WatchTheVotes Privacy Policy
Version: 1.0 · Effective date: 12 October 2026 · Last updated: 12 October 2026
WatchTheVotes is a citizen-run, non-partisan parallel record of polling-unit results in Nigeria. Volunteers ("Vote Protectors") photograph the official result sheet (Form EC8A) posted at their polling unit and enter the figures. The public can then compare those citizen figures with the figures INEC publishes. Our figures are unofficial. Only INEC declares election results.
This policy explains what personal data we collect, why, who we share it with, how long we keep it and what your rights are. It applies to the WatchTheVotes web app at app.watchthevotes.com, our public pages, our API and our SMS and email messages. It is written to comply with the Nigeria Data Protection Act 2023 (NDPA) and the NDPA General Application and Implementation Directive 2025 (GAID) issued by the Nigeria Data Protection Commission (NDPC). Where it helps, we also give you the kind of rights people have under the EU GDPR. Our service area is Nigeria: the Service is offered to people in Nigeria, about Nigerian elections. Some of our providers store data outside Nigeria (see section 7).
1. Who we are (the data controller)
The data controller responsible for your personal data is:
- SciTun Technologies, registered in Nigeria with CAC registration number 9416492
- Registered address: MM2 B Elizabeth Cresent, North Star Garden Estate, Lokogoma, FCT Abuja
- Trading as "WatchTheVotes"
- NDPC registration number (data controller of major importance): NDPC/DPC/07732 (valid 18 July 2025 to 18 July 2027)
Data Protection Officer (DPO): Engr Michael Agbogo, email privacy@watchthevotes.org, postal address as above.
General support: info@watchthevotes.org.
2. Summary
- We collect what we need to run a trustworthy citizen count: your phone number to sign you in, enough identity details to approve volunteers and keep fake accounts out, and the result-sheet photos and figures you upload, together with where and when you took them.
- Your voter-card (PVC/VIN) number is optional. We use it only to check volunteers during approval. We keep it encrypted, and we delete it on the schedule in section 9.
- We collect precise location only when you upload a result or report an incident, plus optional background location on election days if you switch it on. We do not sell your data and we do not use it for advertising.
- We never publish your name, phone number or exact location. Public pages show polling-unit figures, not who submitted them.
- Because taking part in election monitoring could reveal something about your political views, we treat your volunteer data as sensitive and ask for your explicit consent.
- You can ask to see, correct, delete or export your data, and you can complain to the NDPC.
3. What we collect
| Category | What it includes | Required? | Where it comes from |
|---|---|---|---|
| Account and contact | Phone number (required for sign-in codes), email address (optional), Google account name, email and ID if you use Google sign-in | Phone: yes | You; Google |
| Identity (volunteers) | First and last name, gender, date of birth, profile photo (optional), your polling unit, referral or invite code | Name, gender, date of birth: yes, for volunteers | You |
| Voter card | Voter Identification Number (VIN) or PVC number, and a photo of your voter card if you upload one | Optional | You |
| Precise location | GPS coordinates and accuracy captured when you submit a result or report an incident; GPS your phone reports; background location during election-day windows only if you switch it on | Upload GPS: needed to verify a submission. Background: optional | Your device |
| Result submissions | Photos (and short videos, if enabled) of EC8A result sheets, figures you enter, capture time, a content hash, moderation outcome, trust score | Yes, for uploads | You; our systems |
| Incident reports | Description, photos and location of irregularities. You can report anonymously | Optional | You |
| Device and technical | Device fingerprint (used to detect duplicate or fake accounts), device and browser type, app version, keyed hashes of IP addresses, session tokens, security logs | Yes | Your device; our systems |
| Usage | First-party product analytics such as pages viewed, funnels and heatmaps, run on our own systems | Yes (see section 12 to opt out) | Our systems |
| Communications | Messages to support, in-app feedback and its attachments, public comments you post, SMS and email delivery records, alert subscriptions and unsubscribes | Optional | You; our processors |
| Consent records | Which version of our terms, notices and consents you accepted and when (stored in hashed form) | Yes | Our systems |
| Opinion poll (not active) | If we ever turn on our opinion poll, your voting intention. The poll is switched off. It will not be switched on until a data protection impact assessment is complete and a separate notice and consent are in place | n/a | n/a |
Personal data of other people in your photos. EC8A sheets carry the names and signatures of polling officials and party agents, and a photo might accidentally capture bystanders. Please photograph only the result sheet. Moderators may blur or reject photos that show people's faces or ballot papers.
Photos. We downscale uploaded photos and restrict how the original files can be accessed, so raw uploads are not publicly delivered. We record the location you shared separately, as integrity evidence, and we do not publish it.
4. Why we use your data, and our lawful basis
Under the NDPA (section 25) we must have a lawful basis for each use. Ours are:
| Purpose | Data used | Lawful basis |
|---|---|---|
| Create and secure your account; send sign-in codes | Phone, email, Google identity, device and technical data | Contract: providing the service you asked for under our Terms of Use |
| Approve volunteers and keep out fake, duplicate or bot accounts | Identity, voter card (optional), device fingerprint, location compared with your polling unit | Explicit consent (because volunteer data may reveal political opinion, see section 5) and legitimate interests in the integrity of the count |
| Receive, verify, moderate and publish polling-unit figures | Result photos, figures, capture time, upload location, trust score | Explicit consent and legitimate interests (a reliable, checkable citizen record) |
| Background location during election-day windows | Precise location | Consent only. Off unless you switch it on. You can switch it off at any time |
| Keep an audit trail and evidence for election petitions and legal claims | Submission records, hashes, audit chain, location, uploader identity | Legitimate interests, and establishing, exercising or defending legal claims |
| Security, fraud prevention, abuse detection | Device and technical data, IP hashes, logs | Legitimate interests; legal obligation (NDPA section 39 security duty) |
| Polling-unit alerts by SMS or email | Phone or email, chosen polling unit | Consent (separate tick box; unsubscribe at any time) |
| Product improvement and first-party analytics | Usage data | Legitimate interests (you can opt out) |
| Support, feedback, public comments | Communications | Contract and legitimate interests |
| Comply with the law, court orders and regulator requests | Any relevant data | Legal obligation |
Where we rely on legitimate interests, we have weighed our interests against your rights and added safeguards (minimal data, short retention, no public disclosure of identity). You can object (section 10).
Where we rely on consent, you can withdraw it at any time in your account settings or by emailing the DPO. Withdrawal does not affect processing already done. If you withdraw consent to volunteer processing, we will close your volunteer role, but we may keep submissions you already made (de-linked from your identity where possible) because the integrity of the public record depends on them (see section 9).
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Our risk signals (for example a duplicate device, or an upload far from your polling unit) only flag applications and uploads for human review. If we introduce automatic approval, you will be able to ask for a human to review any automated rejection.
5. Sensitive personal data (political opinion)
The NDPA treats data revealing political opinions or affiliations as sensitive personal data (section 30). WatchTheVotes is non-partisan and we do not ask which party you support. However, being an election volunteer, the polling unit you watch, the comments you post or (if you are one) your role as a party agent could be read as revealing political views. To be safe:
- We ask for your explicit consent to process volunteer data on that basis when you sign up.
- We never publish volunteer identities. Our "Is my polling unit covered?" check never reveals who the volunteer is.
- Access to volunteer identity is limited to approving admins and moderators, and that access is logged.
- We do not share volunteer identity with political parties, candidates or campaigns.
We do not otherwise collect sensitive data such as religion, ethnicity, health or biometrics. Profile and voter-card photos are used for manual checks only, not for facial recognition.
6. Who we share data with
We do not sell personal data. We share it only as follows.
a) Our own media storage (MediaStash). Result-sheet photos and videos are stored and delivered using MediaStash, SciTun Technologies' own storage service, which will be hosted in Europe (see section 7). MediaStash is another SciTun Technologies product, not a separate company or an outside processor, so using it does not share your data with anyone else. The MediaStash team must follow an internal data handling policy approved by our DPO. That policy requires use only for WatchTheVotes, private storage for any photo not approved for publication, short-lived access links, and verified deletion.
b) Service providers (data processors) who act on our instructions under contract (NDPA section 29):
| Provider | What they do | Data involved | Data location |
|---|---|---|---|
| DigitalOcean, LLC | Cloud hosting (Kubernetes), main database, cache, audit-log database | All account, profile and submission data; audit records | United Kingdom (London) |
| Termii | Sign-in codes and alerts by SMS | Phone number, message content | Europe |
| Postmark (ActiveCampaign, LLC) | Transactional email | Email address, message content | United States |
| CloudAMQP (84codes AB) | Message queue for notifications | Phone/email and message content in transit | Europe |
| Cloudinary Ltd (legacy, until migration is complete) | Storage and delivery of photos uploaded before the move | Photos uploaded before the move | Europe (storage); global CDN delivery |
| OpenAI | Reading figures from result-sheet photos | Result-sheet photos | United States |
| ngrok, Inc. (interim) | Network tunnel between our app and our core service | Data in transit between our systems | United States |
| OpenStreetMap Foundation | Map tiles loaded in your browser | Your IP address and the map area you view | United Kingdom |
Google provides sign-in if you choose "Continue with Google". Google acts as a separate controller for your Google account under its own privacy policy.
c) Partners and the public. Public results pages and data exports contain polling-unit figures and verification status. They do not contain your name, phone number, email, voter-card number or precise location. Signed-in users can view result-sheet photos. Partner organisations that recruit volunteers through a partner or team code can see aggregate coverage figures and protector counts for their code, and no individual identity unless you separately agree.
d) Evidence for election petitions. If a court, tribunal, INEC or a party to an election petition needs evidence about a specific result, we may provide result photos, hashes, timestamps, upload location and audit records. We will share uploader identity only if a court or tribunal orders it, the law requires it, or you agree (for example, if you choose to act as a witness).
e) Law enforcement and regulators, where the law requires it or there is a valid court order. We will push back on requests that are unlawful or too broad, and where we lawfully can, we will tell you.
f) A successor organisation, if WatchTheVotes is restructured, merged or transferred, provided it keeps to this policy.
7. Transfers outside Nigeria
Our service area is Nigeria, but your data is stored abroad. WatchTheVotes serves people in Nigeria. Our main hosting and several of our providers are outside Nigeria, so your personal data is transferred to, and stored in, the countries listed below. That includes our own MediaStash media storage, which will be hosted in Europe.
The rules we follow. Under sections 41 to 43 of the NDPA and the GAID, we may transfer personal data out of Nigeria only if the destination gives an adequate level of protection, or another lawful ground applies. For each transfer we use the following, in this order:
- Adequacy. Where the NDPC has recognised the destination country, region or framework as giving adequate protection (NDPA ss.41–42), we rely on that recognition.
- Appropriate safeguards. Where there is no adequacy recognition, we rely on a binding contract with the provider: its standard contractual clauses or data processing agreement, which give protections equivalent to the NDPA. These cover use only on our instructions, security, confidentiality, breach notice, help with your rights, onward-transfer limits, deletion and audit.
- Transfer impact assessment. For every provider, we carry out and document a transfer impact assessment. It covers the destination's laws and practices on government access, the provider's security certifications (for example ISO 27001 or SOC 2), and the extra steps we take. We keep these assessments in our NDPA compliance file and update them when a provider, region or law changes.
We do not rely on your consent as the main basis for routine transfers. The other grounds in NDPA s.43 (for example, to establish or defend legal claims) are used only where they genuinely apply, such as giving evidence to a court.
Where your data goes
| Provider | Data transferred | Country and region | Transfer basis |
|---|---|---|---|
| DigitalOcean, LLC (hosting: application cluster, PostgreSQL database, in-cluster Redis, and managed MongoDB audit database shared with our iElect product) | All account, profile and submission data; encrypted voter-card data; upload location; audit records | United Kingdom (London, lon1) | Adequacy, if the NDPC recognises the destination; otherwise appropriate safeguards: the provider's standard contractual clauses / DPA with NDPA-equivalent protections, plus our documented transfer impact assessment |
| MediaStash (SciTun Technologies' own media storage; no outside processor) | Result photos and videos | Europe (will be hosted in Europe) | Adequacy, if the NDPC recognises the destination; otherwise our documented transfer impact assessment and the safeguards of the underlying hosting provider |
| Termii (SMS) | Phone number and SMS content (sign-in codes, alerts) | Europe (data is hosted outside Nigeria, so this is a cross-border transfer) | Adequacy, if the NDPC recognises the destination; otherwise appropriate safeguards: the provider's standard contractual clauses / DPA with NDPA-equivalent protections, plus our documented transfer impact assessment |
| Postmark (ActiveCampaign, LLC) | Email address and email content | United States | Adequacy, if the NDPC recognises the destination; otherwise appropriate safeguards: the provider's standard contractual clauses / DPA with NDPA-equivalent protections, plus our documented transfer impact assessment |
| CloudAMQP (84codes AB) | Phone/email and message content, in transit for notifications | Europe | Adequacy, if the NDPC recognises the destination; otherwise appropriate safeguards: the provider's standard contractual clauses / DPA with NDPA-equivalent protections, plus our documented transfer impact assessment |
| Cloudinary Ltd (legacy, until migration is complete) | Photos uploaded before the move | Europe (storage); delivered via a global CDN | Adequacy, if the NDPC recognises the destination; otherwise appropriate safeguards: the provider's standard contractual clauses / DPA with NDPA-equivalent protections, plus our documented transfer impact assessment |
| OpenAI (AI extraction of result sheets), used under OpenAI's data processing agreement | Result-sheet photos | United States | Adequacy, if the NDPC recognises the destination; otherwise appropriate safeguards: the provider's standard contractual clauses / DPA with NDPA-equivalent protections, plus our documented transfer impact assessment |
| Google LLC (Google Sign-In, if you choose it) | Name, email address and Google account identifier exchanged during sign-in | United States | Adequacy, if the NDPC recognises the destination; otherwise appropriate safeguards: the provider's standard contractual clauses / DPA with NDPA-equivalent protections, plus our documented transfer impact assessment |
| ngrok, Inc. (interim network tunnel between our app and our core service) | Data passing between our app and our core service, in transit | United States | Adequacy, if the NDPC recognises the destination; otherwise appropriate safeguards: the provider's standard contractual clauses / DPA with NDPA-equivalent protections, plus our documented transfer impact assessment. This is an interim arrangement that we intend to replace |
| OpenStreetMap Foundation (map tiles loaded in your browser) | Your IP address and the map area you view, when the map loads | United Kingdom | Adequacy, if the NDPC recognises the destination; otherwise appropriate safeguards: the provider's standard contractual clauses / DPA with NDPA-equivalent protections, plus our documented transfer impact assessment |
We do not currently use a separate search service for your data.
We choose providers that offer data-protection commitments for the personal data they handle for us, and we review these arrangements and each transfer under the NDPA.
Keeping sensitive data to a minimum abroad
- Voter-card numbers are optional. They are encrypted before storage, and the readable number is deleted on the schedule in section 9.
- Precise location is collected only with uploads and incident reports (and background location only if you switch it on). It is never sent to our SMS, email, messaging or staff-alert providers, or to partners, and it is reduced to polling-unit level on the section 9 schedule.
- We send each provider only the data it needs. For example, our SMS provider receives your phone number and the message, not your profile.
Getting a copy of the safeguards. You can ask for a copy of the safeguards we rely on for any transfer (we may redact commercially confidential terms) by emailing privacy@watchthevotes.org. We will reply within 30 days.
8. How we protect your data
- Encryption in transit (HTTPS/TLS) and at rest.
- Personal identifiers such as phone numbers and IP addresses are encrypted or stored as keyed hashes.
- Voter-card numbers are handled as described in sections 2 and 9.
- Role-based access and audit logging of staff actions and role changes; we are introducing multi-factor authentication for staff accounts.
- A content hash and append-only audit chain for every submission, so tampering can be detected.
- Location and identity are removed from webhooks and public data.
- Regular security testing. We plan an independent penetration test before the 2027 elections.
- A breach response plan. If a breach is likely to put your rights at risk, we will notify the NDPC within 72 hours of becoming aware of it (NDPA section 40) and tell you promptly if the risk to you is high.
No system is perfectly secure. Please keep your phone and sign-in codes private.
9. How long we keep your data (retention schedule)
We keep data only as long as we need it. Our key dates are tied to the 2027 general elections (16 January and 6 February 2027) and the election-petition window that follows them. Under section 285 of the Constitution, petitions must be filed within 21 days of a declaration, tribunals have 180 days to decide, and each appeal has 60 days. For the 6 February 2027 elections, that means petitions close in early March 2027 and the last appeals should end by about 31 December 2027.
| Data | How long we keep it | Why |
|---|---|---|
| Voter-card (VIN/PVC) number, readable (encrypted) form | Deleted 30 days after your approval decision and in any case by 31 March 2027, whichever comes first | Needed only to check you during approval. 31 March 2027 is about 30 days after the petition-filing window closes for the 6 February elections, so it covers late approvals, re-applications and immediate fraud follow-up |
| Voter-card keyed hash (only if introduced; cannot be turned back into the number) | If we introduce keyed hashing of voter-card numbers, the hash is kept until 31 December 2027 or until you delete your account, whichever is first | Stops one voter card being used for several accounts during the election cycle and any related disputes |
| Voter-card photo | Deleted 30 days after your approval decision, by 31 March 2027 at the latest | Manual check only |
| Upload location (GPS attached to a specific result or incident) | Kept with the submission until 31 December 2027, then reduced to polling-unit level (precise coordinates deleted). Kept longer only if the submission is evidence in a live case (legal hold), and deleted when that case ends | Location is key evidence that a photo was taken at the polling unit. Petitions and appeals from the 2027 elections should end by about this date |
| Background location (only if you switched it on) | Collected only during election-day windows. Deleted 30 days after collection and all deleted by 31 March 2027, unless it is linked to a flagged submission or incident under investigation (then treated like upload location) | Used only to spot-check on election day; little value after the day |
| Device fingerprint | 90 days after your approval decision, by 31 March 2027 at the latest, unless linked to a fraud flag (then until 31 December 2027) | Duplicate-account checks at approval |
| Account and identity (name, phone, gender, date of birth, email, profile photo, polling unit) | While your account is active. On 31 December 2027 we delete or anonymise volunteer accounts unless you choose to stay on for future elections. After that, accounts inactive for 24 months are deleted | Needed to run your account and to link you to your submissions while petitions are possible |
| Result photos and figures | Kept as a long-term public-interest archive. Uploader identity is de-linked (pseudonymised) after 31 December 2027 | The EC8A is a public document. Keeping an archive serves election transparency and research. After the petition period, there's no need to know who uploaded it |
| Audit chain and content hashes | Kept long-term. References to identity are pseudonymised after 31 December 2027 | Lets anyone check the archive hasn't been tampered with |
| Accounts banned for fraud: keyed hash of phone number and device | 3 years after the ban | Stops repeat fraud in the next election cycle |
| Moderation and staff audit logs | 3 years | Accountability and investigations |
| Incident reports | Same as result submissions. Anonymous reports are kept in the archive | Evidence and transparency |
| Public comments | Until you delete them or we remove them. Your display name is de-linked if you delete your account | Public discussion |
| Alert subscriptions | Until you unsubscribe, and deleted by 7 May 2027 (90 days after the 6 February elections) unless you renew | Alerts relate to the 2027 elections |
| Consent records | As long as the related processing continues, plus 3 years | To prove we had consent |
| Sign-in codes (OTPs) | Expire within minutes; deleted within 24 hours | Security |
| SMS and email delivery logs | 90 days in our systems (our providers keep their own logs under their policies) | Troubleshooting and fraud (SMS pumping) detection |
| Server and security logs, IP hashes | 90 days | Security |
| Support messages and feedback attachments | 12 months after the issue is closed | Support |
| First-party analytics | 13 months, then aggregated | Product improvement |
| Backups | Rolling 35 days. Deleted data drops out of backups within 35 days | Disaster recovery |
If the law, a court order or a live election petition requires us to keep specific data longer, we will keep only that data, only for as long as needed, and then delete it. The retention dates in this section and our related processing follow the 2027 general election timetable as published by INEC, including any supplementary or rerun elections it announces (see inecnigeria.org). If INEC changes the timetable, we will adjust these dates and update this policy.
10. Your rights
Under the NDPA (sections 34 to 38) you have the right to:
- Be informed about how we use your data (this policy).
- Access your data and get a copy.
- Correct inaccurate or incomplete data.
- Delete your data when we no longer need it, you withdraw consent, or you object and we have no overriding reason to keep it.
- Restrict our use of your data while a complaint or correction is resolved.
- Object to processing based on legitimate interests, including first-party analytics.
- Withdraw consent at any time, as easily as you gave it.
- Data portability: receive the data you gave us in a common, machine-readable format (for example CSV or JSON), or have it sent to another organisation where technically feasible.
- Not be subject to solely automated decisions with significant effects, and ask for human review.
- Complain to the NDPC (section 14).
Limits. We may not be able to fully delete a submission that has already become part of the public record, for example a result-sheet photo and its figures. In that case we will remove your identity from it. We may also keep data where we need it for a legal claim or an election petition, or where the law requires it.
How to exercise your rights: use the settings in your account, or email privacy@watchthevotes.org from the phone number or email on your account (or tell us your phone number so we can send a code to verify you). We will reply within 30 days. We may extend this once if the request is complex, and if we do we will tell you why. Requests are free unless they are clearly unfounded or excessive.
11. Children
WatchTheVotes is for people aged 18 and over, the minimum voting age in Nigeria. Volunteers must give their date of birth, and we will not approve anyone under 18. We do not knowingly collect data from children. If we learn that we have, we will delete it. If you think a child has given us data, contact the DPO.
12. Cookies and similar technologies
We use only strictly necessary cookies and storage: sign-in session cookies (secure, HTTP-only), security tokens and your language and display settings. We also use your device's offline storage (IndexedDB) to hold queued uploads until you are back online. Queued uploads are removed from your device once they have been sent. Our first-party analytics run on our own servers and are not shared with advertisers. You can opt out in settings. We do not load any third-party analytics or advertising scripts; the only third-party script is Google Sign-In, used if you choose to sign in with Google. We do not use advertising cookies.
The "Use my location" button on the map asks your browser for your location once, to move the map. We don't save that location or send it to WatchTheVotes.
13. Changes to this policy
We will post updates here and change the "Last updated" date. If a change materially affects how we use your data, we will tell you in the app (and by SMS or email if appropriate), and where the law requires it we will ask for your consent again before the change applies.
14. Contact and complaints
- DPO: Engr Michael Agbogo, privacy@watchthevotes.org, MM2 B Elizabeth Cresent, North Star Garden Estate, Lokogoma, FCT Abuja
- Support: info@watchthevotes.org
If you are not satisfied with our response, you can also complain to the Nigeria Data Protection Commission through its website, https://ndpc.gov.ng. You can also complain to the NDPC without contacting us first.