Version 1.7 · Drafted 23 September 2026
This Privacy Notice explains how AI-Sentinel Africa handles personal data across its public information website, registered portal, controlled downloads, enquiries and approved institutional activities. It should be read together with any service-specific or institutional notice presented when information is collected.
1. Who is responsible for your personal data
For the public website and general portal-registration service, the data controller is Dr. Segun H. Olugbile, Founder and Author of AI-Sentinel Africa, operating AI-Sentinel Africa as a Nigeria-based public-interest initiative.
Privacy, consent and data-rights requests may be sent to author@aisentinel.africa. If AI-Sentinel Africa works with a government institution, regulator, critical-infrastructure operator or research partner, the relevant agreement may identify that institution and AI-Sentinel Africa as separate controllers, joint controllers, or controller and processor for the particular pilot.
2. Scope and governing framework
Our primary Nigerian framework is the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Commission’s General Application and Implementation Directive 2025 (GAID).
We also take account of the ECOWAS Supplementary Act A/SA.1/01/10 on Personal Data Protection, the African Union Convention on Cyber Security and Personal Data Protection, and the AU Data Policy Framework as regional governance reference points. These instruments apply according to their legal status in the relevant country and do not displace stricter national requirements.
Additional laws may apply because of a person’s location, the institution involved, the place of processing or a contractual commitment. This may include another African data-protection law, the EU General Data Protection Regulation, the UK GDPR or equivalent rules. Nothing in this notice limits mandatory rights under an applicable law.
3. Personal data we may collect
3.1 Public website and security data
- IP address, browser and device information, operating system, language, time zone, requested pages, referring page, timestamps and security-event data.
- Privacy choices, notice and terms versions, a random browser identifier, accessibility preferences and consent-withdrawal history.
- Aggregated first-party interaction events only where optional analytics has been expressly enabled.
3.2 Enquiries and professional contact data
- Name, professional contact details, organisation, role, country, sector and the content of an enquiry or partnership request.
- Correspondence, meeting notes and follow-up decisions necessary to respond to the request.
3.3 Portal registration and account governance
- Full name, official email address, organisation, industry, country and stated purpose of access.
- Email-verification status, administrator decision, decision rationale, assigned role, activation status, access timestamps and account-security history.
- Verification codes, activation tokens and session credentials. Where stored, security secrets are held as cryptographic hashes rather than readable values.
3.4 Controlled resources, subscriptions and contributions
- Information submitted to request a controlled report or briefing, including the requested scope and declared purpose of use.
- Newsletter preferences and subscription status where a separate voluntary subscription is offered.
- Community or expert contributions, including contributor identity, institution, submission text, review status and any separate choice concerning public attribution.
3.5 Institutional pilots and evidence workspaces
An approved pilot may process authorised professional contact data, institutional evidence, review comments, provenance records, role assignments and audit events. The institution-specific agreement and data-governance schedule will define the permitted data, security classification, purpose, hosting location, access roles, retention and disclosure rules.
Do not submit classified information, intelligence-source identities, credentials, vulnerability secrets, live incident data, special-category personal data or other restricted material through the public website, ordinary email or basic visitor portal. Such information may be processed only through an expressly approved controlled environment and written institutional protocol.
4. Where personal data comes from
We receive data directly from you, from an authorised representative of your institution, from technical and security services that protect the platform, and from approved public or institutional sources used in a governed workspace. Where information is not obtained directly from you, we record its source where reasonably possible and apply the relevant notice, purpose and access controls.
5. Why we process personal data and our lawful bases
- Website delivery and security: legitimate interests in operating a secure, resilient public-interest service; compliance with legal obligations; and, where appropriate, performance of a requested service.
- Enquiries and partnership discussions: steps taken at your request before a possible relationship, legitimate interests in responding to professional enquiries, or consent where required.
- Portal verification and access review: steps taken at your request, legitimate security interests, prevention of misuse, least-privilege role assignment and maintenance of an accountable access record.
- Controlled reports and institutional services: performance of a request or agreement, legitimate accountability interests, consent where appropriate, and legal or public-interest functions documented by an authorised institutional partner.
- Newsletter and optional analytics: consent. These activities remain off unless you make a separate affirmative choice, and consent may be withdrawn.
- Community contributions: your requested submission, moderation and programme-improvement interests. Public attribution requires a separate clear choice.
- Legal, audit and incident response: compliance with law, establishment or defence of legal claims, protection of rights and systems, and accountability.
We do not rely on consent where another lawful basis is more appropriate. When legitimate interests are used, we assess necessity, reasonable expectations and the effect on individual rights. Sensitive personal data will not be intentionally requested through public services. If an authorised institutional activity requires it, a specific lawful condition, data-protection impact assessment and additional safeguards must be documented first.
6. Cookies, local storage and anti-abuse controls
- Strictly necessary controls: privacy choices, security settings, accessibility preferences and approved portal sessions. These are needed to deliver and protect the service.
- Optional analytics: first-party aggregated events used only after express opt-in. They are not used for advertising or behavioural profiling.
- Cloudflare Turnstile: used on selected forms to distinguish legitimate submissions from automated abuse. Cloudflare may process technical and security signals under its own privacy terms.
- WordPress administration: administrative cookies apply only to authorised users who sign in to manage the public site.
You can reject optional analytics and still use public content. A privacy-choice control will allow you to change or withdraw an optional choice. Browser settings may also remove stored data, although doing so may require you to record your choice again.
7. AI-assisted processing and human authority
AI-Sentinel Africa may use governed AI tools to organise evidence, identify patterns, summarise material, support scenario analysis or prepare draft briefings. AI-generated content is labelled or otherwise kept distinguishable from source evidence and human decisions where the context requires it.
Portal approval, institutional permissions and decisions producing legal or similarly significant effects are not intended to be made solely by automated processing. An authorised human reviewer remains responsible for access decisions and institutional outputs. You may request human review and challenge an automated or AI-assisted result that materially affects you.
8. Who may receive personal data
Personal data may be disclosed only as necessary to:
- authorised AI-Sentinel Africa personnel and approved institutional reviewers;
- hosting, database, security, communications and professional service providers acting under appropriate obligations;
- Cloudflare, for DNS, network security and Turnstile anti-abuse services;
- Resend, for transactional email such as verification and activation messages;
- an institutional partner where the person has requested or been authorised to participate in that partner’s controlled activity;
- regulators, courts, law-enforcement bodies or other competent authorities where disclosure is lawfully required; and
- professional advisers where necessary to protect legal rights or manage compliance.
We do not sell personal data. We do not disclose portal registration information for third-party advertising.
9. International and cross-border transfers
Internet, security, email and cloud services may involve processing in more than one country. Before personal data is transferred from Nigeria, we will document a valid basis under sections 41–43 of the NDPA and the GAID. Depending on the transfer, this may include an adequacy basis, binding corporate rules, contractual clauses, an approved code or certification mechanism, or a specific statutory condition. The transfer basis and the adequacy of protection will be recorded.
We assess the destination, applicable law, independent oversight, enforceable rights, public-authority access, onward transfers, technical safeguards and the sensitivity of the information. Encryption, data minimisation, pseudonymisation, access controls and contractual audit rights may be used to reduce risk. Explicit informed consent is used for a cross-border transfer only where lawful and appropriate; it is not treated as the default substitute for adequate safeguards.
For institutional, government or critical-infrastructure information, the project-specific data-governance schedule must identify permitted storage locations, approved subprocessors, transfer routes, sovereignty requirements and any localisation obligation. This public notice does not authorise the export of classified, national-security or otherwise restricted information.
10. Retention
We keep personal data only for the stated purpose, legal accountability, security, dispute handling and an approved institutional record. The following default periods are proposed unless a stricter law, legal hold or project-specific schedule applies:
- email-verification codes expire after 10 minutes; activation links and sessions are single-use or time-limited;
- abandoned, rejected or withdrawn portal applications: up to 12 months after the last decision or activity;
- approved account profiles and access decisions: for the account relationship and up to 24 months after closure or suspension;
- ordinary access, security and audit logs: up to 24 months, with longer retention only where an incident, investigation, legal duty or institutional schedule requires it;
- enquiries and partnership correspondence: up to 24 months after the last substantive contact;
- newsletter details: until withdrawal, followed by a minimal suppression record for up to 24 months;
- consent and terms-acceptance records: up to six years where needed to demonstrate accountability; and
- institutional evidence and pilot records: as stated in the approved data-governance schedule.
At the end of the applicable period, data is deleted, securely destroyed or irreversibly anonymised. Backup copies expire through controlled rotation unless preservation is lawfully required.
11. Security and personal-data breaches
Safeguards include encrypted transport, secure email verification, hashed security tokens, role-based and least-privilege access, administrator approval, audit records, input validation, anti-automation controls, backup procedures and periodic review. No internet system can be guaranteed completely secure, and safeguards are adjusted to the nature, sensitivity and risk of the processing.
Suspected personal-data breaches are assessed, contained and documented. Where the NDPA applies, a breach likely to create risk to individuals will be reported to the Nigeria Data Protection Commission within the applicable period, including the statutory 72-hour period where required. Affected individuals will be informed promptly where the breach is likely to create a high risk, unless a lawful exception applies.
12. Your rights
Subject to applicable conditions, you may request:
- information about whether and why your data is processed;
- access to and a copy of your personal data;
- correction of inaccurate or incomplete information;
- deletion or restriction of processing;
- objection to processing, including direct marketing;
- withdrawal of consent as easily as it was given;
- data portability where applicable;
- human intervention and an opportunity to challenge a solely automated significant decision; and
- information about relevant international-transfer safeguards.
Send a request to author@aisentinel.africa. We may verify identity and authority before releasing or changing data. We will respond without unreasonable delay and within any applicable statutory period.
You may also complain to the Nigeria Data Protection Commission or another competent supervisory authority. Exercising a right does not affect the lawfulness of processing already carried out.
13. Children
The service is designed for adult professionals and institutional participants and is not directed to anyone under 18. We do not knowingly solicit children’s personal data through the website or portal. If you believe a child has provided data, contact us so that it can be reviewed and, where appropriate, deleted.
14. Changes to this notice
Material changes will be identified by a new version and date. Where a change materially affects an existing consent or controlled service, we will provide an appropriate notice and seek a new choice or acknowledgement when required.
15. Contact
AI-Sentinel Africa privacy contact
Dr. Segun H. Olugbile
Federal Republic of Nigeria
author@aisentinel.africa
This notice is a transparency and governance document. It does not remove the need for a data-protection impact assessment, processing agreement, records of processing, security classification or local legal review where a particular institutional activity requires them.