Privacy notice

1. Who we are

"Convene" is the event-management portal of the National Cybersecurity Coordination Centre (NCCC), an agency within the Office of the National Security Adviser (ONSA), Federal Republic of Nigeria. For the purposes of the Nigeria Data Protection Act 2023 (NDPA), the NCCC is the data controller for personal data submitted on this site.

2. What we collect

When you register for an event, we collect:

• Identity: salutation, first and last name.
• Contact: email address, phone number.
• Professional: organisation, job title, country of residence.
• Accommodation: dietary requirements, accessibility needs (where you choose to share them).
• Identification: a photo, only if you upload one for your event badge.
• Operational: the IP address and browser making the request, recorded in server logs for security purposes.

3. Why we collect it (lawful basis)

We process this data under the following bases set out in section 25 of the NDPA:

• Performance of a task in the public interest — organising and accrediting attendees at official cybersecurity engagements.
• Consent — for any optional fields (e.g. dietary requirements, photo upload), which you may decline to provide.
• Legitimate interest — for security logging and prevention of fraudulent registrations.

4. How we use it

• Verify your identity at the accreditation desk via your reference code and QR pass.
• Print your badge with your name, organisation, and job title.
• Send you confirmation, approval/rejection, reminder, and broadcast communications by email and SMS.
• Plan catering, accessibility provisions, and security clearance where relevant.
• Generate aggregate (non-identifying) statistics about attendance and demographics.

5. Who we share it with

We share your personal data only with:

• Event co-organisers formally listed on the event page, under a data-sharing agreement that binds them to the same standard as the NCCC.
• Service providers we use to deliver the service, currently: Microsoft 365 (email transit), Kudisms (SMS gateway), and any hosting infrastructure inside Nigerian jurisdiction.
• Law enforcement or regulatory bodies, where we are legally compelled to do so by a competent Nigerian authority.

We do not sell your data, and we do not transfer it outside Nigeria except as needed for the third-party services listed above.

6. How long we keep it

• Registration records: 5 years after the event end date, then archived or deleted.
• Server access logs: 90 days.
• Audit logs of administrative actions: 7 years, as part of our records-management policy.
• Delegate photos: deleted within 30 days of the event end, unless retained for an explicit ongoing programme.

7. Your rights

Under the NDPA you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion ("erasure"), subject to our legal record-keeping obligations.
• Object to direct marketing — we do not send marketing, only event-operational comms.
• Withdraw consent for any optional data at any time.
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC).

To exercise any of these rights, contact us using the details below.

8. Security

The portal uses TLS in transit, password hashing, multi-factor authentication for staff, row-level audit logging, IP-based rate limiting on the registration form, and signed short-lived QR codes for accreditation. The infrastructure is hosted within Nigerian jurisdiction. We will notify the NDPC and affected individuals within the timelines set out in the NDPA in the event of a personal data breach.

9. Cookies

We use only strictly necessary cookies (authentication, anti-forgery, language preference). We do not use third-party analytics or advertising cookies. See our cookies notice for the full list.

10. Contact & complaints

Data Protection Officer (DPO)
National Cybersecurity Coordination Centre
Office of the National Security Adviser
Email: dpo@nccc.gov.ng
General enquiries: appsupport@nccc.gov.ng

If you are not satisfied with our response, you may contact the Nigeria Data Protection Commission: ndpc.gov.ng.