How we handle your information

Who is responsible

Be Empowered Network, Incorporated Trustees, registration CAC/IT/NO 140796, a non-profit registered in Nigeria, is the data controller for everything described here.

For anything about your data, write to hello@beempowerednetwork.org with “Data request” in the subject line. A trustee reads that inbox.

We follow the Nigeria Data Protection Act 2023. Where you are in the UK or the European Economic Area, we also apply the UK GDPR and EU GDPR standards to your information.

What we collect, and why

When you use the contact form

Your name, email address, an optional phone number, the topic you pick, and whatever you choose to write. The form notes which page you came from.

We use it to reply to you and, if you ask, to point you towards support. We do not need an account and we do not profile you.

When you volunteer or ask about a partnership

Your name, email, the city or state you are in, the role you are interested in, and anything you add about your background or availability.

When you create an account

Your name, email, phone number if you give one, a password you choose, and which emails you have asked for. We never see your password: it is hashed before it reaches us.

When you RSVP to a circle or event

Which event, and any note you add, such as telling us that data costs are a barrier. Facilitators see the note so they can plan.

When you subscribe to the newsletter

Your email address only. We send a confirmation link first and do nothing until you click it.

When you use Bee, the chat companion

See The chat companion below. This one deserves its own section.

What we do not collect

No advertising identifiers, no cross-site tracking, no location beyond the city you type yourself, no fingerprinting. We do not run analytics of any kind, so we genuinely cannot tell you how many people read this page.

Information about your mental health

If you pick “Getting support for myself” or describe what you are going through, that is sensitive personal data under the Nigeria Data Protection Act and special category data under the GDPR. The law sets a higher bar for it, and so do we.

• We rely on your explicit consent, given when you tick the box on the form. You can withdraw it at any time and we will delete the message.
• Only trained volunteers who are responding to enquiries can read it. It is not shared across the organisation.
• We will never pass your message to anyone else — a clinic, your employer, your family — without asking you first. The one exception is set out in our safeguarding policy: if we believe someone is at immediate risk of serious harm, we may act without consent. We will tell you when we can.
• Please do not send us clinical records, diagnoses or medication lists. We are not a clinical service and we do not want to hold them.

Our legal grounds

• Consent — the newsletter, anything you tell us about your health, and the optional notes on a form. Withdrawing it is as easy as giving it.
• Performance of a contract or steps you asked for — running your account, confirming an RSVP, replying to a question you sent us.
• Legitimate interests — keeping the site secure, preventing spam and abuse, and keeping basic records of our work. We have weighed this against your privacy and kept the data minimal.
• Legal obligation — donation and financial records we are required to keep.
• Vital interests — only where there is a risk to someone’s life, as described in the safeguarding policy.

Who else can see your information

A short list, and it stays short. Each of these is a processor acting on our instructions, not a partner we share data with for their own purposes.

• Supabase — the database and sign-in system that stores enquiries, accounts, RSVPs and subscriptions. Hosted in Europe.
• Railway — hosts the website itself. It serves pages; it does not hold your records.
• Anthropic — processes the free-text part of a Bee conversation. See below.
• Our email provider — delivers newsletters and the replies we send you.

We do not use advertising networks, data brokers or social media pixels. If a court or regulator lawfully compels disclosure we will comply, and we will tell you unless we are forbidden to.

Where your information is stored

Being straight with you: our database is hosted in Europe, not in Nigeria. Our email and AI providers are based in the United States. So if you are in Nigeria, your information leaves the country.

We did not choose this to be evasive — it is where the infrastructure we can afford as a small non-profit runs. Under sections 41 to 43 of the Nigeria Data Protection Act we are required to tell you, and to make sure the destination gives your data comparable protection. Our providers are contractually bound to protect it, apply the GDPR standard, and use it only as we instruct.

If you would rather not have your data leave Nigeria, email or phone us instead of using the forms, and say so.

How long we keep it

• Enquiries and contact messages — 24 months after our last exchange with you, then deleted.
• Volunteer and partnership enquiries — 24 months, or for as long as you volunteer with us.
• Accounts — while you use them. If you have not signed in for 24 months we delete the account and tell you first.
• RSVPs — 12 months after the event.
• Newsletter — until you unsubscribe, plus 30 days so we do not re-add you by accident.
• Donation records — 6 years, because financial and tax rules require it.
• Safeguarding records — 7 years, held separately and tightly restricted.

Your rights

Under the Nigeria Data Protection Act, and the GDPR where it applies to you, you can ask us to:

• Show you everything we hold about you, as a file you can keep.
• Correct anything wrong.
• Delete it. We will, unless the law requires us to keep a specific record, and we will tell you if so.
• Restrict or object to what we do with it.
• Withdraw consent at any time, without affecting what we did lawfully before.
• Port it to another organisation in a machine-readable format.

Email hello@beempowerednetwork.org. We reply within 30 days, free of charge. We will ask you to confirm your identity, but only enough to be sure it is you — we will not demand ID for a simple deletion request from a verified email address.

We do not make any automated decisions about you that have a legal or similarly significant effect.

Cookies and what we store in your browser

There is no cookie banner on this site, because there is nothing to consent to. We set no advertising or analytics cookies. What we do store is:

• Your theme choice (light or dark) and the chat language you picked — kept in your own browser, never sent to us.
• A sign-in token, only if you have an account and only while you are signed in. Clearing it signs you out.

Fonts and one software library load from external services (Google Fonts, Fontshare, jsDelivr). Those services will see your IP address, as they would on most of the web. Nothing identifying you is sent with the request.

The chat companion

Bee is a self-help guide. It is not a person, not a therapist and not an emergency service, and it says so at the top of every conversation.

Most of Bee is a fixed script that runs entirely in your browser and sends us nothing. When you type something the script does not recognise, that message and the recent conversation are sent to Anthropic, an AI provider in the United States, to generate a reply.

• We do not store your conversation in our database. Closing the tab ends it.
• If the conversation suggests a crisis, Bee stops and shows you helplines. That text is handled by the safety check and is not sent to the AI.
• Please do not type anything into Bee that you would not want leaving the country. Use your first name or no name at all.

Children and young people

This website is intended for people aged 18 and over, and accounts are for adults. We run programmes in secondary schools, but those are arranged through the school, and any information about a pupil is collected and held by the school under its own duty of care, with parental or guardian consent, not through this site.

If you are under 18 and need support, please talk to a trusted adult, or call 112 in an emergency. If you believe a child has given us personal information through this site, tell us and we will delete it.

Photographs and video

We publish photographs and video from our programmes. We ask for consent before we take and before we publish, people can say no without losing any support, and we remove the image on request — just email us. We strip location and camera data from every photograph before it goes up. We do not name people in captions without their agreement.

Keeping it safe

Traffic is encrypted end to end. The database enforces row-level security, so one account cannot read another’s records, and enquiries are readable only by administrators. Admin access is limited to named trustees and volunteers who need it.

No system is perfect. If a breach puts your rights or freedoms at risk, we will report it to the Nigeria Data Protection Commission within 72 hours of becoming aware, and tell you directly without undue delay.

If you are unhappy

Tell us first — hello@beempowerednetwork.org — and we will try to put it right.

You also have the right to complain to a regulator without coming to us at all. In Nigeria that is the Nigeria Data Protection Commission (NDPC). In the UK it is the Information Commissioner’s Office; in the EEA, your national supervisory authority.

Changes

If we change anything that affects you materially, we will update the date at the top and, where it matters, say so on the site or by email. We will not quietly broaden what we do with information you have already given us.