PRIVACY POLICY

I. Introduction

Ikoyi Baptist Church ("IBC," "we," "our," or "us") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, disclose, and protect your personal data when you visit our website at www.ikoyibaptistchurch.org (the "Website"), use our online services, or interact with us through our digital platforms, including our podcast platform, social media channels, and online giving portals.

This Policy is issued in compliance with the Nigeria Data Protection Act, 2023 (NDPA), the General Application and Implementation Directive (GAID) 2025 issued by the Nigeria Data Protection Commission (NDPC), and the provisions of Section 37 of the 1999 Constitution of the Federal Republic of Nigeria (as amended), which guarantees citizens' right to privacy.

By accessing or using our Website and services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with any part of this Policy, please discontinue use of our Website and services.

II. Data Controller Information

For the purposes of the NDPA, the data controller responsible for your personal data is:

III. Personal Data We Collect

We may collect and process the following categories of personal data, depending on how you interact with our Website and services:

A. Information You Provide Directly

B. Information Collected Automatically

• •Website Usage Data: When you visit our Website, we may automatically collect technical information including your IP address, browser type and version, operating system, referring website, pages visited, time and date of visit, and time spent on each page.
• •Cookies and Similar Technologies: Our Website may use cookies and similar tracking technologies to enhance your browsing experience. See Section IX (Cookie Policy) below for details.
• •Livestream and Media Engagement: When you access our media content, livestreams, or podcast, we may collect data about your engagement patterns such as play counts, duration, and device information.

C. Information from Third Parties

We may receive information about you from third-party platforms where you interact with us, including Facebook, Instagram, X (formerly Twitter), and YouTube. This information is subject to the privacy policies of those platforms.

IV. Lawful Basis for Processing

In accordance with the NDPA, we process your personal data based on one or more of the following lawful bases:

• •Consent: Where you have given clear, informed, and unambiguous consent for us to process your personal data for a specific purpose (e.g., receiving prayer alerts, newsletter subscriptions, sharing of your testimony).
• •Legitimate Interests: Where processing is necessary for the legitimate interests of IBC, including facilitating church operations, administering ministries, and fulfilling our spiritual mission, provided such interests are not overridden by your fundamental rights and freedoms.
• •Contractual Necessity: Where processing is necessary to fulfil an obligation arising from your registration for church programmes, events, or services.
• •Legal Obligation: Where processing is necessary to comply with a legal obligation to which IBC is subject under Nigerian law.
• •Vital Interests: Where processing is necessary to protect the vital interests of you or another individual (e.g., emergency contact information).

V. How We Use Your Personal Data

We use your personal data for the following purposes:

• •To facilitate worship, fellowship, discipleship, evangelism, and ministry in accordance with our five-fold purpose.
• •To process and respond to your prayer requests, counselling requests, and testimonies.
• •To process and acknowledge your donations and provide giving statements.
• •To register and manage your participation in Sunday School, Home Cells, Discipleship programmes, and other church activities and events.
• •To communicate with you about church services, events (including Night of the Supernatural, revivals, and special programmes), and announcements.
• •To maintain membership records and support the administrative functions of the Church Council and Purpose Driven Vehicles (PDVs).
• •To deliver media content including livestreams, sermon recordings, and podcast episodes.
• •To improve our Website, services, and user experience through analytics.
• •To comply with our obligations under the Nigerian Baptist Convention, the Lagos State Baptist Conference, and the Shalom Baptist Association.
• •To comply with applicable legal and regulatory requirements.

VI. Sensitive Personal Data

As a religious organisation, some of the personal data we process may constitute sensitive personal data under the NDPA, including information relating to your religious beliefs, spiritual life, and personal circumstances shared during counselling or prayer requests. We process such data only with your explicit consent and in accordance with our spiritual mission. We implement enhanced security measures to protect sensitive personal data and restrict access to authorised pastoral and administrative staff only.

VII. Data Sharing and Disclosure

We do not sell, trade, or rent your personal data to third parties. We may share your personal data in the following limited circumstances:

• •Pastoral Team and Church Officers: Your data may be shared with relevant pastoral staff, ministry leaders, and church officers on a need-to-know basis to support your spiritual care and participation in church activities.
• •Payment Processors: When you make a donation, your payment information is processed by our third-party payment service providers who operate under strict data protection obligations.
• •Denominational Bodies: We may share aggregate or anonymised data with the Nigerian Baptist Convention, Lagos State Baptist Conference, or Shalom Baptist Association for reporting purposes.
• •Technology Service Providers: We engage third-party service providers for website hosting, email services, podcast hosting, and media streaming. These providers process data on our behalf under data processing agreements.
• •Legal Requirements: We may disclose your personal data where required by law, regulation, court order, or governmental request.
• •With Your Consent: We may share your personal data with other parties where you have given specific consent (e.g., publication of your testimony on our Website or social media channels).

VIII. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Specific retention periods include:

Upon expiry of the applicable retention period, we will securely delete or anonymise your personal data.

IX. Cookie Policy

Our Website may use cookies and similar technologies. Cookies are small text files placed on your device to help us provide and improve our services. In compliance with the NDPA and the GAID, we will obtain your opt-in consent before placing non-essential cookies on your device.

Types of Cookies We May Use:

• •Essential Cookies: Necessary for the basic functioning of our Website (e.g., session management, security). These do not require consent.
• •Analytics Cookies: Used to understand how visitors interact with our Website and to improve user experience. These require your consent.
• •Third-Party Cookies: Our Website may embed content from third parties such as YouTube (for livestreams) and social media platforms. These third parties may set their own cookies, subject to their respective privacy policies.

You can manage your cookie preferences through your browser settings. However, disabling certain cookies may affect the functionality of our Website.

X. Your Rights as a Data Subject

Under the NDPA, you have the following rights in relation to your personal data:

• •Right of Access: You have the right to request confirmation of whether we process your personal data, and to obtain a copy of such data.
• •Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data.
• •Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, or where you withdraw your consent.
• •Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data in certain circumstances.
• •Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• •Right to Object: You have the right to object to the processing of your personal data based on legitimate interests.
• •Right to Withdraw Consent: Where processing is based on consent, you have the right to withdraw your consent at any time.

To exercise any of these rights, please contact us at info@ikoyibaptistchurch.org. We will respond to your request within 30 days.

XI. Children's Privacy

IBC is deeply committed to the safety and welfare of children. Our Children's Ministry caters for children from Day 1 to 12 years of age. We do not knowingly collect personal data from children under the age of 18 without the consent of a parent or guardian. Where we collect data relating to children participating in our Children's Ministry, Sunday School, or church events, such collection is done with the knowledge and consent of their parents or guardians, in accordance with Section 8 of the NDPA and the Child Rights Act 2003.

XII. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• •Use of encryption (SSL/TLS) for data transmitted through our Website.
• •Access controls restricting data access to authorised personnel only.
• •Regular review and update of our security practices.
• •Secure storage of physical records containing personal data.
• •Data processing agreements with all third-party service providers.

While we strive to protect your personal data, no method of transmission over the internet or electronic storage is entirely secure. We encourage you to take steps to protect your personal information, including using strong passwords and keeping your login credentials confidential.

XIII. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of the breach, as required under the NDPA. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay.

XIV. Cross-Border Data Transfers

Some of our third-party service providers (including website hosting, podcast hosting, and payment processing services) may be located outside Nigeria. Where your personal data is transferred outside Nigeria, we will ensure that the recipient country or organisation provides an adequate level of protection for personal data as required by Section 42 of the NDPA, or that appropriate safeguards (such as binding corporate rules, contractual clauses, or certification mechanisms) are in place.

XV. Third-Party Links and Services

We link to third-party websites and services, including Facebook, Instagram, X, YouTube, Google Drive, and our Podcast platform. These third-party services have their own privacy policies, and we do not accept any responsibility or liability for their policies or practices. We encourage you to review the privacy policies of any third-party service before providing your personal data.

XVI. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal requirements, or operational needs. Any material changes will be communicated through our Website. We encourage you to review this Privacy Policy periodically.

XVII. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact us:

XVIII. Regulatory Authority

If you believe that your data protection rights have been violated, you have the right to lodge a complaint with the: