Privacy & Data Policy

• We only collect what a form actually needs — usually your name and email.
• Application details are temporary. They exist to run one selection cycle. After the cohort is successfully picked, the personal data of applicants who were not selected is discarded, and selected awardees keep only what their public profile needs.
• We never sell your personal information.
• You can ask us to show, correct or delete your data at any time.

Depending on how you interact with the site, we collect:

• Applications (ambassador, volunteer, nominations): your name, email, organisation and the answers you give on the form — used solely to review your application, contact you about it and run the selection process.
• Awardee cohort applications: collected through Google Forms, so the data is stored with Google and handled under the same review-then-discard approach in section 04.
• Member accounts: name, email, password (stored in hashed form by our authentication provider), invite code and the profile details you choose to add — used to operate your awardee workspace and, once approved, your public directory profile.
• Contact messages: name, email and your message — used to reply to you.
• Magazine downloads: name and email — used to deliver the download and, if you agreed, occasional updates about future releases.
• Newsletter: your email — used only to send the newsletter until you unsubscribe.
• Technical data: anonymised usage analytics and the cookies described in our Cookie Policy.

Every form that stores personal data asks for your explicit consent via a checkbox before you can submit it.

• to review applications and select each year’s cohort;
• to create and operate awardee accounts and public profiles;
• to respond to messages and partnership enquiries;
• to deliver the magazine and, with consent, related updates;
• to send newsletters you subscribed to;
• to keep the platform secure and understand overall usage (aggregate analytics only).

We do not use your personal information for automated decision-making, we do not build advertising profiles, and we do not sell or rent it to anyone.

Our default is short retention. Application data exists to run one selection cycle and no longer:

• While a cycle is open: applications sit in the admin review queue and are visible only to the review team.
• After a successful pick: once a cohort is finalised and announced, the personal details and supporting information of applicants who were not selected are deleted within 60 days of the announcement — from our database and from the review queue.
• If you are selected: only the details needed for your awardee profile and member account are retained, and you review what appears publicly. The rest of your application is discarded on the same schedule.
• Contact messages are kept only as long as needed to resolve your enquiry, then archived or deleted.
• Newsletter and magazine contacts are kept until you unsubscribe or ask us to remove you — every email includes an unsubscribe link.
• Member accounts are kept while your account is active; if you ask us to close it, your profile is removed from the directory and your personal data deleted, except where we must keep a minimal record to meet a legal obligation.

We share personal data only with the service providers that run the platform, and only so they can provide their service to us:

• Supabase — our database and authentication provider (accounts, applications, messages).
• Vercel — website hosting and privacy-friendly, aggregated analytics.
• Brevo — newsletter and transactional email delivery.
• Google Forms — awardee cohort application intake.

These providers may process data outside your country; they each commit to appropriate safeguards under their own terms. Beyond this list, we disclose personal data only if the law requires it. Public awardee profiles are, by design, visible to anyone — but only after selection and with your involvement in what is shown.

Access to applicant and member data is restricted to the admin review team, protected by authenticated, role-based access. Passwords are hashed by our authentication provider and are never visible to us. Data is encrypted in transit. No system is perfectly secure, but if a breach ever affects your personal data we will notify you and the relevant authority as required by law.

Under the Nigeria Data Protection Act (NDPA) and similar laws such as the GDPR, you can at any time:

• ask for a copy of the personal data we hold about you;
• ask us to correct inaccurate information;
• ask us to delete your data (“right to be forgotten”);
• withdraw a consent you previously gave — for example, unsubscribe from emails;
• object to or ask us to restrict a particular use of your data.

Email partnership@top100afl.com with your request and we will respond within 30 days. You also have the right to complain to your data protection authority.

The platform is aimed at undergraduates and young professionals. We do not knowingly collect personal data from anyone under 16. If you believe a child has submitted data to us, contact us and we will delete it promptly.

If we change how we handle personal data, we will update this page and its “Last updated” date, and announce material changes on the site. We will never quietly weaken the discard-after-selection commitment in section 04 — a change to that would be communicated directly to affected applicants.