FundGrid Privacy Policy

1. Introduction

FundGrid respects your privacy and is committed to protecting the personal data entrusted to us.

FundGrid is a technology platform operated by North Canvas Technologies Ltd. (“FundGrid”, “North Canvas”, “we”, “us” or “our”). FundGrid provides digital infrastructure for discovering, verifying, assessing, independently authenticating, funding, implementing and tracking community-development projects.

This Privacy Policy explains how we collect, use, store, disclose and protect personal data when you:

• visit the FundGrid website;
• create or use a FundGrid account;
• contribute to the FundGrid Impact Pool;
• participate as a corporate contributor;
• register an organization or submit a project;
• report a community need;
• participate as an Implementing Partner, verifier or volunteer;
• submit project evidence or updates;
• report a concern;
• communicate with us;
• use Grid, our AI-enabled assistant;
• otherwise interact with FundGrid.

We process personal data in accordance with applicable data-protection laws, including the Nigeria Data Protection Act 2023 and applicable directives and guidance issued by the Nigeria Data Protection Commission.

2. Who We Are

FundGrid is a product of:
North Canvas Technologies Ltd.

FundGrid is a Community Impact Infrastructure Platform designed to enable transparent, verified and accountable support for community-development projects.

For privacy questions, requests or complaints, you may contact FundGrid through the contact details provided on our website.

Privacy/Data Protection Email: [Insert official privacy email before launch]
Registered/Business Address: [Insert official address before launch]

3. Personal Data We May Collect

The information we collect depends on how you interact with FundGrid.

A. Account and Identity Information

This may include:

• full name;
• email address;
• phone or WhatsApp number;
• country;
• state or location;
• account type;
• username/account identifier;
• authentication information;
• communication preferences.

Passwords should be stored securely in hashed or otherwise protected form. FundGrid does not need to know your plain-text password.

B. Individual Contributor Information

We may collect:

• name;
• contact information;
• contribution history;
• contribution amount;
• currency;
• payment status;
• transaction references;
• Impact Pool participation;
• allocation-related records;
• receipt information;
• impact-report preferences.

Where you contribute as a guest, we may collect only the information necessary to process and acknowledge the contribution.

C. Corporate Account Information

Corporate users may provide:

• company name;
• company registration number;
• company email;
• website;
• industry or sector;
• country and location;
• authorized contact person's details;
• corporate verification information;
• Impact Pool contribution records;
• project sponsorship records;
• CSR or sustainability preferences;
• reporting information.

D. NGO and Project Owner Information

Organizations may provide information including:

• organization name;
• registration number;
• organization type;
• address;
• organization profile;
• authorized representatives;
• registration certificates;
• proof of address;
• identification documents;
• authorization documents;
• previous-project records;
• one-year financial statements;
• supporting organizational documents;
• project submissions;
• project budgets;
• quotations;
• implementation plans;
• milestone evidence;
• financial and project records.

Some of this information is collected specifically for due diligence, verification, fraud prevention and project assurance.

E. Community Need Reports

When someone reports a community need, we may collect:

• reporter's name;
• phone/WhatsApp number;
• email address;
• relationship to the affected community;
• community name;
• state and LGA;
• location information;
• GPS/map coordinates where provided;
• description of the problem;
• estimated number of people affected;
• photographs and videos;
• community contact information;
• follow-up responses;
• evidence connected to the reported need.

A Community Reporter will not ordinarily be publicly identified merely because they submitted a report unless they have consented to such disclosure or disclosure is otherwise lawfully required.

F. Verification and Project Evidence

We may process:

• photographs;
• videos;
• GPS/location information;
• timestamps;
• verification checklists;
• technical assessments;
• field reports;
• community interviews or confirmations;
• project documentation;
• evidence submitted by volunteers or partners;
• verification findings;
• project-assessment records;
• conflict-of-interest declarations;
• independent authentication records.

G. Community Feedback and Concern Reports

If you report an issue concerning a project, organization or participant, we may process:

• your contact details;
• complaint or concern;
• supporting documents;
• photographs/videos;
• project reference;
• allegations or observations;
• correspondence relating to the investigation.

Where appropriate, reports may be handled confidentially.

Confidential treatment does not necessarily mean absolute anonymity where disclosure is required by law, necessary for safeguarding, necessary for fair investigation, or otherwise legally justified.

H. Payment Information

Where live payments are enabled, payment transactions may be processed through third-party payment providers.

FundGrid may receive information such as:

• amount;
• currency;
• payment status;
• payment method;
• transaction reference;
• payer identifier;
• payment provider reference.

Full card details should ordinarily be processed by the relevant payment provider and not stored directly by FundGrid.

I. Technical and Usage Information

When you use FundGrid, we may automatically receive information such as:

• IP address;
• browser;
• device type;
• operating system;
• pages viewed;
• session information;
• login activity;
• referral information;
• timestamps;
• cookies or similar technologies;
• security and diagnostic data.

J. Grid AI Interactions

Where you use Grid or another AI-enabled FundGrid feature, we may process:

• prompts and questions;
• account role;
• relevant FundGrid records required to answer your request;
• conversation history where enabled;
• feedback;
• technical logs.

Grid must operate according to the permissions associated with your account.

4. How We Obtain Personal Data

We may obtain information:

• directly from you;
• from organizations you represent;
• from Community Reporters;
• from FundGrid verification partners;
• from volunteers;
• from community representatives;
• from public records;
• from corporate or institutional partners;
• through payment providers;
• through technical systems and cookies;
• from other lawful sources used for verification or due diligence.

Where we obtain personal data from a person other than you, we will handle that information in accordance with applicable data-protection requirements.

5. Why We Use Personal Data

We may process personal data to:

• create and administer accounts;
• verify email addresses and identities;
• verify corporate and organizational accounts;
• conduct organization due diligence;
• receive and evaluate Community Need Reports;
• receive and process project submissions;
• verify community needs;
• verify project information;
• conduct financial, technical and implementation assessments;
• coordinate field verification;
• administer the FundGrid Project Assessment & Verification Standard;
• prepare project authentication dossiers;
• facilitate independent project authentication;
• publish eligible project information;
• process Impact Pool contributions;
• administer corporate sponsorships;
• track allocations;
• monitor project implementation;
• review milestone evidence;
• prepare reports and receipts;
• provide customer support;
• investigate concerns and suspected misconduct;
• prevent fraud and abuse;
• maintain platform security;
• meet legal and regulatory obligations;
• communicate important account or project information;
• improve FundGrid;
• conduct analytics;
• provide AI-assisted functionality;
• establish, exercise or defend legal rights.

6. Lawful Bases for Processing

Depending on the circumstances, FundGrid may process personal data based on one or more lawful bases, including:

• your consent;
• performance of a contract or steps taken at your request before entering a contract;
• compliance with legal obligations;
• legitimate interests pursued by FundGrid or another party, where those interests are not overridden by your rights;
• protection of vital interests where applicable;
• other lawful grounds permitted by applicable law.

Where processing relies on consent, you may withdraw that consent, subject to applicable law and any processing already lawfully completed before withdrawal.

7. Sensitive Personal Data

Certain FundGrid activities may involve information requiring additional protection, including identification documents, financial information, location data, safeguarding information or other sensitive records.

We seek to collect sensitive information only where necessary and to apply appropriate safeguards.

Users should avoid uploading unnecessary sensitive personal information.

8. Children

FundGrid accounts, financial contributions, corporate accounts and organization accounts are intended for adults who can lawfully enter into relevant transactions.

A person under 18 should not create an account or make a financial contribution without appropriate lawful authorization.

Where FundGrid processes personal data relating to children as project beneficiaries, community members or through project evidence, we will apply additional safeguards.

Where consent is the applicable lawful basis for processing a child's data, Nigerian law generally requires consent from a parent or legal guardian, subject to applicable statutory exceptions.

Organizations, partners and users uploading photographs, videos or other information involving children must ensure that they have an appropriate lawful basis and required permissions.

9. Public Project Information

FundGrid is built around transparency, but not every piece of information collected during verification should become public.

Public project pages may contain information such as:

• project title;
• community/location;
• project category;
• project owner;
• project origin;
• funding information;
• project description;
• beneficiary estimates;
• relevant SDGs;
• implementation partner;
• milestone progress;
• public-safe project evidence;
• verification status;
• independent authentication reference;
• public verification summary;
• impact information.

Sensitive verification records, personal identification documents, confidential financial information, private committee deliberations and similar information will not ordinarily be publicly displayed.

10. Who We May Share Information With

Where necessary and lawful, FundGrid may share relevant information with:

• payment service providers;
• hosting and cloud providers;
• authentication providers;
• email, messaging and notification services;
• Implementing Partners;
• verification professionals;
• FundGrid Ambassadors or volunteers;
• Independent Project Authentication Committee members;
• professional advisers;
• auditors;
• analytics providers;
• technology vendors;
• government or regulatory authorities;
• law-enforcement authorities where legally required;
• corporate sponsors where appropriate and lawful;
• other parties necessary for project implementation or verification.

Recipients should receive only the information reasonably necessary for their role.

Where third parties process personal data on our behalf, FundGrid should use appropriate contractual and data-protection safeguards.

11. International Data Transfers

Some technology providers or infrastructure used by FundGrid may process data outside Nigeria.

Where personal data is transferred internationally, FundGrid will seek to use lawful transfer mechanisms and appropriate safeguards in accordance with applicable Nigerian data-protection requirements.

12. Artificial Intelligence and Automated Processing

FundGrid may use AI to assist with tasks such as:

• document extraction;
• project summaries;
• completeness checking;
• potential anomaly identification;
• clarification drafting;
• evidence summarization;
• project categorization;
• reporting;
• user support.

FundGrid's operating principle is:

AI prepares. Humans decide.

AI should not independently make consequential final decisions such as:

• final NGO approval;
• project authentication;
• definitive fraud determination;
• final project rejection;
• independent project authorization.

Where applicable, users retain rights relating to automated decision-making under applicable data-protection law.

13. Cookies and Similar Technologies

FundGrid may use cookies and similar technologies to:

• keep users signed in;
• maintain security;
• remember preferences;
• understand website performance;
• improve functionality;
• conduct analytics.

Where required, non-essential cookies will be subject to appropriate consent controls.

Users should be able to manage applicable cookie preferences.

14. Data Security

FundGrid seeks to use reasonable administrative, technical and organizational safeguards to protect personal data from:

• unauthorized access;
• unlawful processing;
• alteration;
• accidental loss;
• destruction;
• disclosure;
• misuse.

However, no digital system can guarantee absolute security.

Users are responsible for protecting their account credentials and should notify FundGrid promptly if they suspect unauthorized account access.

15. Data Retention

FundGrid will retain personal data only for as long as reasonably necessary for:

• the purpose for which it was collected;
• project verification;
• financial reconciliation;
• audit records;
• fraud prevention;
• dispute resolution;
• regulatory obligations;
• legal requirements;
• project accountability;
• legitimate operational needs.

Retention periods may differ depending on the type of record.

Some project, authentication, financial and audit records may need to be retained after an account has been closed because of FundGrid's accountability or legal obligations.

16. Your Data Protection Rights

Subject to applicable law, you may have the right to:

• be informed about processing of your personal data;
• access your personal data;
• correct inaccurate information;
• request deletion where applicable;
• restrict processing;
• object to certain processing;
• withdraw consent where processing relies on consent;
• request portability of qualifying data;
• challenge certain automated decisions;
• lodge a complaint with the Nigeria Data Protection Commission.

To exercise a right, contact FundGrid using the privacy contact details provided on our website.

We may need to verify your identity before fulfilling a request.

17. Data Breaches

Where a personal-data breach occurs, FundGrid will assess the incident and take appropriate containment, remediation and notification steps as required by applicable law.

18. Third-Party Websites

FundGrid may link to third-party websites or services.

We do not control the privacy practices of independent third parties. You should review the privacy notices of those services before providing them with personal data.

19. Changes to This Privacy Policy

We may update this Privacy Policy when our services, technology, legal obligations or data practices change.

Material changes will be reflected through an updated effective date and, where appropriate, additional notice.

20. Contact and Complaints

For privacy questions, requests or concerns, contact:

FundGrid / North Canvas Technologies Ltd.
Email: [Insert privacy email]
Address: [Insert official company address]

You may also have the right to make a complaint to the Nigeria Data Protection Commission.