Privacy Policy

The St. Thomas Aquinas College (STAC) Alumni Association (“STAC Alumni,” “we,” “us,” or “our”) operates a shared digital platform serving three connected communities: the STAC Alumni Association itself, the STAC Multipurpose Cooperative Society (“STAMCOS”), and the Newman/NFCS fellowship at the University of Ilorin Catholic Chaplaincy (together, the “Platform”).

This Privacy Policy explains what personal data we collect when you register, verify your membership, join STAMCOS, apply for a loan, make or claim a payment, or otherwise use the Platform; why we collect it; how we protect it; and the rights you have over it. It applies to members, cooperators, admins, executives, referees, guarantors, and next-of-kin whose details a member provides to us.

We designed this policy to meet the requirements of Nigeria's Data Protection Act 2023 and the NDPC General Application and Implementation Directive, and — because some of our alumni and cooperators reside outside Nigeria — to reflect the core principles of the EU/UK General Data Protection Regulation (GDPR) as a matter of good practice, even where not legally mandatory.

The STAC Alumni Association is the data controller for personal data processed on the Platform. STAMCOS, as a distinct registered cooperative society, is a joint controller for data collected specifically for cooperative membership, savings, loans, and related financial services. Questions about this policy or your data can be directed to us using the contact details in Section 13.

We only collect data that is necessary for the purposes described in this policy. What we collect depends on which parts of the Platform you use.

3.1 Identity & contact data (all members)

Full name, email address, username, phone number (and whether it is WhatsApp-enabled), gender, date of birth, passport photograph, residential address (including LGA, state, and country), year of graduation, course of study, campus, and society memberships.

3.2 Account & security data

Hashed password (we never store passwords in plain text), email verification status, membership status, session and login activity (including failed login attempts, used only to protect your account from unauthorized access), and device/session identifiers for mobile app sign-in.

3.3 National service & zone data

NYSC posting state and the date you set it, and the geographic zone assigned to your membership record, used to route you to the correct zonal chapter and administrators.

3.4 STAMCOS cooperative membership data

If you join STAMCOS, we additionally collect: employer name and work address, job title and employment type, bank account details (bank name, account name, account number, sort code) for savings/loan disbursement, a government-issued means of identification (e.g. national ID, passport, driver's license) and its uploaded image, next-of-kin details (name, relationship, phone, email, address), and the names and contact details of two referees you nominate to support your application.

3.5 Financial & transactional data

Dues payment history and receipts, thrift/savings contributions and balances, capital contributions, withdrawal requests, loan applications, loan guarantor requests and responses, loan repayment schedules and repayment history, and an internally computed credit score used solely to assess loan eligibility within STAMCOS.

3.6 Uploaded files

Payment receipts, means-of-identification documents, and passport photographs are uploaded to our storage provider (Cloudinary) and are never publicly accessible — all access is served through a signed, time-limited URL that only your session or an authorized administrator can request.

3.7 Mentorship, benefits, and community data

If you participate in the mentorship program: mentor/mentee profile details, session records, and ratings. If you claim a benefit: your claim details and supporting documents. If you send or receive birthday wishes, referee requests, or platform notifications: the content of those interactions.

3.8 Technical & usage data

IP address and basic request metadata (collected automatically by our hosting infrastructure for security and rate-limiting purposes), browser/device type, and audit-log entries recording significant account and administrative actions (e.g. who approved a payment, who changed a role) for accountability and fraud prevention.

3.9 Admin & executive data

For members who are appointed as executives or administrators: role assignments, admin login credentials (separate from your member account), and permission grants.

We process your personal data to:

• Create and manage your membership and/or STAMCOS cooperator account;
• Verify your identity and eligibility (e.g. graduation year, NYSC status);
• Process dues, savings, capital contributions, loan applications, guarantor requests, and repayments, and record accurate financial history;
• Disburse funds to the bank account you provide;
• Assess loan eligibility using your credit score and repayment history;
• Contact you about your account, payments, loan status, events, dues reminders, and platform notifications;
• Operate the mentorship program and benefits scheme you opt into;
• Detect, investigate, and prevent fraud, unauthorized access, and abuse (e.g. account lockouts after repeated failed logins, rate limiting);
• Maintain audit logs required for cooperative governance and dispute resolution;
• Comply with our legal and regulatory obligations; and
• Improve the Platform's reliability and security.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects without human review — loan decisions informed by your credit score are reviewed by a human STAMCOS administrator before approval.

Under the Nigeria Data Protection Act 2023 and, where applicable, the GDPR, we rely on the following legal bases:

• Contractual necessity — to provide membership, cooperative, and financial services you have signed up for;
• Consent — for optional features such as mentorship participation, birthday wishes, and marketing-style communications, which you may withdraw at any time;
• Legal obligation — for financial record-keeping required of a registered cooperative society;
• Legitimate interest — for fraud prevention, account security, and platform administration, balanced against your rights and freedoms.

We do not sell your personal data. We share it only with:

• Authorized administrators — STAC, STAMCOS, and zonal admins with role-based access strictly limited to what their role requires, to verify payments, approve onboarding, and manage claims;
• Referees and guarantors — limited details necessary for them to confirm or respond to a request you initiated;
• Service providers acting on our behalf, under contractual confidentiality obligations:
  • Neon (PostgreSQL database hosting) — stores all Platform data;
  • Cloudinary — stores uploaded receipts, identification documents, and photographs behind signed, access-controlled URLs;
  • Resend — delivers transactional emails (verification, receipts, reminders);
  • Vercel — hosts and serves the Platform;
• Regulators and legal authorities — only where required by law, court order, or to protect the rights, property, or safety of STAC, STAMCOS, our members, or the public.

We do not transfer your data internationally in a way that removes the protections of this policy; where our service providers process data outside Nigeria, we rely on their own compliance with recognized international data-protection standards.

We retain your personal data for as long as your account is active and as necessary to provide the Platform's services, meet cooperative financial record-keeping obligations, and resolve disputes.

If you request account deletion, your account is scheduled for anonymization after a 30-day grace period, during which you may cancel the request. Once the grace period lapses, our automated process permanently removes or irreversibly anonymizes your personally identifying data. Certain financial and transactional records may be retained in anonymized or aggregated form for longer, where required for cooperative audit, tax, or regulatory purposes.

We apply technical and organizational measures appropriate to the sensitivity of the data we hold, including:

• Passwords stored as one-way cryptographic hashes, never in plain text;
• Two fully independent authentication systems for members and administrators, so a compromise of one cannot be used to access the other;
• Role-based access control limiting administrators to only the data their role needs;
• Account lockout after repeated failed login attempts;
• All file uploads (identification documents, receipts, photographs) served only via signed, time-limited URLs — never publicly accessible;
• Encrypted data transmission (HTTPS/TLS) across the Platform;
• Audit logging of sensitive administrative actions.

No system can guarantee absolute security. If we become aware of a data breach affecting your personal data, we will notify affected members and the National Data Protection Commission (NDPC) in line with our obligations under the Data Protection Act 2023.

Subject to applicable law, you have the right to:

• Access the personal data we hold about you;
• Request correction of inaccurate or incomplete data;
• Request deletion of your account and personal data, subject to the retention obligations described in Section 7;
• Withdraw consent for optional processing (e.g. mentorship, birthday wishes) at any time;
• Object to or request restriction of certain processing;
• Request a copy of your data in a portable format;
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC) or, where applicable, another supervisory authority.

You can exercise most of these rights directly from your profile settings, or by contacting us using the details in Section 13.

The Platform is intended for alumni, cooperators, and fellowship members who are 18 years of age or older. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can remove it.

We use strictly necessary cookies to keep you signed in and to protect your session (member sessions and, separately, admin sessions). We do not use third-party advertising or tracking cookies.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will post the revised policy on this page with an updated “Last updated” date, and where changes are material, we will notify you directly.

If you have questions about this policy or how your data is handled, please contact:

• STAC Alumni Association: stacalumni2000@gmail.com
• STAMCOS: stamcosltd@gmail.com
• Postal address: St. Thomas Aquinas Centre, Catholic Chaplaincy, University of Ilorin, Kwara State, Nigeria.