrations, and verify eligibility
Monetary disbursements, reimbursements, etc
Comply with legal obligations

Personal data used

Identity, contact, membership data, NIN/VIN (identity verification)
Name, email, phone
Referral link, referrer ID
NIN, VIN, phone, email
Bank name, account name, account number
As required

Lawful basis (NDPA s.25)

Consent; performance of our membership arrangement with you
Consent (you may withdraw it at any time)
Consent; legitimate interest in growing the movement
Legitimate interest in the integrity of our membership register
Consent
Legal obligation

6. Sensitive personal data

Because WoPU is a civic/political movement, the fact of your membership may reveal your political opinions or affiliation, which is sensitive personal data under the NDPA. We process such data only where you have given your explicit consent for the specific purpose, or where another condition in the NDPA applies. You may withdraw your consent at any time (see Section 8). We apply additional safeguards to sensitive personal data, government identifiers (NIN, VIN), and financial data.

7. Disclosure and sharing of your data

We do not sell your personal data. We share it only with:

Service providers (Data Processors) who process data on our behalf under written instructions and appropriate safeguards, including:
- Wix.com Ltd — our website and content management platform, and our email/contact communication tools.
- Amazon Web Services (AWS) — our membership database hosting (see Section 9).
Authorities, regulators, or courts where we are required to disclose by law.

Each processor is required to protect your data and use it only for the purposes we specify.

8. Consent and how to withdraw it

Where we rely on consent, that consent is freely given, specific, and informed, and is not bundled with other terms. You may withdraw your consent at any time, for example, to stop campaign communications by contacting our DPO (Section 1) or using any unsubscribe option provided. Withdrawing consent does not affect processing carried out before the withdrawal, and may mean we can no longer provide certain membership services.

9. Cross-border transfer of your data

Our membership database is hosted by AWS in the Africa (Cape Town) Region, South Africa. This means your personal data is transferred to and stored outside Nigeria. We make such transfers in accordance with NDPA Sections 41–43, and we record the legal basis relied upon for the transfer. We take reasonable steps to ensure that any country or provider to which data is transferred provides an adequate level of protection, or that appropriate safeguards and your consent are in place.

10. How long we keep your data (retention)

We keep your personal data only for as long as necessary for the purposes described in this policy, for the duration of your membership, and some time after your membership ends, unless a longer period is required by law. When data is no longer needed, we securely delete or anonymise it.

11. How we protect your data (NDPA s.39)

We implement appropriate technical and organisational measures to protect your data, including encryption of data at rest and in transit, access controls and authentication, network security controls, database-level uniqueness and integrity constraints, monitoring and logging, periodic risk assessment, regular testing and evaluation of our controls, and processes for the timely restoration of data after an incident. We treat the measures in NDPA s.39(2) as a minimum, not a ceiling.

12. Children

Membership is restricted to persons 18 years and older. We do not knowingly collect the personal data of children. If you believe a child has provided us data, contact our DPO and we will delete it.

13. Website, cookies, and our host

Our Site is hosted on Wix. Wix and our analytics/functional tools may place cookies or similar technologies on your device for essential functionality, security, and performance. You can control cookies through your browser settings; disabling some may affect Site functionality. [Confirm and list the specific cookies/analytics in use, or link to Wix's cookie disclosures.]

14. Your rights as a data subject

Under the NDPA and GAID, you have the right to:

Be informed about how your data is processed (this policy);
Access the personal data we hold about you;
Rectify inaccurate or incomplete data (you can update much of this in your member profile);
Erase your data ("right to be forgotten"), where applicable;
Restrict or object to certain processing;
Withdraw consent at any time;
Data portability, where and when established by NDPC regulations;
Lodge a complaint with the Nigeria Data Protection Commission (see Section 16);
Not be subject to a decision based solely on automated processing that significantly affects you, where applicable.

To exercise any right, contact our DPO (Section 1). We will respond within the timeframe required by the NDPA/GAID. We may need to verify your identity before acting on a request.

15. Personal data breaches

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and we will inform affected data subjects where required.

16. Complaints to the regulator

If you are not satisfied with how we handle your data, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC):

Website: https://ndpc.gov.ng

17. Changes to this policy

We may update this policy from time to time. We will post the updated version on the Site and revise the "Last updated" date. Material changes will be communicated to members where appropriate.

18. Contact us

For any questions about this policy or your personal data, contact us at info@workingpeopleunited.org or 08033102277