Privacy notice
This says what happens to the information you give this website, in plain terms. It is written to meet the Nigeria Data Protection Act 2023. Last updated 22 August 2026.
Who is responsible
The data controller is the University of Lagos, acting through the Conference Planning Committee Secretariat for the 19th University of Lagos Annual Research Conference. That means the University decides what is collected and why, and answers for it.
Conference Planning Committee (CPC) SecretariatResearch Management Office, behind the Ade Ajayi AuditoriumUniversity of Lagos, Akoka, YabaLagos, Nigeriaunilagconf@unilag.edu.ng · +234 704 201 5134What is collected, and why
Only what the conference actually needs. Each row says what we take, what it is for, and what entitles us to hold it.
| What | Why | Lawful basis |
|---|---|---|
| Your name, email address, phone number and institution | To register you, to write to you about your registration, and to know who is at the conference. | Performance of a contract: you asked us to register you. |
| Your country of residence | So that international delegates can be sent visa letters and dial-in details. | Performance of a contract. |
| Your student number and institutional email address, if you claim a student rate | To check that the reduced fee is properly claimed, before it is granted rather than after you have paid. | Performance of a contract. Only collected if you select a student category. |
| Your payment reference, the amount you say you paid, the date on your receipt, and the receipt itself | To match your payment against the conference account and confirm your place. | Performance of a contract, and our legal obligation to keep proper financial records. |
| Your abstract or paper, and the details of its authors | To review it and, if accepted, to place it in the programme. | Performance of a contract. |
| Whether you agreed to appear on the public delegate list | So that your name is published only if you asked for it to be. | Consent, which you can withdraw at any time. |
| The IP address a form was submitted from | To rate limit the forms. Without it, the site can be flooded by anyone with a script. | Legitimate interest in keeping the site working. |
Your card details
This site never sees your card. Payment is made on the University of Lagos payment portal, operated by Remita, and card details are entered there. Nothing about your card reaches this website, and none of it is stored here.
Who else sees it, and where it is held
Running a website means using other people’s computers. These are the only organisations involved, what each one does, and which country the data sits in. Most of them are outside Nigeria, which the Act permits so long as you are told, and this is us telling you.
| Who | What they do | Where |
|---|---|---|
| Vercel | Runs the website itself | European Union (Frankfurt), pinned in vercel.json |
| Neon | Holds the database of registrations and payments | European Union |
| Cloudinary | Stores uploaded receipts and logos | European Union |
| Google (Gmail) | Delivers the emails the Secretariat sends you about your registration | United States and the European Union |
| Google Maps | Draws the venue map on the contact page, and only if you press the button asking for it | United States and the European Union |
| Remita and Tranzgate | Take the payment on the university's behalf. Payment happens on their systems, not ours | Nigeria |
Your data is never sold, and it is never given to anyone for marketing. Your name appears on the public delegate list only if you ticked the box asking for it.
Why it may lawfully be held outside Nigeria
The application and the database both run inside the European Union, in Frankfurt, and uploaded receipts are stored in the European Union as well. The EU's data protection regime is among the strictest in the world, which is the adequacy section 41 is concerned with.
The transfer is also necessary to perform the contract you entered into when you registered. The conference cannot register you, take your payment or issue your certificate without processing your details somewhere, and this is where.
The site was moved to Frankfurt deliberately. It previously ran in the United States while the database sat in Frankfurt, which put two jurisdictions in the path of every query instead of one, and sent every lookup across the Atlantic and back.
Payment itself never leaves Nigeria. Remita and Tranzgate handle it on the University's own portal, so card details are processed in Nigeria under Nigerian rules and never reach this site at all.
If the University later requires this data to be held in Nigeria, it can be moved. Nothing here depends on a particular provider and the database is ordinary PostgreSQL.
How long it is kept
| What | How long | Why that long |
|---|---|---|
| Registration and payment records | Six years after the conference | Financial records supporting a university account have to be available for audit. |
| Uploaded receipts | Six years after the conference | They are the evidence behind a payment record, and are useless separated from it. |
| Abstracts and papers | Indefinitely, as part of the conference proceedings | The proceedings are a permanent scholarly record. Author names stay attached to their work. |
| Certificates | Indefinitely | A certificate must remain verifiable years later, which is the point of issuing one. |
| Rate limiting records | Cleared automatically once the window passes | They serve no purpose after that. |
Cookies
The public pages of this site set no cookies at all. There is no analytics, no advertising and no third-party tracking. The Secretariat's own dashboard sets one cookie so that staff stay signed in; it does nothing else and is deleted when they sign out.
The map on the contact page
The contact page offers a map of the venue, which comes from Google. It is not loaded until you press the button asking for it. If you do, Google sets its own cookies and can see that you requested the map, under Google's terms rather than ours. If you would rather not, the direction links beside it open Google or Apple Maps in a new tab and load nothing into this page.
What you can ask for
- Ask what personal data we hold about you, and get a copy of it.
- Have anything inaccurate corrected.
- Ask us to delete your data, where we are not required to keep it.
- Object to processing that rests on our legitimate interest.
- Withdraw consent, where consent is what we relied on. Taking your name off the public delegate list takes effect immediately and does not affect your registration.
- Ask for your data in a portable form.
- Complain to the Nigeria Data Protection Commission if you think we have got this wrong.
Write to unilagconf@unilag.edu.ng with your registration reference. We will answer within 30 days. There is no charge.
If something goes wrong
If personal data held for this conference is ever exposed, the University will report it to the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and will tell the people affected directly where the risk to them is significant.
You can also complain directly to the Nigeria Data Protection Commission, which regulates this and does not need our permission to hear from you.
Questions about any of this go to the Secretariat, at unilagconf@unilag.edu.ng. See also our contact page.