Your rights

4.1 Overview

This Section sets out the rights you have over the personal data we hold about you. The precise rights available depend on your jurisdiction. Where multiple regimes apply, we apply the rule that affords you the strongest protection.

4.2 Rights under the Nigeria Data Protection Act 2023

If you are physically present in Nigeria or are a Nigerian citizen, you have:

• (a) Right to be informed - to know what personal data is collected and why (NDPA § 34);
• (b) Right of access - to obtain a copy of the personal data we hold about you (NDPA § 35);
• (c) Right to rectification - to correct inaccurate or out-of-date personal data (NDPA § 36);
• (d) Right to erasure - to require deletion of personal data, subject to overriding legal obligations (NDPA § 37);
• (e) Right to restriction - to limit how we process your data while a dispute is resolved (NDPA § 38);
• (f) Right to data portability - to receive your data in a structured, commonly-used, machine-readable format (NDPA § 39);
• (g) Right to object - to object to processing based on legitimate interests, including profiling (NDPA § 40);
• (h) Right not to be subject to automated decisions - including profiling, where they produce legal or similarly significant effects (NDPA § 41);
• (i) Right to withdraw consent - at any time, without affecting prior processing.

4.3 Rights under the GDPR / UK GDPR

Where you are physically present in the EEA, the United Kingdom, or Switzerland, you have the rights at Articles 15–22 GDPR / UK GDPR, which substantially mirror the NDPA rights set out above. In addition, you have the right to lodge a complaint with your local supervisory authority. A non-exhaustive list:

• Ireland - Data Protection Commission (DPC);
• United Kingdom - Information Commissioner's Office (ICO);
• Germany - the relevant Land-level Datenschutzbehörde;
• France - Commission Nationale de l'Informatique et des Libertés (CNIL);
• Italy - Garante per la protezione dei dati personali.

4.4 Rights under the CCPA / CPRA

California residents have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, including:

• The right to know what categories of personal information we have collected;
• The right to delete personal information, subject to lawful exceptions;
• The right to correct inaccurate personal information;
• The right to opt out of the sale or sharing of personal information;
• The right to limit the use of sensitive personal information;
• The right to non-discrimination for exercising any of the foregoing rights.

We do not sell or share personal information for cross-context behavioural advertising. We have not done so in the preceding twelve (12) months and have no plans to do so.

4.5 How to exercise your rights

To exercise any right, send a written request to contact@peterobi.supportwith the subject line “Data Subject Request” and the following information:

1. The right you wish to exercise and the basis on which you do so;
2. Sufficient information to identify your records (typically the email or order ID associated with the contribution, or a description of the dataset);
3. A copy of a valid identity document, redacted as you see fit, but sufficient to satisfy us that the request is genuine.

We respond to verifiable requests within thirty (30) calendar days, extendable by a further sixty (60) days where the request is complex or numerous, in accordance with NDPA § 36 and Article 12(3) GDPR.

4.6 Limits to your rights

We may decline a request, in whole or in part, where:

• We cannot verify your identity to the standard required by law and reasonable fraud-prevention practice;
• The request is manifestly unfounded, repetitive, or excessive (in which case we may charge a reasonable administrative fee);
• Compliance would compromise the Campaign's ability to comply with the Compliance Acts (see Section 3);
• Compliance would prejudice the establishment, exercise, or defence of legal claims;
• Compliance would infringe the rights and freedoms of others (for example, in records that mention third-party donors).

Where we decline, we will tell you the reason and your right of recourse to the relevant supervisory authority.

4.7 Appeals and complaints

If you are dissatisfied with our response, you may:

1. Request internal review by writing to contact@peterobi.supportwith the subject line “DSR Appeal”;
2. Lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng;
3. If you are in the EU/UK, lodge a complaint with your local supervisory authority;
4. If you are in California, file with the California Privacy Protection Agency or the Attorney General.