Effective date: March 27, 2026
Last updated: May 28, 2026

1. Introduction to Our Privacy Policy

This Privacy Policy explains how Peter King ("we," "us," or "our") collects, uses, shares, and protects personal information when you visit https://olufemijamesurrah.com (the "Site") or interact with us through the Site, including through our social media channels linked from it.

We respect your privacy and handle your information in line with applicable laws, including the Nigeria Data Protection Act 2023 (NDPA), the EU/UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and other applicable U.S. state privacy laws. By using the Site, you acknowledge that you have read this Policy. If you do not agree with it, please do not use the Site.

Data controller: Peter King. Contact: info@olufemijamesurrah.com.

2. Information We Collect

2.1 Information You Give Us

• Contact details and messages: name, email address, phone number, and the content of any message you send through a contact form, email, or direct message.
• Email or SMS sign-ups: name, email address, phone number, and communication preferences when you subscribe to updates or newsletters.
• Volunteer, supporter, or event registrations: name, contact details, location (such as ward, local government area, or state), and any information you choose to include.
• Donations or payments (if enabled): billing details are processed by third-party payment providers; we generally receive only confirmation, amount, and limited identifying details, not full card numbers.
• Accounts (if enabled): username, password (stored in hashed form), and profile details.
• Comments and submissions: anything you post publicly or submit to us, including feedback and survey responses.

2.2 Information Collected Automatically

• Device and technical data: IP address, browser type and version, operating system, device type, screen resolution, and language settings.
• Usage data: pages viewed, time spent, links clicked, referring website, and approximate location derived from your IP address.
• Cookie and similar technology data: see Section 6 and our Cookie Policy.

2.3 Information From Third Parties

We may receive information from analytics providers, email or messaging platforms, social media platforms (if you interact with our pages or log in through them), and payment processors.

2.4 Sensitive Information

We do not ask you to provide sensitive personal information (such as health, ethnicity, religion, or biometric data). However, because this Site relates to political and public-service activity, information that shows your political opinions or support, for example by signing up as a supporter or volunteer, may be considered sensitive under the NDPA and GDPR. We collect this only with your explicit consent and use it only for the purposes you agree to. Please do not send us sensitive information unless it is needed for what you are asking us to do.

3. How We Use Your Information

We use personal information to:

• Operate, maintain, and improve the Site and its content;
• Respond to your enquiries, requests, and feedback;
• Send newsletters, campaign updates, event invitations, and other communications you have asked for or consented to;
• Organize volunteers, supporters, and events;
• Process donations or payments, where offered;
• Understand how visitors use the Site through analytics and measure the reach of our communications;
• Detect, prevent, and respond to fraud, abuse, security incidents, and technical problems;
• Comply with legal obligations, including electoral, tax, and record-keeping laws, and enforce our terms.

3.1 Legal Bases (GDPR and NDPA)

• Consent: for email/SMS marketing, non-essential cookies, and any sensitive information. You may withdraw consent at any time.
• Contract or pre-contract steps: where we need your data to provide something you requested (for example, account features or event registration).
• Legitimate interests: to run and secure the Site, respond to enquiries, and understand and improve engagement, balanced against your rights and interests.
• Legal obligation: where the law requires us to process or retain information.

We do not use your personal information for solely automated decision-making that produces legal or similarly significant effects on you.

4. How We Share Information

We do not sell your personal information. We also do not "share" it for cross-context behavioral advertising, as those terms are defined under the CCPA. We disclose information only as follows:

• Service providers and processors: hosting, website, analytics, email/SMS delivery, form, payment, and IT support providers who process data on our behalf under contractual confidentiality and data protection obligations.
• Campaign, organizational, or event partners: only where needed to deliver an event or activity you registered for, and only where you have been told or have consented.
• Legal and safety reasons: to comply with law, court orders, or lawful requests from regulators or authorities; to protect our rights, property, or safety, or that of others; or to investigate fraud or security issues.
• Business changes: if our operations or the Site are reorganized, transferred, or wound down, information may be transferred subject to this Policy.
• With your direction or consent: for example, where you ask us to introduce you to someone.
• Aggregated or de-identified data: which cannot reasonably identify you, may be shared for reporting or analysis.

4.1 International Transfers

We are based in Nigeria, and our service providers may be located in other countries, including the United States and the European Economic Area. Where your information is transferred across borders, we use safeguards recognized by applicable law, such as adequacy determinations, standard contractual clauses, or your consent, to protect it.

5. Your Rights and Choices

5.1 Rights for All Users

Depending on where you live, you may have the right to:

• Access the personal information we hold about you and receive a copy;
• Correct inaccurate or incomplete information;
• Delete your information, subject to legal exceptions;
• Restrict or object to certain processing, including processing based on legitimate interests and direct marketing;
• Data portability: receive your data in a structured, commonly used, machine-readable format;
• Withdraw consent at any time, without affecting prior lawful processing;
• Not be discriminated against for exercising your rights.

5.2 California Residents (CCPA/CPRA)

Categories collected in the past 12 months

Identifiers (name, email, phone, IP address); internet or network activity (browsing and interaction data); approximate geolocation; and any other information you submit voluntarily. We collect these for the purposes in Section 3 and disclose them to the categories of recipients in Section 4.

Your California rights

You have the right to know, delete, and correct your personal information, and to opt out of its sale or sharing. We do not sell or share personal information, including that of minors under 16. We do not use sensitive personal information to infer characteristics or for purposes beyond those permitted by law. We honor recognized opt-out preference signals such as Global Privacy Control where technically feasible. You may use an authorized agent to submit a request; we may ask for proof of authorization and to verify your identity.

5.3 Residents of Other U.S. States

Residents of states with comprehensive privacy laws (such as Virginia, Colorado, Connecticut, and Texas) may have similar rights of access, correction, deletion, portability, and opt-out of targeted advertising, sale, and profiling. If we decline a request, you may appeal by replying to our decision, and we will respond within the time required by law.

5.4 Nigeria, the European Economic Area, and the UK

You may exercise your rights under the NDPA or GDPR as described above. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC), or with your local supervisory authority in the EEA or UK.

5.5 How to Exercise Your Rights

Email info@olufemijamesurrah.com with the subject line "Privacy Request" and tell us what you want to do. We may need to verify your identity. We will respond within one month (GDPR/NDPA) or 45 days (CCPA), extendable where the law allows. There is no charge unless a request is manifestly unfounded or excessive.

5.6 Marketing Opt-Out

You can unsubscribe from emails at any time using the "unsubscribe" link in any message, or by replying "STOP" to SMS messages. You may still receive essential non-marketing messages.

6. Cookies and Tracking Technologies

We and our providers use cookies, pixels, local storage, and similar technologies to make the Site work, remember your preferences, and understand how the Site is used. Where the law requires it, non-essential cookies are placed only after you consent, and you can change your choices at any time through the cookie settings on the Site or in your browser. We respond to Global Privacy Control signals. Because there is no uniform standard for "Do Not Track" browser signals, we do not respond to them except as stated here.

For the categories of cookies we use, the third parties involved, and step-by-step ways to manage them, please read our Cookie Policy.

7. Data Security

We use reasonable technical and organizational measures to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. These include HTTPS encryption, access controls, and vetted service providers. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please use strong, unique passwords and do not send confidential information by unsecured means. If a breach occurs that is likely to harm your rights or freedoms, we will notify you and the relevant authorities as required by law, including the NDPC within the applicable timeframe.

8. Data Retention

We keep personal information only as long as needed for the purposes in this Policy, or as required by law:

• Enquiries and messages: generally up to 24 months after our last interaction;
• Mailing list and supporter data: until you unsubscribe or withdraw consent, or we stop the relevant activity;
• Analytics data: typically 14 to 26 months;
• Financial or legal records: for the period required by tax, electoral, or other laws.

When information is no longer needed, we delete or anonymize it. Backups may retain it for a short additional period before being overwritten.

9. Third-Party Links and Services

The Site may link to third-party websites, social platforms, and services. We do not control them and are not responsible for their privacy practices. Please read their policies before providing personal information.

10. Children's Privacy

The Site is intended for a general audience and is not directed to children under 16 (or under 18 where local law defines a child at that age, including in Nigeria). We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it promptly.

11. Limitation of Liability

To the fullest extent permitted by law, we are not liable for indirect, incidental, or consequential damages arising from your use of the Site or from unauthorized access to information despite our reasonable safeguards. Nothing in this Policy excludes liability that cannot be excluded under applicable law, or limits your statutory rights.

12. Contact Information

For questions, concerns, or requests about this Policy or your personal information, contact:

Peter King
Email: info@olufemijamesurrah.com

13. Updates to This Policy

We may update this Policy from time to time to reflect changes in our practices, technology, or the law. The "Last updated" date at the top shows when it was last revised. If changes are material, we will provide a prominent notice on the Site or contact you directly where required. Your continued use of the Site after an update means you accept the revised Policy, except where the law requires your fresh consent.