Legal · Privacy
Privacy Policy
Effective Date: June 26, 2026 · Last Updated: June 26, 2026
1. Introduction
TraceQuest ("we," "us," "our," or "the Platform") is committed to protecting the privacy and personal data of all users, applicants, participants, spectators, patrons, sponsors, and visitors to our website and platform. This Privacy Policy explains how we collect, use, store, share, and protect your personal data in compliance with the Nigeria Data Protection Act 2023 (NDPA) and other applicable data protection laws.
By accessing our website, submitting any form, or participating in any TraceQuest event, you acknowledge that you have read, understood, and agree to the terms of this Privacy Policy.
Data Controller: TraceQuest, registered and operating in the Federal Republic of Nigeria.
Contact: hello@tracequest.africa
Data Protection Officer: dpo@tracequest.africa
2. Data We Collect
We collect the following categories of personal data depending on how you interact with our platform:
2.1 Waitlist & General Registration
- Full name
- Email address
- City of residence
- Role preference (Spectator, Seeker, Patron)
- Referral responses
2.2 Seeker Application
- Full legal name (as on government-issued ID)
- Age range
- Email address
- Phone number
- City of residence and local government area
- Social media handles (TikTok, Instagram, X/Twitter)
- Competitive edge descriptions and motivation statements
- Knowledge of event city
- Application video URL (hosted on your own social media account)
- Video platform selection
- Smartphone model
- Data plan and network provider information
- Referral source
2.3 KYC Verification (Selected Participants Only)
- Government-issued identity documents (e.g., National ID, International Passport, Driver's Licence)
- Photographs for identity matching
- Bank account details for prize disbursement
KYC data is collected only from participants who are selected to participate in a TraceQuest event, through a separate, dedicated KYC verification process with its own specific consent mechanism. KYC data is processed by our licensed identity verification service provider under strict data processing agreements.
2.4 Sponsor & Patron Inquiries
- Company name and contact details
- Business email address
- Information voluntarily provided in communications
2.5 Automatically Collected Data
- IP address and approximate geolocation
- Browser type and version
- Device type and operating system
- Pages visited and time spent
- Referring URLs
3. How We Collect Data
- Directly from you: When you fill out forms on our website, submit applications, register for the waitlist, or communicate with us via email.
- From third-party form processing services: We use third-party form submission services to receive and process data you submit through our website forms. These services act as data processors on our behalf.
- Automatically: Through standard web server logs and any analytics tools integrated into our website.
- From publicly available sources: Social media profiles and content you voluntarily make public and link to in your application.
4. Purpose of Data Collection
We process your personal data for the following purposes:
| Purpose |
Legal Basis (NDPA) |
| Processing waitlist registrations |
Consent |
| Evaluating seeker applications |
Consent; Pre-contractual steps |
| Coordinating event logistics and communication |
Contractual necessity; Legitimate interest |
| KYC identity verification of selected participants |
Legal obligation; Contractual necessity |
| Prize disbursement |
Contractual necessity |
| Sending marketing communications (with explicit consent) |
Consent |
| Responding to sponsor and patron inquiries |
Legitimate interest; Pre-contractual steps |
| Ensuring safety and security of participants and events |
Legitimate interest; Legal obligation |
| Complying with legal and regulatory requirements |
Legal obligation |
| Improving our website and services |
Legitimate interest |
5. Third-Party Data Processors
We may share your personal data with the following categories of third-party service providers who process data on our behalf:
- Form Processing Services: We use third-party form submission and handling services to collect and route data submitted through our website forms. These services may be based outside Nigeria, including in the United States.
- Escrow & Payment Service Providers: Licensed Nigerian payment and escrow service providers for prize pool management and disbursement.
- KYC & Identity Verification Providers: Licensed identity verification services for confirming participant identities.
- Cloud Hosting & Infrastructure Providers: For website hosting, data storage, and content delivery.
- Analytics Services: For website usage analysis and performance improvement.
- Communication Services: For sending transactional and marketing emails.
All third-party processors are bound by Data Processing Agreements (DPAs) that require them to protect your data to a standard no less protective than this Privacy Policy and applicable law.
6. Cross-Border Data Transfers
Important: Some of our third-party service providers operate outside the Federal Republic of Nigeria, including in the United States and the European Union. Your personal data may be transferred to, stored in, and processed in jurisdictions outside Nigeria.
Where we transfer personal data outside Nigeria, we ensure that appropriate safeguards are in place, including:
- Data Processing Agreements incorporating Standard Contractual Clauses
- Ensuring the receiving jurisdiction provides an adequate level of data protection as determined by the Nigeria Data Protection Commission (NDPC)
- Obtaining your explicit consent where required
- Implementing additional technical and organizational security measures
By submitting your personal data through our forms, you explicitly consent to the cross-border transfer of your data as described in this section, in compliance with Section 41–44 of the NDPA.
7. Data Retention
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:
| Data Category |
Retention Period |
| Waitlist registration data |
24 months from collection, or until you request deletion |
| Seeker application data (non-selected) |
12 months from the relevant event date |
| Seeker application data (selected participants) |
24 months from the relevant event date |
| KYC identity documents |
As required by applicable Nigerian regulatory requirements (minimum 6 years) |
| Prize and payment records |
7 years (per Nigerian tax and financial regulations) |
| Marketing consent records |
Until consent is withdrawn, plus 12 months for record-keeping |
| Sponsor and patron inquiry data |
24 months from last interaction, or as required by contractual obligations |
| Website usage data |
12 months |
Upon expiry of the retention period, data is securely deleted or anonymized. You may request earlier deletion subject to our legal and regulatory obligations.
8. Your Rights Under the NDPA
Under the Nigeria Data Protection Act 2023, you have the following rights regarding your personal data:
- Right of Access: You may request a copy of the personal data we hold about you.
- Right to Rectification: You may request correction of inaccurate or incomplete personal data.
- Right to Deletion: You may request deletion of your personal data, subject to our legal retention obligations.
- Right to Data Portability: You may request your data in a structured, commonly used, and machine-readable format.
- Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
- Right to Object: You may object to processing based on legitimate interest.
- Right to Restriction: You may request restriction of processing in certain circumstances.
- Right to Lodge a Complaint: You may lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your rights have been violated.
To exercise any of these rights, contact us at dpo@tracequest.africa. We will respond to your request within 30 days.
9. Data Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, including:
- Encryption of data in transit (TLS/SSL)
- Access controls limiting data access to authorized personnel only
- Regular security assessments and audits
- Secure data storage with redundancy and backup
- Incident response procedures for data breaches
In the event of a data breach that poses a risk to your rights and freedoms, we will notify the NDPC and affected individuals within 72 hours of becoming aware of the breach, as required by the NDPA.
10. Children's Data
TraceQuest is not directed at individuals under the age of 18. We do not knowingly collect personal data from children under 18. All applicants must be 18 years or older. If we become aware that we have collected personal data from a child under 18, we will take steps to delete such data promptly.
11. Cookies & Tracking Technologies
Our website uses minimal cookies and tracking technologies:
- Essential Cookies: Required for basic website functionality (e.g., session management for password-protected pages).
- Third-Party Font Services: We use external font delivery services which may set cookies on your device for performance and caching purposes.
We do not currently use advertising cookies, retargeting pixels, or invasive tracking technologies. If this changes, we will update this policy and obtain your consent where required.
12. Marketing Communications
We will only send you marketing communications (including event updates, promotional content, and partner offers) if you have provided explicit opt-in consent for such communications.
You may withdraw your marketing consent at any time by:
- Clicking the "unsubscribe" link in any marketing email
- Emailing us at hello@tracequest.africa with the subject "Unsubscribe"
Withdrawal of marketing consent does not affect transactional communications related to your application, participation, or account.
13. Third-Party Links & Platforms
Our website may contain links to third-party websites and social media platforms. We are not responsible for the privacy practices of these external sites. We encourage you to read the privacy policies of any third-party services you interact with.
When you submit an application video via your social media account, that video remains hosted on the relevant social media platform and is subject to that platform's terms and privacy policy. TraceQuest does not host or store your application videos.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:
- Update the "Last Updated" date at the top of this page
- Post a prominent notice on our website
- Where required, notify you by email if you have provided one
Your continued use of our website or services after any changes constitutes acceptance of the updated Privacy Policy.
15. Governing Law
This Privacy Policy is governed by and construed in accordance with the laws of the Federal Republic of Nigeria, including the Nigeria Data Protection Act 2023 (NDPA). Any disputes arising under this policy shall be resolved through the mechanisms specified in our Terms of Service.
16. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact us:
General Inquiries: hello@tracequest.africa
Data Protection Officer: dpo@tracequest.africa
Postal Address: TraceQuest, Abuja, Federal Capital Territory, Nigeria
Supervisory Authority: Nigeria Data Protection Commission (NDPC),
ndpc.gov.ng