WAYON West Africa Youth Observers Network

Privacy notice

Last updated: 12 September 2026

This notice is given under the Nigeria Data Protection Act 2023 (the NDPA). It explains what personal data we collect about you, why, and the rights the Act gives you. Where it applies to you, the European Union's General Data Protection Regulation (GDPR) applies as well, and we work to its standard throughout.

Who we are

WAYON, the West Africa Youth Observers Network, is hosted by Legis360 Centre for Advocacy, Development and Public Enlightenment Initiatives, Abuja, Nigeria. Legis360 is the data controller for this platform: it decides how and why your personal data is used. You are the data subject. You can reach us at info@legis360.org.

What we collect

If you register your interest: your name, email address, country, age bracket, the languages you speak and your areas of interest.

If you apply for membership, we also collect your preferred name, date of birth, gender, nationality, the country and city where you live, your phone number, whether you live in an urban or rural area, your occupation and organisation, your years of civic engagement, any prior observation experience, whether you have a smartphone or a passport and can travel, your statement of why you should be considered, your CV, any social media links you choose to give, and the name and email address of a referee.

We record the IP address at the moment you give consent, and the language you used, so we can show what you agreed to and when.

Information about other people

The application asks for the name and email address of a referee. That is another person's personal data, and we rely on you having their permission before you give it to us. We use it only in connection with your application, and we delete it on the same schedule as the rest of your application.

Sensitive personal data

If you choose to answer, we record whether you identify as a person with a disability. Under the NDPA this is sensitive personal data, so we treat it differently. We collect it only with your separate, explicit consent, we use it only to report on how inclusive the network is, and it is never used to decide your application. You can answer "prefer not to say", and nothing is recorded.

Our lawful basis

The NDPA requires a lawful basis for each purpose. Ours are:

  • Steps taken at your request. Assessing your application and contacting you about it, because you asked to join.
  • Your consent. Contacting you about membership and opportunities, and recording your answer to the disability question. You may withdraw either at any time, and withdrawing one does not withdraw the other.
  • Our legitimate interests. Running and administering the network, keeping a record of the decisions it takes, and keeping the platform secure.

Who can see it

The Legis360 secretariat, and the chapter lead for your country where one is appointed. A country lead sees applications from their own country only. Nobody else has access. Your contact details are not published, and your application is not shared with other applicants or members.

Sending your information outside Nigeria

Our servers are operated by DigitalOcean in London, United Kingdom, and we use Brevo to deliver our emails. Your personal data is therefore transferred outside Nigeria. The NDPA permits such transfers where the destination provides adequate protection or where you have consented. The United Kingdom has a comprehensive data protection regime, and our providers act as data processors under contract, handling your data only on our instructions.

How long we keep it

  • Expressions of interest: until you ask us to remove them, or 24 months after we last heard from you.
  • Applications that are not successful: 24 months after the decision.
  • Applications you withdraw: 12 months.
  • Member records: while you are a member, and 24 months afterwards.
  • A record that a decision was taken is kept as part of the network's institutional history.

Your rights under the NDPA

The Act gives you the right to:

  • be told what personal data we hold about you, and obtain a copy of it;
  • have inaccurate data corrected;
  • have your data deleted, where the Act allows;
  • restrict or object to how we use it;
  • receive your data in a portable form;
  • withdraw consent at any time, without affecting what we did before you withdrew it.

To exercise any of these, email info@legis360.org. We will respond within the time the Act requires.

Automated decisions

We do not make decisions about you by automated means. Every application is read and decided by a person in the secretariat.

If the GDPR applies to you

If you are in the European Union or the European Economic Area, the GDPR also applies to our handling of your personal data, and the United Kingdom GDPR applies to the data we store in London. Your rights are substantially those listed above. In addition, you may complain to the supervisory authority in your country of residence as well as to the NDPC, and you may ask us about the safeguards that cover transfers of your data.

Complaints

If you are not satisfied with how we have handled your personal data, you may complain to the Nigeria Data Protection Commission (NDPC), the regulator established under the NDPA.

Changes to this notice

If we change how we use your personal data we will update this page and change the date at the top.