17th Annual General Meeting and Scientific Conference of the Nigerian Infectious Diseases Society (NIDS 2026)

Website: https://nids2026.org.ng

Effective date: 1^st July, 2026     |     Version 1.0

This Privacy Policy explains how Irrua Specialist Teaching Hospital, Irrua, Edo State and Nigerian Infectious Diseases Society (“ISTH”, “we”, “us” or “our”), acting through the NIDS 2026 Planning Committee, collects, uses, discloses, retains and protects your personal data when you use the website at https://nids2026.org.ng (the “Website”) and when you register for, submit materials to, or participate in the 17th Annual General Meeting and Scientific Conference of the Nigerian Infectious Diseases Society (“NIDS 2026” or the “Conference”).

We are committed to protecting your privacy and to processing your personal data in accordance with the Nigeria Data Protection Act, 2023 (“NDPA”) and the guidance and regulations issued by the Nigeria Data Protection Commission (“NDPC”). This Policy should be read together with our Terms and Conditions.

1.  Who We Are — The Data Controller

For the purposes of the NDPA, the data controller responsible for your personal data is Irrua Specialist Teaching Hospital, acting through the NIDS 2026 Planning Committee (the “Secretariat”). Where we jointly determine the purposes of processing with the Nigerian Infectious Diseases Society, we act as joint controllers in respect of Conference records. Our contact details for privacy matters are set out in clause 12.

2.  Scope of this Policy

This Policy applies to personal data we collect through the Website and in connection with the Conference, whether you are a prospective or registered Delegate, an author or co-author of an Abstract, a member of a committee, or any other individual who interacts with us through the Website. It does not apply to third-party websites or services that we do not control, even where we link to them.

3.  Personal Data We Collect

We collect and process the following categories of personal data:

You are not obliged to provide personal data, but if you do not provide the data marked as required on the Website, we may be unable to process your registration, verify your student status, process your payment, or consider your Abstract.

4.  How and Why We Use Your Data — Lawful Bases

Under the NDPA we must have a lawful basis for processing your personal data. We rely on the following bases, depending on the purpose:

Specifically, we use your personal data to: process and confirm your registration and payment; verify undergraduate student eligibility; issue your registrant identification number; receive, code, review and communicate decisions on Abstracts; notify Scientific Committee members and the Secretariat of relevant registrations and submissions; send you administrative and Conference-related communications; produce the book of abstracts and Conference records; maintain the security and integrity of the Website; and comply with our legal obligations.

5.  Sensitive Personal Data

We do not seek to collect sensitive personal data as defined under the NDPA. However, information you volunteer — for example dietary or accessibility needs — may indirectly reveal health or religious information. Where you provide such information, you consent to our using it solely to accommodate your needs at the Conference. Please do not submit sensitive personal data that is not necessary for your participation.

6.  Disclosure of Your Data

We do not sell your personal data. We disclose it only as follows, and only to the extent necessary:

•     Committee and Secretariat: to authorised members of the NIDS 2026 Planning Committee, the Secretariat, the Scientific Committee, and the Conference Accountant, strictly on a need-to-know basis and according to their role, to administer registration, verification, payments and Abstract review.

•     The Nigerian Infectious Diseases Society: as joint organiser, for the purpose of compiling and maintaining Conference records and proceedings.

•     Payment Processor: Flutterwave, to process payments. Flutterwave processes your payment data as an independent controller under its own privacy policy.

•     Service providers (data processors): our website host, email-delivery provider, and similar service providers who process data on our behalf under written instructions and appropriate confidentiality and security obligations.

•     Legal and regulatory authorities: where required by law, court order, or a lawful request from a competent authority, or to establish, exercise or defend legal claims.

•     Successors: in connection with any reorganisation or transfer of the functions of the Committee, subject to the protections of this Policy.

7.  Data Processors and Contracts

Where we engage third parties to process personal data on our behalf, we put in place data-processing agreements as required by the NDPA, obliging them to process personal data only on our instructions, to keep it secure and confidential, and to assist us in meeting our obligations to you.

8.  International Transfers

Some of our service providers, including our Payment Processor and cloud or email providers, may process personal data on servers located outside Nigeria. Where personal data is transferred outside Nigeria, we take steps to ensure that the transfer complies with the NDPA — for example, by transferring only to jurisdictions or recipients that provide an adequate level of protection, by relying on appropriate safeguards or contractual protections, or, where permitted, on the basis of your consent or the necessity of the transfer for the performance of our contract with you.

9.  Cookies and Similar Technologies

The Website uses cookies and similar technologies to enable core functionality (such as maintaining your session and processing your registration and payment), to remember your preferences, and, where applicable, to understand how the Website is used and to improve it. Strictly necessary cookies do not require your consent; other cookies are set only where permitted by your browser settings or where you consent. You can control or delete cookies through your browser settings, although disabling certain cookies may affect the functionality of the Website.

10.  Data Retention

We retain your personal data only for as long as necessary for the purposes for which it was collected, including to satisfy any legal, accounting, academic-record or reporting requirements. As a guide: registration and payment records are retained for the period required by applicable tax and accounting law; Abstracts and accepted presentation materials are retained as part of the permanent academic record of the Conference; and student identification documents are retained only for as long as necessary to complete verification and to resolve any related query, after which they are securely deleted or anonymised. When personal data is no longer required, we delete, destroy or irreversibly anonymise it.

11.  Your Rights Under the NDPA

Subject to the conditions and exemptions in the NDPA, you have the following rights in respect of your personal data:

•     Right to be informed — to be told how your personal data is collected and used, as set out in this Policy.

•     Right of access — to request confirmation of whether we process your personal data and to obtain a copy of it.

•     Right to rectification — to have inaccurate or incomplete personal data corrected or completed.

•     Right to erasure — to request deletion of your personal data where there is no lawful basis for us to continue processing it.

•     Right to restrict processing — to request that we limit our processing in certain circumstances.

•     Right to object — to object to processing based on our legitimate interests, and to object to direct marketing at any time.

•     Right to data portability — to receive certain personal data in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible.

•     Right to withdraw consent — where we rely on your consent, to withdraw it at any time, without affecting the lawfulness of processing before withdrawal.

•     Right to lodge a complaint — to complain to the Nigeria Data Protection Commission (see clause 13).

To exercise any of these rights, contact us using the details in clause 12. We will respond within the timeframe required by the NDPA. We may need to verify your identity before acting on your request. Exercising your rights is free of charge, save that we may charge a reasonable fee, or decline to act, where a request is manifestly unfounded, excessive or repetitive, as permitted by law.

12.  Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. These measures include access controls restricting data to authorised committee roles, use of a reputable hosting provider, encryption in transit where supported, and reliance on our Payment Processor for the secure handling of payment credentials. While we take reasonable steps to protect your data, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the NDPC and, where required, affected individuals, in accordance with the NDPA.

13.  How to Contact Us and the Regulator

If you have any question, request or complaint about this Policy or about how we handle your personal data, please contact the Secretariat of the NIDS 2026 Planning Committee:

•     Email (Secretariat / privacy matters): support@nids2026.org.ng

•     Email (Abstract matters): abstract@nids2026.org.ng

•     Data Controller: Irrua Specialist Teaching Hospital, Irrua, Edo State, Nigeria.

If you are not satisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC), the supervisory authority for data protection in Nigeria, whose current contact details are published at https://ndpc.gov.ng. We would, however, appreciate the opportunity to address your concerns before you approach the NDPC.

14.  Children

The Website and the Conference registration process are intended for adults. We do not knowingly collect personal data from children below the age of majority without appropriate parental or guardian consent. Undergraduate students who register must be of the applicable age of majority or must obtain the necessary consent. If you believe we have inadvertently collected data from a child without proper consent, please contact us so that we can take appropriate action.

15.  Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices or in the law. We will publish the revised Policy on the Website with an updated effective date, and, where the changes are significant, we will take reasonable steps to bring them to your attention. Your continued use of the Website after publication constitutes acceptance of the updated Policy.

By using the Website and registering for NIDS 2026, you acknowledge that you have read and understood this Privacy Policy.