Who is responsible
The Capital Health Awards (“CHA”, “we”, “us”) is the awards platform responsible for this website and its awards, guest, media, volunteer and partnership activities. CHA determines why and how personal information is processed for these activities and acts as the data controller for Nigerian data-protection purposes.
Operational Secretariat:
Suite C11, Second Floor,
Kenuj O2 Mall, Kaura District,
Games Village, Abuja, Nigeria.
Privacy and general enquiries: thesecretariat@thecapitalhealthawards.com.
Information we handle
- Website and security data: request time, browser/device information, IP address and technical logs normally processed by the hosting infrastructure to deliver and secure the site.
- Nominations: nominator contact details, nominee name and organisation, category, supporting statements, links and permitted evidence files. For the University Laureate Prize, this also includes the invited institution and one-time reference, the authorised official’s role and contact details, the student’s identity/contact and university enrolment details, the nominated work, impact, institutional reference letter and optional supporting evidence.
- Enquiries and partnerships: name, email, enquiry type, message and relevant organisational details.
- Guest RSVP: invitation reference, identity/contact details, attendance and approved plus-one information, plus optional dietary or accessibility information.
- Media accreditation: professional contact details, organisation, role, assignment information, work evidence and limited accreditation documents.
- Volunteer applications: contact details, general location, availability, preferred role, relevant experience and motivation.
- Privacy requests: identity/contact details, request type, correspondence and verification information where genuinely necessary.
- Event media: photographs, film, audio and related event information as described in the Event Photography & Media Notice.
- Device-only information: cookie choices and nomination drafts stored in your browser. A saved draft is not sent to CHA until you submit it.
CHA does not use this website to build advertising profiles, sell personal information or automatically add people to a marketing list. The website is not intended to collect patient records or identifiable confidential health information.
Why we use information and our lawful bases
| Activity | Purpose | Current basis |
|---|---|---|
| Website delivery and security | Provide pages, prevent abuse and investigate technical incidents. | Legitimate interests in operating a secure public website. |
| Nominations | Receive, assess, verify and administer award nominations, including institution-authorised student nominations. | Legitimate interests and the nominator’s requested participation under the Nomination Terms. Authority, accuracy and terms checkboxes are declarations and acknowledgements, not marketing consent. |
| Contact, partnership and sponsorship | Respond to the enquiry and take requested steps toward a relationship or arrangement. | Steps at the requester’s request and/or legitimate interests in correspondence and institutional relationships. |
| RSVP and guest management | Verify invitations, administer attendance, security, protocol and hospitality. | Steps requested by the guest, event administration and legitimate interests. Explicit consent is requested separately for optional dietary/accessibility information where it reveals health-related information. |
| Press and volunteer applications | Assess applications, allocate access or roles, communicate decisions and operate the event. | Steps requested by the applicant and legitimate interests. Explicit consent is requested for optional sensitive accessibility information. |
| Embedded YouTube media | Show a selected film, playlist or soundtrack. | Your affirmative embedded-media choice. Players do not load before that choice. |
| Event photography and film | Event reporting, archive, editorial communication and proportionate promotion. | CHA’s legitimate interests and the public-event context, balanced against attendee rights. Separate releases are used for arranged interviews, testimonials and individual promotional productions where appropriate. |
| Privacy rights and legal records | Answer requests, demonstrate accountability and manage disputes. | Legal obligation and legitimate interests. |
Where CHA relies on consent, it will identify the purpose, record the choice and allow withdrawal without making it harder than giving consent. Withdrawal does not make earlier lawful processing unlawful.
How long information is kept
CHA keeps personal information only for as long as reasonably necessary for the purpose for which it was collected, to meet legal and accountability obligations, or to resolve a live query or dispute. The operational retention schedule below applies to information collected through the website.
| Record | Operational schedule |
|---|---|
| Unsuccessful nominations and supporting evidence | Delete within 12 months after the relevant ceremony, unless needed for a live query, dispute or legal duty. |
| Successful nominee records | Public award, citation and archive records may be preserved as institutional history; non-public contact data and evidence should be reviewed within 24 months after the ceremony. |
| University Laureate code-use ledger | A minimal institution, code digest/reference and use timestamp may be retained after nomination evidence is deleted so a one-time institutional reference cannot be reactivated or reused. |
| Contact and partnership enquiries | 24 months after the last meaningful contact, unless a contract, dispute or continuing relationship requires longer. |
| RSVP/general guest records | 90 days after the event. Optional dietary/accessibility information is scheduled for deletion 30 days after the event. |
| Press applications | Unsuccessful applications and identity evidence: 90 days after the event. Successful accreditation administration: review within 12 months after the event. |
| Volunteer applications | Unsuccessful applications: six months after decision. Selected volunteer administration: review within 24 months after the event. |
| Privacy requests | Three years after closure to demonstrate how the request was handled, unless a legal matter requires longer. |
| Cookie preference record | On the visitor’s device for up to 12 months or until cleared/replaced. |
| Short-lived anti-abuse request hashes | 30 days. |
Security and confidentiality
CHA maintains appropriate technical and organisational safeguards proportionate to the nature of the information processed. These include secure HTTPS transmission, access controls, server-side validation, anti-abuse protections, restricted file types and sizes, non-public evidence storage, controlled reviewer access and safeguards designed to prevent unauthorised use of University Laureate reference codes.
Access to personal information is limited to authorised persons who need it for a legitimate CHA purpose. While no digital service can guarantee absolute security, CHA reviews its safeguards and responds appropriately where a security concern is identified.
Your data-protection rights
Subject to the circumstances and lawful exceptions, the Nigeria Data Protection Act provides rights to be informed; request access; seek correction; request deletion where applicable; restrict or object to certain processing; withdraw consent where consent is relied upon; request portability where applicable; and complain to the Nigeria Data Protection Commission.
Use the Privacy Request page to start a request. CHA will not disclose personal information merely because a requester knows an email address. Identity, authority and scope will be verified proportionately before sensitive information is released or changed.
Contact, grievances and complaints
Email thesecretariat@thecapitalhealthawards.com or use the Privacy Request form. Please write “CHA Privacy Request” in the subject and do not attach identity documents unless CHA asks for a proportionate verification method.
If a concern is not resolved, you may contact or complain to the Nigeria Data Protection Commission. This notice is informed by the Nigeria Data Protection Act 2023 and the NDPC’s Nigeria Data Protection Act General Application and Implementation Directive 2025.