Privacy Policy

The Office for Strategic Preparedness and Resilience (“OSPRE”, “we”, “us”, “our”) is Nigeria's National Centre for the Coordination of Early Warning and Response Mechanisms, established by Presidential Executive Order 12 pursuant to Article 58 of the ECOWAS Treaty and Article 16 of the 1999 Protocol on Conflict Prevention, Management, Resolution, Peacekeeping and Security.

For the purposes of the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation 2019 (NDPR), OSPRE is the Data Controller for personal data processed through osprenigeria.gov.ng and its associated services. Our Data Protection Officer (DPO) is registered and contactable as set out in section 15.

This Policy applies to personal data we process when you visit our website, submit an incident or early-warning report, contact us, request a resource or publication, apply for partnership, subscribe to updates, or access an authorised staff or partner account. It explains what we collect, why, the lawful bases we rely on, how we protect it, how long we keep it, and the rights available to you.

We collect only the data we need for the purposes described in this Policy. Categories include:

We do not intentionally collect special-category (sensitive) personal data through public forms. Where a report you submit necessarily contains sensitive information, we process it under the lawful bases in section 5 and apply heightened safeguards.

Under the NDPA, we must rely on a lawful basis for each processing purpose. Our principal purposes and bases are:

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

Reporting a threat should never expose you to risk. Our incident and early-warning intake is built to protect reporters:

• Anonymous by choice. You may submit a report without providing your name or contact details. Identifying fields are optional.
• No raw IP retention on reports. To deter abuse without tracking you, we store only a salted, irreversible SHA-256 hash derived from network metadata — never your raw IP address — and it is never exposed.
• Need-to-know handling. Reports are accessible only to authorised analysts under least-privilege access controls and full audit logging.
• Selective, sanitised publication. A report is only ever made public after human review and with identifying detail removed.

We use the minimum cookies required to operate securely. We do not use advertising, profiling or cross-site tracking cookies, and we do not sell data to advertisers.

These are essential cookies; the platform cannot function securely without them. You can block cookies in your browser, but authenticated areas will not work. We do not deploy third-party analytics or marketing trackers.

Our public pages can display the local date, time and weather for your approximate location. We have engineered this to be privacy-preserving and sovereign:

• Your approximate location (city/country) is resolved on our own servers using a locally-hosted geolocation database — your IP address is not sent to any third party for this purpose.
• To fetch weather, only approximate coordinates (not your IP or any identifier) are sent to our weather data provider.
• Your live clock is computed in your own browser and no location is stored to your profile.

We also process IP-derived data transiently for security monitoring (e.g. rate-limiting and intrusion detection) as described in section 10.

We never sell, rent or trade your personal data. We share it only where necessary and lawful:

• Government partners. With relevant Federal and State institutions strictly for the coordination of early-warning and response activities, on a need-to-know basis.
• Regional bodies. With ECOWAS mechanisms where required under the Treaty and Security Protocol.
• Development partners. Only under formal data-sharing or partnership agreements that impose equivalent protection.
• Service processors. With vetted providers that process data on our documented instructions under written agreements (e.g. infrastructure and email delivery).
• Legal disclosure. Where required by law, court order, or a lawful request from a competent authority.

We prioritise keeping personal data within Nigeria on sovereign infrastructure, and we have deliberately designed privacy-sensitive functions (such as IP geolocation) to run on-premises so data does not leave the country unnecessarily. Where a transfer outside Nigeria is unavoidable, we do so only where the NDPA permits — for example under an adequacy determination, appropriate contractual safeguards, or your explicit consent. For resilience and disaster recovery, we may retain encrypted backup snapshots off-site; these are protected with strong encryption at rest and remain subject to this Policy.

We apply layered, independently-verified technical and organisational measures, including:

• Encryption in transit. All traffic is served over TLS/HTTPS with HSTS.
• Perimeter defence. A web application firewall (ModSecurity with the OWASP Core Rule Set) and per-endpoint rate-limiting protect against attacks and abuse.
• Strong authentication. Staff access requires two-factor authentication (TOTP); passwords are stored using bcrypt and screened against known-breached-password datasets using a privacy-preserving k-anonymity check.
• Least privilege & auditing. Access is capability-based and re-checked against live records; security-relevant actions are logged; intrusion tripwires and device-anomaly detection are in place.
• Secret, backup & data protection. Application secrets are encrypted at rest, and backup and disaster-recovery snapshots — including any copy held off-site for resilience — are encrypted at rest.

No system can be guaranteed perfectly secure, but we continuously monitor, patch and independently review our controls. If a breach ever affects your rights, we will act — and notify you and the NDPC — as the NDPA requires.

We keep personal data only as long as necessary for the purpose collected, then delete or anonymise it:

Subject to the NDPA, you have the right to:

To exercise any right, contact our DPO (section 15). We respond within the statutory timeframe and will not charge a fee except where the law allows.

The platform is intended for adults and is not directed at children. We do not knowingly collect personal data from anyone under 18 without appropriate consent. If you believe a child has provided us data, contact our DPO and we will take appropriate action.

Our reconnaissance and early-warning analytics aggregate and cross-verify publicly-available incident data from multiple independent open sources to produce area-level risk pictures — no single source is treated as authoritative. This analysis concerns events and locations, not the profiling of individual website visitors, and does not make automated decisions producing legal or similarly significant effects about you.

We may update this Policy to reflect changes in law, technology or our services. We will revise the “Last updated” date above and, for material changes, notify registered users. Your continued use after changes take effect constitutes acceptance of the revised Policy.

To exercise your rights, ask a question, or raise a concern about how we handle your data, contact our Data Protection Officer: