Privacy Policy

1. Who We Are

SmartBallot is a technology platform providing digital infrastructure for institutional elections, civic and community engagement, communications, SuperGroups, organizational activities and related digital services. The Platform may be used by tertiary institutions, student bodies, civic organizations, associations, communities, movements, campaigns, electoral groups and other eligible organizations and users.

1.1 Institutional Digital Elections

SmartBallot may provide digital election technology through which tertiary institutions, student bodies and other eligible private or institutional organizations administer their own internal elections.

These elections are separate from Nigerian governmental elections administered by INEC or another legally authorized election management body. References in this Privacy Policy to SmartBallot’s “voting,” “ballot” or “election” functionality should therefore be understood primarily in the context of such institutional or private elections, unless expressly stated otherwise.

1.2 SuperGroups

SmartBallot provides technology and infrastructure through which independently organized communities, associations, movements and other groups may establish and operate SuperGroups. Unless SmartBallot expressly identifies itself as the owner or operator of a particular SuperGroup, the fact that a SuperGroup exists on SmartBallot does not mean SmartBallot owns, sponsors, endorses, manages or controls the organization operating that SuperGroup.

SmartBallot provides the infrastructure through which the SuperGroup operates, in a manner broadly comparable to other communications and community platforms providing technology to independently operated groups. Users freely decide whether to request or maintain membership in a SuperGroup. Before joining, users may be presented with information, consent requests or acknowledgements concerning membership, group communications and the processing necessary to provide the requested SuperGroup functionality. Users may leave a SuperGroup through available controls on the Platform.

1.3 Privacy Roles

Depending upon the circumstances and applicable law, SmartBallot, a participating institution, a SuperGroup operator or another organization using SmartBallot may act as a data controller, joint controller, processor, service provider or another legally recognized participant in processing personal information.

SmartBallot’s processing activities may be subject, where applicable, to:

• The Nigeria Data Protection Act 2023 (“NDPA”) and applicable regulations, directives and guidance of the Nigeria Data Protection Commission (“NDPC”);
• Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”) and applicable provincial privacy legislation;
• The European Union General Data Protection Regulation (“EU GDPR”);
• The United Kingdom GDPR and Data Protection Act 2018;
• Applicable United States federal or state privacy laws; and
• Other privacy and data-protection laws lawfully applicable to a particular processing activity.

The Nigeria Data Protection Act 2023 is Nigeria’s current principal data-protection statute and provides, among other matters, rules regarding lawful processing, sensitive personal data, data-subject rights and international transfers. 

2. Information We Collect

The information SmartBallot collects depends upon how an individual uses the Platform and which features the individual chooses to access. SmartBallot seeks to limit collection to information reasonably necessary for identified and lawful purposes.

2.1 Personal and Account Information

We may collect:

• full name;
• telephone number;
• email address;
• username or display name;
• account credentials;
• profile photograph where supplied;
• age or date of birth where legitimately necessary;
• gender where voluntarily supplied or legitimately required;
• institutional or organizational affiliation;
• account authentication information;
• information submitted when requesting SuperGroup membership; and
• other information voluntarily submitted by the user.

2.2 Government Identification Information

We Do Not Require for Ordinary Registration or SuperGroup Membership. SmartBallot DOES NOT require or collect the following as part of ordinary SmartBallot account registration or ordinary SuperGroup membership:

• National Identification Number (NIN);
• Permanent Voter’s Card (PVC) number;
• A photograph or copy of a PVC;
• Nigerian national identity card;
• International passport;
• Driver’s licence; or
• Other government-issued identity documents.

SmartBallot does not use NIN or PVC information to authenticate participation in Nigerian governmental elections. SmartBallot registration is independent from INEC registration and is not represented as governmental voter registration, voter accreditation or verification of eligibility to vote in an official Nigerian governmental election.

Where a tertiary institution or other eligible private organization separately requires institutional identification or eligibility information for its own internal election, the information required will be identified to affected participants and processed only for the applicable lawful purpose.

This distinction enables SmartBallot to minimize unnecessary collection while still supporting legitimate institutional-election requirements. Both the Nigerian framework and Canada’s PIPEDA emphasize lawful, purpose-specific and appropriately limited processing.

2.3 Institutional Election and Eligibility Information

Where SmartBallot is used by a tertiary institution or another eligible private organization to conduct an internal digital election, SmartBallot may process information reasonably necessary to:

• authenticate eligible participants;
• determine institutional-election eligibility;
• prevent duplicate participation;
• prevent impersonation or fraud;
• administer the applicable election;
• maintain system and election integrity; and
• maintain appropriate audit information.

Such information relates to the relevant institutional or private election and does not constitute voter accreditation or official voting records for Nigerian governmental elections.

Where an election is conducted by secret ballot, appropriate technical and organizational measures should be used to preserve ballot secrecy.

2.4 SuperGroup Information

Where a user voluntarily joins or participates in a SuperGroup, SmartBallot may process:

• SuperGroup membership;
• membership status;
• name and profile information;
• telephone number;
• email address;
• administrative roles;
• State, Local Government Area, Ward, Polling Unit or other organizational assignment where applicable;
• information submitted when requesting membership;
• verification information;
• communications with authorized administrators;
• referrals or invitations;
• posts, comments and other group content; and
• other information reasonably necessary to provide the requested SuperGroup functionality.

2.5 Sensitive Personal Information

Some information processed through SmartBallot may qualify as sensitive personal data under applicable law. For example, participation in certain civic, political or advocacy-oriented SuperGroups may reveal or permit an inference concerning an individual’s political opinions or affiliations. SmartBallot does not assume that membership in every SuperGroup necessarily establishes political affiliation. However, where information constitutes sensitive personal data, SmartBallot will process that information only where an appropriate lawful basis or additional processing condition exists and will implement safeguards appropriate to the nature and sensitivity of the information. The Nigerian NDPA expressly treats political opinions or affiliations as sensitive personal data.

2.6 Technical and Usage Information

SmartBallot may process:

• IP address;
• device type;
• operating system;
• browser information;
• device identifiers where permitted;
• login records;
• authentication information;
• timestamps;
• app interactions;
• security events;
• crash information;
• diagnostic information; and
• other technical data reasonably required to operate, protect and improve the Platform.

2.7 Location and Geographic Information

Where a SmartBallot feature requires device location, location information will be processed only where an appropriate lawful basis exists and any required device permission has been obtained. Users may also voluntarily select or provide geographic or organizational information such as:

• country;
• State;
• LGA;
• Ward;
• Polling Unit; or
• institutional location.

User-selected geographic information does not necessarily represent the user’s precise or real-time physical location.

2.8 User-Generated Content

SmartBallot may process content voluntarily submitted through Platform functionality, including:

• messages;
• comments;
• posts;
• photographs;
• videos;
• documents;
• institutional election materials;
• incident reports;
• observational reports; and
• other user-generated content.

2.9 Payment and Transaction Information

Where SmartBallot provides payment, donation, wallet, fundraising or related transaction functionality, relevant transaction information may be processed. Depending upon the method of payment, payment-card credentials or banking information may be processed directly by authorized payment service providers rather than stored by SmartBallot. SmartBallot may maintain information such as transaction references, amounts, timestamps, transaction status and records reasonably necessary for accounting, reconciliation, fraud prevention, dispute resolution, security and regulatory compliance.

3. How We Use Your Information

SmartBallot may use and process personal information for identified and lawful purposes including:

• creating and maintaining user accounts;
• authenticating and verifying accounts;
• providing requested Platform services;
• facilitating digital elections conducted by participating tertiary institutions and other eligible private organizations;
• determining eligibility for institutional elections;
• preventing duplicate institutional voting, fraud and impersonation;
• enabling voluntary participation in SuperGroups;
• assigning users to requested or applicable organizational structures;
• enabling authorized SuperGroup administrators to administer their respective groups;
• facilitating appropriate communications between groups and their members;
• sending OTPs, authentication information and security notifications;
• communicating important service, account or group information;
• providing customer support;
• processing transactions;
• preventing misuse or abuse of the Platform;
• maintaining Platform security;
• investigating suspected security incidents;
• diagnosing technical problems;
• improving functionality and user experience;
• maintaining appropriate security and audit records;
• enforcing applicable Platform policies and agreements;
• complying with legal obligations; and
• protecting the rights, security and integrity of SmartBallot, its users and others.

3.1 SuperGroup Communications

Where a user voluntarily joins a SuperGroup and an appropriate lawful basis exists, the relevant SuperGroup and its authorized administrators may use permitted contact information for legitimate purposes connected with that user’s membership.

This may include:

• membership verification;
• membership-related information;
• important group communications;
• requests for additional information reasonably necessary for legitimate group purposes;
• phone calls;
• SMS;
• email; and
• other communications disclosed to the user.

SmartBallot does not treat membership in one SuperGroup as authorization for unrelated SuperGroups or organizations to access or use that user’s private contact information.

3.2 Public-Election Civic Engagement and Monitoring

SmartBallot may provide independent technology supporting lawful:

• voter education;
• civic engagement;
• voluntary voter mobilization;
• community organization;
• communications;
• election-related documentation;
• incident reporting;
• observational reporting;
• election monitoring or observation support; and
• related lawful civic activities.

These features are separate from and do not connect to, control, modify or participate in INEC’s official voter registration, accreditation, governmental voting, ballot counting, official result transmission, official collation, declaration or return processes. SmartBallot has no functionality designed to cast or alter votes in Nigerian governmental elections, access or modify INEC electoral systems, conduct official governmental result transmission or collation, or declare the official winner of a Nigerian governmental election. Where an individual or organization requires accreditation, appointment or authorization to perform a particular election-related role, SmartBallot’s technology does not itself confer that legal status. Information independently submitted through SmartBallot’s observational or monitoring functionality does not become official electoral data merely because it appears on the Platform.

4. Legal Basis for Processing

Where applicable legislation requires a lawful basis for processing, SmartBallot will rely upon one or more legally recognized grounds appropriate to the particular activity.

These may include:

1. Consent: Where an individual freely gives valid consent to specified processing.
2. Contractual Necessity: Where processing is necessary to provide a service requested by the user or perform an applicable agreement.
3. Legal Obligation: Where processing is necessary to comply with an applicable statutory, regulatory, judicial or other legal requirement.
4. Legitimate Interests: Where recognized by applicable law and where SmartBallot’s or another party’s legitimate interests are not overridden by the rights and interests of the affected individual. Potential legitimate interests may include cybersecurity, fraud prevention, Platform integrity and service improvement.
5. Vital Interests or Public Interest: Where recognized and applicable under relevant legislation.
6. Sensitive Personal Data: Where sensitive personal data is processed, SmartBallot will satisfy the additional lawful requirements or conditions applicable to that category of information.

Where SmartBallot relies upon consent, individuals may withdraw that consent subject to applicable law and the nature of the requested service. Withdrawal of consent does not retroactively invalidate processing lawfully conducted before withdrawal. Consent will not be interpreted as blanket authorization for processing unrelated to the purposes presented to the user.

5. How We Share And Disclose Your Information

SmartBallot does not sell personal information. SmartBallot does not provide SuperGroups with unrestricted access to SmartBallot’s broader user database merely because those groups use the Platform. Information may be disclosed only where reasonably necessary, appropriately authorized and permitted by applicable law.

6. Cross-border Data Transfers And International Access

SmartBallot operates through internet, cloud, communications and technology infrastructure that may involve more than one jurisdiction. Accordingly, personal information may be accessed, processed, transferred or stored outside the country where the individual is located or where the information was originally collected. This may include processing in Nigeria, Canada, the United States or other jurisdictions in which SmartBallot or authorized service providers maintain infrastructure or provide services. Where international transfers occur, SmartBallot will implement safeguards applicable to the circumstances, which may include:

• data-processing agreements;
• appropriate contractual protections;
• Standard Contractual Clauses or other recognized transfer instruments where applicable;
• adequacy or transfer-risk assessments where required;
• encryption;
• access restrictions;
• data minimization;
• vendor due diligence;
• information-security requirements; and
• other technical, organizational or legal safeguards.

Nigeria’s NDPA expressly regulates rather than categorically prohibits cross-border transfers and establishes bases and safeguards for lawful transfers.  Where Canadian privacy legislation applies, SmartBallot remains accountable for information under its control when transferred to another organization for processing and will implement measures appropriate to protect that information. 

6.1 International SuperGroup Participation

SuperGroups may include members and authorized administrators located in different countries. The physical location of a user or administrator does not itself determine what personal information that individual may access.

Access is governed by:

• the individual’s role;
• authorization;
• legitimate operational need;
• Platform permissions;
• security controls; and
• applicable law.

Accordingly, an appropriately authorized SuperGroup administrator located outside Nigeria may, where lawful and necessary, access information made available to that administrator for legitimate administration of the relevant SuperGroup. Location outside Nigeria does not provide that administrator with broader access than the role otherwise permits.

7. Data Retention, Supergroup Exit And Deletion

SmartBallot retains personal information only for as long as reasonably necessary to satisfy the purposes for which it was collected, provide requested services or satisfy applicable security, legal, regulatory, accounting, audit or dispute-resolution obligations.

Retention periods may differ depending upon the type of information and purpose.

7.1 Leaving a SuperGroup

Users may voluntarily leave a SuperGroup through available controls within the SuperGroup profile or other designated Platform functionality. When a user exits a SuperGroup, the user’s active membership record and personal information maintained specifically for that user’s active participation in the SuperGroup will be removed or deleted from the active SuperGroup membership system promptly and, where technically implemented, immediately. Leaving a SuperGroup does not necessarily delete the individual’s underlying SmartBallot account or information legitimately processed for unrelated SmartBallot services.

Limited information may be retained where reasonably necessary or legally required for:

• security;
• fraud and abuse prevention;
• financial transactions;
• legal compliance;
• disputes;
• audit requirements;
• enforcement or defence of legal rights; or
• backups awaiting scheduled deletion or overwriting.

SmartBallot will not use retained information for an unrelated purpose merely because the information must temporarily remain in a backup, security or legally required record.

7.2 Rejoining a SuperGroup

If a former member later voluntarily requests to join the same SuperGroup again, the new membership may be processed as a new membership record. Use of the same telephone number, email address or SmartBallot account does not automatically restore a previously deleted active SuperGroup membership record. The new membership remains subject to applicable consent, eligibility and verification requirements.

7.3 Account Deletion

Where available and subject to applicable legal limitations, users may request deletion of their SmartBallot account or applicable personal information through Platform controls or by contacting SmartBallot. SmartBallot will delete, anonymize or securely dispose of personal information when it is no longer reasonably required, subject to applicable lawful retention obligations. PIPEDA specifically requires organizations to limit the collection, use, disclosure and retention of personal information to appropriate purposes.

8. Your Privacy Rights

Depending upon applicable law and the circumstances of the processing, individuals may have rights including:

• the right to be informed about processing;
• the right to request access to personal information;
• the right to request correction or rectification;
• the right to request deletion or erasure;
• the right to restrict certain processing;
• the right to object to certain processing;
• the right to portability where applicable;
• the right to withdraw consent where processing relies upon consent;
• rights relating to certain automated decision-making where applicable; and
• the right to lodge a complaint with an appropriate regulatory authority.

The NDPC identifies rights under the Nigerian framework including information, access, rectification, objection, restriction, portability, erasure and rights regarding automated decision-making. 

Nigeria

Individuals covered by the Nigeria Data Protection Act may exercise applicable rights provided by the NDPA and related regulatory requirements.

Canada

Individuals covered by PIPEDA or applicable provincial privacy legislation may exercise applicable rights including access, correction, withdrawal of consent where appropriate and the ability to challenge compliance.

European Union and United Kingdom

Where the EU GDPR or UK GDPR applies, users may exercise applicable rights established under those regimes.

United States

Where applicable federal or state privacy legislation applies, eligible individuals may exercise rights provided by that legislation, subject to its statutory applicability requirements and exemptions.

Privacy requests may be submitted to: privacy@smartballotapp.com

SmartBallot may take reasonable steps to verify the identity and authority of a requester before fulfilling a request. Requests will be handled within timelines required by applicable law. SmartBallot may decline or limit a request where permitted or required by law and will provide an explanation where legally required.

9. Children’s And Young Persons’ Privacy

SmartBallot is not intended for children below the minimum age legally permitted to independently use the relevant service. Because SmartBallot may provide services to tertiary institutions, some participating students may be minors under the laws applicable to their jurisdiction. Where processing involving a minor requires parental, guardian, institutional or another legally recognized authorization, SmartBallot will implement appropriate measures according to applicable law and the relevant service.

SmartBallot may establish higher or different minimum-age requirements for particular features, including SuperGroups, financial services, civic activities or institutional elections. If SmartBallot becomes aware that personal information of a child has been processed contrary to applicable legal requirements, SmartBallot will take appropriate steps to restrict, correct or delete the information.

10. Data Security And Personal Data Breaches

SmartBallot maintains administrative, technical and organizational safeguards appropriate to the nature, volume, sensitivity and risks associated with personal information under its control.

Safeguards may include:

• encryption in transit;
• encryption at rest where appropriate;
• secure communications protocols;
• authentication controls;
• multi-factor authentication where appropriate;
• role-based access controls;
• least-privilege access;
• administrator authorization controls;
• logging and monitoring;
• vulnerability management;
• secure software-development practices;
• backup and recovery procedures;
• incident-response procedures;
• employee and contractor confidentiality controls; and
• vendor security assessments.

SmartBallot periodically evaluates and updates its security measures as technology, threats, Platform functionality and regulatory requirements evolve. Canada’s PIPEDA requires safeguards appropriate to the sensitivity of the information and protection against loss, theft, unauthorized access, disclosure, copying, use or modification.  No internet-connected system can guarantee absolute security. Where SmartBallot becomes aware of a personal-data breach, SmartBallot will investigate, take appropriate containment and remediation measures, maintain records where required, and provide notifications to affected individuals and competent regulators where required by applicable law. SmartBallot will not represent a service as providing end-to-end encryption unless the applicable technical architecture actually provides end-to-end encryption.

11. Third-party Services And Links

SmartBallot may contain links to or integrations with third-party websites, applications, communications providers, payment providers or other services. Where an independent third party determines the purposes and means of its own processing, that party’s privacy policy and applicable legal responsibilities may apply to that independent processing. SmartBallot is not responsible for independent third-party processing that occurs outside SmartBallot’s control.

However, where a third party processes personal information on behalf of SmartBallot, SmartBallot will implement contractual, security and other safeguards appropriate to SmartBallot’s responsibilities under applicable law. SmartBallot will undertake appropriate due diligence regarding service providers where required, particularly where providers process sensitive or significant quantities of personal information.

12. Changes To This Privacy Policy

SmartBallot may update this Privacy Policy periodically to reflect changes in:

• Platform functionality;
• operations;
• technology;
• security practices;
• applicable law; or
• regulatory requirements.

The current version will be made available through the Platform and will identify its applicable effective or revision date. Where a material change substantially affects the manner in which personal information is collected, used or disclosed, SmartBallot will provide appropriate notice. Where applicable law requires new or additional consent for a materially different purpose, SmartBallot will seek such consent. Continued use of SmartBallot will not be treated as sufficient consent where applicable law requires express, informed or otherwise specific consent.

13. Contact Us And Privacy Governance

Questions, complaints, privacy requests and inquiries concerning personal information may be directed to: 

• Privacy Office / Data Protection Officer, SmartBallot
• Email: privacy@smartballotapp.com
• Canada: Toronto, Ontario, Canada
• Nigeria: Lagos Nigeria. 

SmartBallot will designate appropriate responsibility for overseeing privacy and data-protection compliance and will maintain privacy-management measures appropriate to the nature and scale of its processing activities. Canada’s PIPEDA accountability principle requires organizations to be responsible for personal information under their control and to designate an individual or individuals responsible for compliance.  Where applicable, individuals may also submit complaints to the competent data-protection or privacy authority.

14. Jurisdiction-Specific Disclosures

14.1 Nigeria

Where Nigerian data-protection legislation applies, SmartBallot processes personal information in accordance with the Nigeria Data Protection Act 2023 and applicable regulations, directives, guidance and lawful requirements of the Nigeria Data Protection Commission (NDPC). SmartBallot will apply appropriate technical and organizational safeguards having regard to the nature, sensitivity and risks associated with personal information. Where required by applicable law, SmartBallot may undertake data-protection impact assessments, compliance assessments, appropriate registrations, audits, records of processing or related accountability measures. Individuals may exercise applicable statutory rights and may have the right to lodge a complaint with the NDPC. The NDPC is Nigeria’s current data-protection authority under the NDPA framework.

14.2 Canada

Where PIPEDA applies, SmartBallot will comply with applicable requirements concerning:

• accountability;
• identification of purposes;
• consent;
• limiting collection;
• limiting use, disclosure and retention;
• accuracy;
• safeguards;
• openness;
• individual access; and
• mechanisms for challenging compliance.

These remain the core fair-information principles under Canada’s PIPEDA framework. 

Depending upon the province and circumstances, applicable provincial private-sector privacy legislation may apply instead of, or alongside, PIPEDA. Individuals may have the right to complain to the Office of the Privacy Commissioner of Canada or the applicable provincial regulator.

14.3 European Union

Where the EU GDPR lawfully applies to SmartBallot’s processing activities, SmartBallot will comply with applicable requirements concerning lawful processing, transparency, purpose limitation, data minimization, security, data-subject rights and international transfers. SmartBallot will implement applicable EU transfer safeguards where legally required.

14.4 United Kingdom

Where UK data-protection legislation lawfully applies, SmartBallot will comply with applicable provisions of the UK GDPR and Data Protection Act 2018. Eligible individuals may have the right to complain to the United Kingdom Information Commissioner’s Office.

14.5 United States

Where applicable United States federal or state privacy legislation applies to SmartBallot, SmartBallot will provide applicable notices, protections and individual rights according to the relevant legislation, subject to its thresholds, scope and exemptions. SmartBallot does not represent that every U.S. privacy statute applies to every SmartBallot user merely because the Platform is accessible from the United States.

14.6 Other Jurisdictions

SmartBallot may be accessible from jurisdictions not specifically identified above.

Where another jurisdiction’s privacy or data-protection legislation lawfully applies to a SmartBallot processing activity, SmartBallot will comply with the applicable legal requirements.

References to particular laws in this Privacy Policy do not mean that every listed law applies to every SmartBallot user or every processing activity. Applicability depends upon jurisdiction, statutory scope, the nature of the processing and the surrounding circumstances.

North York, Toronto Canada

Email: jahswill.ukah@smartballotapp.com  

Website: www.smartballotapp.com | Twitter/Instagram: @smartballotapp