Who is responsible
The Capital Health Awards (“CHA”, “we”, “us”) determines why and how personal information is processed through this website and its awards, guest, media, volunteer and partnership activities. For Nigerian data-protection purposes, CHA acts as a data controller for these activities.
CHA management must provide the full registered company name, CAC registration/RC number, registered office address and designated legal/privacy contact. These details have not been invented. The published Secretariat contact remains available in the meantime.
Operational Secretariat: Suite C11, Second Floor, Kenuj O2 Mall, Kaura District, Games Village, Abuja, Nigeria. Current privacy contact: thecapitalhealthawards@gmail.com.
Information we handle
- Website and security data: request time, browser/device information, IP address and technical logs normally processed by the hosting infrastructure to deliver and secure the site.
- Nominations: nominator contact details, nominee name and organisation, category, supporting statements, links and permitted evidence files. For the University Laureate Prize, this also includes the invited institution and one-time reference, the authorised official’s role and contact details, the student’s identity/contact and university enrolment details, the nominated work, impact, institutional reference letter and optional supporting evidence.
- Enquiries and partnerships: name, email, enquiry type, message and relevant organisational details.
- Guest RSVP: invitation reference, identity/contact details, attendance and approved plus-one information, plus optional dietary or accessibility information.
- Media accreditation: professional contact details, organisation, role, assignment information, work evidence and limited accreditation documents.
- Volunteer applications: contact details, general location, availability, preferred role, relevant experience and motivation.
- Privacy requests: identity/contact details, request type, correspondence and verification information where genuinely necessary.
- Event media: photographs, film, audio and related event information as described in the Event Photography & Media Notice.
- Device-only information: cookie choices and nomination drafts stored in your browser. A saved draft is not sent to CHA until you submit it.
CHA does not use this website to build advertising profiles, sell personal information or automatically add people to a marketing list. The website is not intended to collect patient records or identifiable confidential health information.
Why we use information and our lawful bases
| Activity | Purpose | Current basis |
|---|---|---|
| Website delivery and security | Provide pages, prevent abuse and investigate technical incidents. | Legitimate interests in operating a secure public website. |
| Nominations | Receive, assess, verify and administer award nominations, including institution-authorised student nominations. | Legitimate interests and the nominator’s requested participation under the Nomination Terms. Authority, accuracy and terms checkboxes are declarations and acknowledgements, not marketing consent. |
| Contact, partnership and sponsorship | Respond to the enquiry and take requested steps toward a relationship or arrangement. | Steps at the requester’s request and/or legitimate interests in correspondence and institutional relationships. |
| RSVP and guest management | Verify invitations, administer attendance, security, protocol and hospitality. | Steps requested by the guest, event administration and legitimate interests. Explicit consent is requested separately for optional dietary/accessibility information where it reveals health-related information. |
| Press and volunteer applications | Assess applications, allocate access or roles, communicate decisions and operate the event. | Steps requested by the applicant and legitimate interests. Explicit consent is requested for optional sensitive accessibility information. |
| Embedded YouTube media | Show a selected film, playlist or soundtrack. | Your affirmative embedded-media choice. Players do not load before that choice. |
| Event photography and film | Event reporting, archive, editorial communication and proportionate promotion. | CHA’s legitimate interests and the public-event context, balanced against attendee rights. Separate releases are used for arranged interviews, testimonials and individual promotional productions where appropriate. |
| Privacy rights and legal records | Answer requests, demonstrate accountability and manage disputes. | Legal obligation and legitimate interests. |
Where CHA relies on consent, it will identify the purpose, record the choice and allow withdrawal without making it harder than giving consent. Withdrawal does not make earlier lawful processing unlawful.
How long information is kept
The website applies event-linked retention dates and records a review/deletion date with each online submission. The schedule below is a defensible operational starting point and must be adopted or amended in CHA’s formal retention policy after Nigerian legal/DPCO review.
| Record | Operational schedule |
|---|---|
| Unsuccessful nominations and supporting evidence | Delete within 12 months after the relevant ceremony, unless needed for a live query, dispute or legal duty. |
| Successful nominee records | Public award, citation and archive records may be preserved as institutional history; non-public contact data and evidence should be reviewed within 24 months after the ceremony. |
| University Laureate code-use ledger | A minimal institution, code digest/reference and use timestamp may be retained after nomination evidence is deleted so a one-time institutional reference cannot be reactivated or reused. |
| Contact and partnership enquiries | 24 months after the last meaningful contact, unless a contract, dispute or continuing relationship requires longer. |
| RSVP/general guest records | 90 days after the event. Optional dietary/accessibility information is scheduled for deletion 30 days after the event. |
| Press applications | Unsuccessful applications and identity evidence: 90 days after the event. Successful accreditation administration: review within 12 months after the event. |
| Volunteer applications | Unsuccessful applications: six months after decision. Selected volunteer administration: review within 24 months after the event. |
| Privacy requests | Three years after closure to demonstrate how the request was handled, unless a legal matter requires longer. |
| Cookie preference record | On the visitor’s device for up to 12 months or until cleared/replaced. |
| Short-lived anti-abuse request hashes | 30 days. |
Security and confidentiality
CHA applies measures proportionate to the current website: HTTPS delivery; server-side input validation; same-origin checks; anti-spam controls; request-rate controls; restricted file types and sizes; file-signature checks; random non-public storage keys; security headers; private evidence storage; one-way digests for unused University Laureate reference codes; atomic single-use locking at submission; and authenticated, allowlisted access for authorised reviewers.
Uploaded evidence is treated as quarantined and must not be opened by staff until it has passed the organisation’s approved malware-checking procedure. The website does not currently claim a third-party malware-scanning service, security certification, penetration test or end-to-end encryption. CHA management must complete the organisational controls listed in the final implementation report, including access review, MFA policy, incident response and provider assessment.
Your data-protection rights
Subject to the circumstances and lawful exceptions, the Nigeria Data Protection Act provides rights to be informed; request access; seek correction; request deletion where applicable; restrict or object to certain processing; withdraw consent where consent is relied upon; request portability where applicable; and complain to the Nigeria Data Protection Commission.
Use the Privacy Request page to start a request. CHA will not disclose personal information merely because a requester knows an email address. Identity, authority and scope will be verified proportionately before sensitive information is released or changed.
Contact, grievances and complaints
Email thecapitalhealthawards@gmail.com or use the Privacy Request form. Please write “CHA Privacy Request” in the subject and do not attach identity documents unless CHA asks for a proportionate verification method.
If a concern is not resolved, you may contact or complain to the Nigeria Data Protection Commission. This notice is informed by the Nigeria Data Protection Act 2023 and the NDPC’s Nigeria Data Protection Act General Application and Implementation Directive 2025.