Privacy Policy

1 Introduction

CRSSC is the statutory body responsible for sports development and administration in Cross River State. In performing our public mandate and operating the Services, we act as a data controller in respect of personal data processed through this website and related platforms.

By using the Services or submitting personal data to us, you acknowledge that you have read this Privacy Policy. Where processing is based on consent, you may withdraw that consent at any time, subject to applicable law. This Policy should be read together with our Terms and Conditions.

2 Legal Basis for Processing

Under the NDPA, we process personal data on one or more of the following lawful bases:

• Consent — where you have given clear consent for a specific purpose (for example, optional communications or certain form submissions)
• Contract / request for a service — where processing is necessary to fulfil a facility booking, registration, or other service you have requested
• Public interest / official authority — where processing is necessary for CRSSC to carry out its statutory sports administration and development functions
• Legal obligation — where we must process data to comply with Nigerian law, court orders, or regulatory requirements
• Legitimate interests — where processing is necessary for security, fraud prevention, service improvement, or similar interests that do not override your rights

We aim to ensure that processing is necessary, proportionate, and transparent.

3 Personal Data We Collect

Depending on how you interact with us, we may collect the following categories of personal data:

• Data you provide:
  • Full name, email address, phone number, and physical address
  • Organisation, school, club, or government agency details
  • Date of birth, gender, and sport or programme preferences (for athlete and related registrations)
  • Identification documents or numbers where required for verification
  • Event details, facility preferences, and booking information
  • Payment references and proof-of-payment uploads
  • Messages and attachments submitted via contact or enquiry forms
  • Photographs or media you voluntarily upload for programmes or profiles
• Data collected automatically:
  • IP address, browser type and version, device type, and operating system
  • Pages viewed, referring URLs, date and time of access
  • Session identifiers, cookies, and similar technical logs used for security and analytics
• Sensitive / special category data: We do not intentionally collect sensitive personal data (such as health information, biometric data used for unique identification, or data revealing political or religious beliefs) unless it is necessary for a specific sports programme, medical clearance, or statutory purpose, and then only with appropriate safeguards under the NDPA.

4 Purpose of Processing

We process personal data for purposes including:

• Operating the website and delivering digital services (including registrations, portals, and facility booking)
• Responding to enquiries and providing official information
• Administering sports programmes, talent identification, athlete development, and events
• Confirming bookings, processing payments or payment proofs, and managing cancellations or refunds
• Improving service delivery, accessibility, and user experience
• Maintaining security, preventing fraud, misuse, and unauthorised access
• Keeping accurate administrative records and complying with audit, legal, and regulatory obligations
• Communicating service-related notices and, where permitted, programme updates

We do not process personal data for purposes incompatible with those stated above without providing notice or obtaining fresh consent where required.

5 Data Minimisation and Retention

• We collect only personal data that is adequate, relevant, and limited to what is necessary for the stated purpose
• We retain personal data only for as long as needed to fulfil that purpose, meet statutory or audit requirements, or resolve disputes
• When data is no longer required, we delete it, anonymise it, or securely archive it in line with applicable public-sector record-keeping rules
• Booking, payment, and registration records may be retained longer where required for financial accountability or legal compliance

6 Sharing and Disclosure

We do not sell personal data. We may share personal data only where necessary and lawful, including:

• With authorised ministries, departments, agencies, local governments, sports federations, or partners involved in delivering CRSSC programmes
• With service providers who support hosting, email, payment verification, security, or analytics, under appropriate contractual controls
• When required by law, court order, law-enforcement request, or regulatory obligation
• With your consent, or where you have directed us to share information (for example, competition entry with an organising body)

Where third parties process data on our behalf, we expect them to implement safeguards consistent with the NDPA.

7 Cross-Border Data Transfers

Personal data is primarily processed and stored in Nigeria. If personal data must be transferred outside Nigeria (for example, through a cloud or service provider), we will take steps required under the NDPA and applicable NDPC guidance, which may include:

• Ensuring the destination provides an adequate level of data protection
• Using approved contractual or other transfer mechanisms
• Obtaining your consent where required

8 Security Measures

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, loss, or destruction. These may include:

• Access controls and role-based permissions for staff
• Secure hosting environments and encrypted connections (HTTPS) where available
• Authentication and session management for protected areas
• Logging, monitoring, and periodic security reviews
• Staff awareness of confidentiality and data-handling obligations

No method of transmission or storage is completely secure. If you suspect a security incident involving your data on our Services, please contact us promptly using the details below.

9 Cookies and Similar Technologies

Our website may use cookies and similar technologies to enable core functionality, remember preferences, maintain sessions, and understand how the Services are used. Essential cookies are required for the site to operate. Analytics or preference cookies, where used, help us improve performance and content.

You can control cookies through your browser settings. Blocking certain cookies may affect the availability or functionality of some features of the Services.

12 Data Protection Enquiries

For privacy questions, data subject requests, or concerns about how CRSSC handles personal data, please contact us through the channels below. We will route your enquiry to the appropriate officer responsible for data protection compliance within the Commission.

You may also seek guidance or lodge a complaint with the Nigeria Data Protection Commission (NDPC).

13 Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our Services, legal requirements, or operational practices. The revised version will be posted on this page with an updated “Last updated” date. We encourage you to review this page periodically. Continued use of the Services after changes take effect constitutes acknowledgement of the updated Policy, except where consent is required by law.

14 Contact Information

For questions, complaints, or to exercise your data protection rights: