Data Protection Policy

This policy establishes a formal framework for the protection of personal data processed by the YPP Mandate platform, ensuring compliance with the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Regulation 2019 (NDPR), and the Electoral Act 2022, and protecting the fundamental rights and freedoms of all data subjects.

This policy applies to:

• All personal data processed by the Platform in any format (digital or physical);
• All personnel who access Platform data, including YPP Electoral Committee members, VoteTrack Ltd engineers, panel members, and administrators;
• All third-party data processors engaged in connection with the Platform;
• All data processing activities — collection, storage, use, disclosure, retention, and deletion — related to the 2026 YPP Party Primaries.

This policy is grounded in the following legal instruments:

• Nigeria Data Protection Act 2023 (NDPA) — primary data protection legislation
• Nigeria Data Protection Regulation 2019 (NDPR) — subsidiary regulation
• Electoral Act 2022 — electoral data obligations
• Cybercrime (Prohibition, Prevention, Etc.) Act 2015 — cyber security obligations
• Evidence Act 2011 — admissibility of electronic evidence
• YPP Constitution, Section 51(b) — result submission mandate

A comprehensive Data Processing Agreement is in place between YPP (Data Controller) and VoteTrack Ltd (Data Processor), compliant with Schedule 2 of the NDPA 2023. The DPA specifies the subject matter, duration, nature and purpose of processing, type of personal data, and obligations of the processor.

All third-party data processors (Supabase, SMS gateway) are subject to:

• Pre-engagement due diligence (security certifications, NDPA compliance evidence);
• NDPA-compliant Data Processing Agreement prior to any data access;
• Annual compliance review for multi-year engagements.

Personnel with access to T2 or T3 data must not store, print, or transmit that data on personal devices or to personal accounts. All work is conducted on managed devices with full disk encryption. Screens must be locked when unattended.

At the end of the retention period, digital data is deleted using cryptographic erasure (overwriting encryption keys). Printed electoral materials containing personal data are shredded using cross-cut shredders rated to DIN 66399 Security Level P-4 or higher.

VoteTrack Ltd maintains a comprehensive Register of Processing Activities for this Platform in accordance with Section 27 of the NDPA 2023, covering all processing operations, their purposes, legal bases, data categories, recipients, and retention schedules.

Access to Platform data and functions is controlled by the following roles:

Service role keys (which bypass RLS) are stored only as environment variables in the server-side Next.js environment and Supabase Edge Function runtime. They are never exposed to the browser, never committed to version control, and are rotated at least annually or immediately upon suspected compromise.

All administrative dashboard access requires multi-factor authentication. Panel members and Electoral Committee members accessing the platform are required to use TOTP-based 2FA. Voter access is authenticated solely via UVP (by design — MFA would compromise anonymity).

Voter sessions are time-limited to the accreditation window of the VotingSession. Admin sessions expire after 60 minutes of inactivity. All sessions use httpOnly, secure, SameSite=Strict cookies to prevent CSRF and session hijacking.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, VoteTrack Ltd will notify:

• NDPC (Nigeria Data Protection Commission): within 72 hours of becoming aware of the breach, in accordance with Section 40 of the NDPA 2023. If notification cannot be made within 72 hours, the reasons for delay will be included.
• YPP (Data Controller): immediately upon discovery, so that YPP can fulfil its obligations as Data Controller.
• Affected data subjects: where the breach is likely to result in a high risk to their rights and freedoms, notification will be made without undue delay and in plain language.
• INEC: where the breach affects electoral data or integrity of the electoral process, INEC will be notified concurrently with NDPC.

Any person (staff, voter, aspirant, or member of the public) who becomes aware of or suspects a data breach or security incident must report it immediately to:

security@votetrack.ng — subject line: SECURITY INCIDENT — YPP Mandate

In accordance with Section 35 of the NDPA 2023, a full Data Protection Impact Assessment has been conducted for the YPP Mandate platform, given that it:

• Processes personal data at large scale (all registered YPP members);
• Relates to a particularly sensitive context (democratic elections);
• Uses novel technology (forensic e-voting, UVP cryptography, SECURITY DEFINER procedures);
• Involves systematic processing of eligibility data that affects individuals' political rights.

The DPIA concluded that the Platform's architectural approach — particularly the schema-level ballot secrecy and UVP hashing — provides privacy protection that exceeds the minimum requirements of the NDPA 2023. Key residual risks identified and mitigated:

The DPIA is reviewed before each election cycle, after any significant change to the Platform architecture, and after any P1 or P2 security incident. The DPO is responsible for maintaining the DPIA register.

Only the following processors are authorised to process YPP Mandate personal data:

• Supabase, Inc. (database infrastructure) — DPA executed; ISO 27001 & SOC 2 Type II; Standard Contractual Clauses for cross-border transfers.
• SMS Gateway Provider (TBC) — DPA executed before first use; NDPA-compliant; phone numbers processed for UVP delivery only, not retained.

No authorised processor may engage sub-processors for YPP Mandate data without prior written approval from the YPP DPO. Any unauthorised sub-processing constitutes a material breach of the Data Processing Agreement.

YPP and VoteTrack Ltd reserve the right to audit any approved processor's compliance with the NDPA and this policy, either directly or through an independent auditor, with 30 days' notice (or immediately in the event of a suspected breach).

Before the VoterRegister for any VotingSession may be locked, the following must be satisfied:

• The Electoral Committee Chair or delegated officer has formally approved the register in writing;
• A human review of the register has been completed for obvious errors (duplicates, non-members, incorrect ward assignments);
• The register count has been reconciled against the YPP Member Registry;
• The DPO has been notified of the planned lock date and time;
• An INEC submission date has been confirmed.

The lock is executed by calling the POST /api/admin/register-snapshot endpoint with the session ID, authenticated with the service role key. This triggers the register-snapshot Edge Function, which seeds the VoterRegister and sets snapshot_locked = true. The operation is atomic — it either completes fully or rolls back entirely.

Once locked, no row in the VoterRegister for that session may be added, modified, or deleted through any application interface or direct database statement (the constraint is enforced by a database trigger). Any attempt generates an alert to the DPO.

If a material error is discovered after locking (e.g., a court order mandating inclusion of a specific voter), the correction requires: (a) written authorisation from the YPP Electoral Committee and the DPO; (b) a DBA operation with full audit logging; (c) notification to INEC; and (d) generation of a corrected INEC submission. This procedure is available only before the voting window opens.

The Platform maintains append-only audit logs containing:

• Timestamp (UTC, millisecond precision);
• Actor (user ID / role / system function);
• Action type (CREATE / READ / UPDATE / LOCK / CAST / ACCREDIT / EXPORT / LOGIN / etc.);
• Affected resource (table + row ID where applicable, excluding T1 data);
• Request fingerprint (hashed IP + user agent);
• Outcome (success / failure / reason).

All audit logs are stored in a format compliant with the Evidence Act 2011 for admissibility as electronic evidence in Nigerian courts. VoteTrack Ltd maintains a documented chain of custody procedure for producing audit logs in response to court orders or INEC demands.

Audit logs are append-only. Write access to the log table is restricted to the service_role (automated Platform functions only). No user, administrator, or engineer can modify or delete audit log entries through any application interface.

Audit logs are retained for 2 years (general security logs) and 7 years (electoral event logs — accreditation, vote casting, register operations, INEC submissions), in accordance with the INEC archival requirements and the NDPA data minimisation principle.

Breach of this policy by YPP personnel or contractors may result in:

• Immediate revocation of Platform access credentials;
• YPP disciplinary proceedings (including suspension or expulsion);
• Termination of contract (for contractors and third-party processors);
• Civil liability for damages caused by the breach.

Non-compliance with the NDPA 2023 may result in regulatory enforcement by the NDPC, including fines of up to ₦10 million or 2% of annual gross revenue (whichever is greater) for a Data Controller, and administrative sanctions against the Data Processor.

Where a breach constitutes a criminal offence under the Cybercrime Act 2015, the NDPA 2023, or the Electoral Act 2022, the matter will be referred to the Nigerian Police Force Cybercrime Unit and/or INEC for prosecution.