Privacy Policy

1 Who we are

Legis360 is an independent parliamentary-monitoring platform and policy think tank that helps the public follow the work of Nigeria's legislatures. For the purposes of the NDPA, Legis360 is the data controller responsible for the personal data processed through this website and its related services.

You can reach our Data Protection contact using the details in the Contact us section below.

2 Legal framework

We process personal data in accordance with the NDPA, the Nigeria Data Protection Act (General Application and Implementation) Directive, and, where still relevant, the Nigeria Data Protection Regulation, 2019 (NDPR). We process data lawfully, fairly, and transparently, and only for the specific purposes set out in this Policy.

3 Personal data we collect

Information you give us

• Account data — your first and last name, email address, occupation/role, and a securely hashed password when you register.
• Content you submit — messages you send to legislators or other users, posts, comments, and any information you include in correspondence with us.

Information we collect automatically

• Technical data — your IP address, browser type and user-agent, and similar device information.
• Usage and activity data — records of actions you take on the platform (for example, sign-ins, bills or members you view), kept in an activity log to operate and secure the service.
• Cookies — a session cookie that keeps you signed in (see Cookies).

Information from third parties

• Email-validation — at sign-up we check whether an email address is disposable using a third-party validation service, to reduce fraudulent or throwaway registrations.

We do not intentionally collect special categories of personal data (sensitive data) such as health, religious, or biometric data through ordinary use of the platform.

4 How and why we use your data

Under section 25 of the NDPA, we must have a lawful basis for each processing activity. We rely on the following:

• To create and manage your account, and verify your email — performance of our agreement with you and your consent.
• To provide core features (legislative tracking, messaging, alerts) — performance of our agreement with you.
• To secure the platform, prevent abuse and fraud, and maintain activity logs — our legitimate interests in keeping the service safe and reliable.
• To send service and verification emails — performance of our agreement and your consent.
• To comply with legal obligations and respond to lawful requests — compliance with a legal obligation.
• To improve and understand use of the platform — our legitimate interests, balanced against your rights.

Where we rely on consent, you may withdraw it at any time without affecting processing carried out before withdrawal.

5 Cookies and similar technologies

We use a strictly necessary session cookie to keep you logged in and to protect forms against cross-site request forgery. These cookies are essential for the platform to function and do not track you across other websites. You can control cookies through your browser settings, but disabling essential cookies may prevent you from signing in.

6 Sharing and disclosure

We do not sell your personal data. We share it only as follows:

• Service providers (data processors) who act on our instructions — for example, our hosting provider, our transactional-email provider, and our email-validation provider. They are bound by contract to protect your data and use it only for the services they provide to us.
• Other users, where you choose to interact — for example, the recipient of a message you send sees the content you submit.
• Legal and regulatory authorities where disclosure is required by law or to establish, exercise, or defend legal claims.

7 International transfers of data

Some of our service providers may store or process data outside Nigeria. Where personal data is transferred abroad, we do so in accordance with Part VIII of the NDPA — that is, to a jurisdiction or recipient that provides an adequate level of protection, or under appropriate safeguards, or where another lawful basis for the transfer applies.

8 How long we keep your data

We retain personal data only for as long as necessary for the purposes set out in this Policy, or as required by law. Account data is retained while your account is active; if you delete your account, we will delete or anonymise your personal data within a reasonable period, except where we are required to retain it (for example, security logs or legal records).

9 How we protect your data

In line with section 39 of the NDPA, we apply appropriate technical and organisational measures to protect personal data, including encryption of traffic in transit, hashing of passwords, access controls, and protection against unauthorised access, loss, or alteration. No method of transmission or storage is completely secure, but we work to safeguard your information and to continually improve our measures.

10 Your rights as a data subject

Subject to the conditions and exceptions in the NDPA, you have the right to:

• Be informed about how your data is processed (this Policy);
• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your data ("right to be forgotten") where applicable;
• Restrict or object to certain processing;
• Data portability — receive your data in a structured, commonly used format;
• Withdraw consent at any time where processing is based on consent; and
• Not be subject to a decision based solely on automated processing that significantly affects you.

To exercise any of these rights, contact us using the details below. We will respond within the timeframe required by the NDPA.

11 Children's privacy

Legis360 is intended for adults and is not directed at children under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

12 Data breaches

If a personal-data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the NDPC within 72 hours of becoming aware of it, as required by section 40 of the NDPA, and will inform affected individuals where the breach is likely to result in a high risk to them.

13 Ilimi and messaging channels

Ilimi is our legislative assistant. You can use it on this website, on Telegram, and on WhatsApp. What we receive and keep depends on the channel you choose.

What we receive. When you message Ilimi we receive the text of your question. On WhatsApp, Meta Platforms Ireland Limited also passes us the phone number you are messaging from, together with your WhatsApp profile name. On Telegram we receive your chat identifier.

What we keep, and what we deliberately do not. We keep the text of your question, the date and time, the channel, and technical measurements such as how long the answer took and which records were consulted. We do not store your phone number or chat identifier. They are converted into an irreversible salted hash before anything is written down, so our records cannot be traced back to your number. We do this so that we can measure which topics the public is asking about without building a record of who asked what.

Conversation memory. So that follow-up questions make sense, Ilimi holds the last few turns of your conversation in temporary memory for up to 30 minutes of inactivity, after which it is discarded. This short-term memory is keyed to your channel identifier and is never written to permanent storage.

Who else is involved. Your question is sent to OpenAI to generate an answer, and on WhatsApp your message reaches us through Meta's WhatsApp Business Cloud API, which is subject to Meta's own privacy policy. Ilimi reads Nigerian legislative records that we hold ourselves; those are public records, not personal data about you.

How long. Question text is deleted automatically after 180 days. Aggregated, non-identifying counts may be kept for longer to report on which policy areas the public asks about.

What Ilimi is not. Ilimi provides legislative information, not legal advice, and does not make decisions about you.

14 Deleting your data

You can ask us to delete the data we hold about you at any time, and we will do so without charge.

• Ilimi on WhatsApp or Telegram. Send the message DELETE to the same chat, or email us from any address at [email protected] with the phone number or chat you used. Because we store only an irreversible hash of your identifier, we need you to tell us which one to match.
• Your Legis360 account. Email [email protected] and we will delete the account and associated personal data.
• Anything else. Contact our Data Protection contact in section 16 below.

We will action deletion requests within 30 days, in line with the Nigeria Data Protection Act, 2023. We may retain the minimum records required by law, and any aggregated statistics that can no longer be linked to you.

15 Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices or the law. We will revise the "Last updated" date above and, where changes are material, take reasonable steps to notify you.

16 Contact us

For any privacy question, or to exercise your rights, please contact our Data Protection contact:

See also our Terms of Use.