Privacy Policy

wehna is a community-management platform for associations, alumni groups, cooperatives, professional bodies, student unions, town development associations, and savings circles across Nigeria and Africa. It is operated by Innovelox Ltd. (“we”, “us”, “our”). This Privacy Policy explains how we collect, use, share, store, and protect personal data in connection with the wehna platform, its public association pages, and our website.

We are committed to handling your data transparently and responsibly, in line with the Nigeria Data Protection Act, 2023 (NDPA) and other applicable Nigerian data protection law.

This registration is maintained under section 44 of the NDPA, covering Innovelox Ltd.'s role as both a data controller (for platform account data) and a data processor (for member data processed on behalf of associations).

This policy applies to:

• Members who create a wehna account and belong to one or more associations
• Association leaders and administrators who use wehna to manage their community
• Visitors to a public association page (at wehna.app/a/[slug]) or to our marketing site

We use the information described above to:

• Provide, operate, and maintain the wehna platform and your account
• Let one account belong to many associations and switch between them
• Enable administrators to manage members, collect dues, run elections and polls, host events, and post announcements
• Process and reconcile dues payments through Paystack, and record manual payments entered by administrators
• Send transactional email — verification, password reset, payment receipts, and notifications — delivered through SendGrid
• Publish each association's public page at wehna.app/a/[slug]
• Keep the service secure, prevent fraud and abuse, and debug issues
• Respond to support requests and comply with our legal obligations

We do not:

• Sell your personal data to third parties
• Use your data for third-party advertising
• Use member data for any purpose beyond delivering the service to the association

Under section 25 of the NDPA, we process personal data only where we have a lawful basis to do so. Depending on the activity, we rely on one or more of the following:

• Performance of a contract — to create your account, provide the platform, process the dues payments and votes you or your association initiate, and let you sign in with an existing Google or Apple account.
• Legitimate interests — to secure the service, prevent fraud and abuse, and analyse and improve the product, in a way that does not override your rights.
• Legal obligation — to meet tax and financial record-keeping requirements under Nigerian law.
• Consent — for marketing and optional communications, which you may withdraw at any time.

We rely on the protection of vital interests and on public interest or official authority only in exceptional circumstances.

We do not sell your data. We share it only with the trusted service providers (“subprocessors”) that help us run wehna, each bound to process data only as instructed and to keep it secure:

We may also disclose personal data where required to comply with the law, respond to lawful requests from public authorities, enforce our terms, or protect the rights, safety, and property of Innovelox Ltd., our users, and the public. If wehna is involved in a merger, acquisition, or sale of assets, data may be transferred as part of that transaction, subject to this policy.

We keep personal data only for as long as it is needed for the purposes described in this policy:

Under the NDPA, you have the following rights over your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion — ask us to delete your personal data, subject to our legal obligations.
• Portability — request your data in a structured, machine-readable format.
• Restriction — ask us to limit how we process your data in certain circumstances.
• Objection — object to processing based on our legitimate interests, and not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects for you.
• Withdraw consent — where we rely on consent, withdraw it at any time without affecting prior processing.
• Lodge a complaint — complain to the Nigeria Data Protection Commission (NDPC) if you believe we have not handled your data lawfully.

To exercise any of these rights, email us at hello@wehna.app. We will respond within 30 days of receiving your request (or any shorter period required under the NDPA and the NDPC's General Application and Implementation Directive (GAID), 2025).

We use a small number of cookies and similar technologies to:

• Keep you signed in and maintain your session (strictly necessary)
• Remember your preferences, such as light or dark theme
• Understand aggregate usage so we can improve the platform

We do not use third-party advertising cookies. You can control or clear cookies through your browser settings, but disabling strictly necessary cookies may prevent you from signing in or using parts of the service.

We apply appropriate technical and organisational measures to protect your data, including:

• Passwords are hashed — never stored in plaintext
• Data is transmitted over HTTPS/TLS encryption
• Every record is scoped to its association, and the platform is designed to enforce that separation on every query
• Card data is handled entirely by Paystack — we never store full card numbers, CVVs, or bank credentials
• Access to production systems and personal data is restricted on a need-to-know basis

No system can be guaranteed completely secure. If we become aware of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it. Where the breach is likely to result in a high risk to you, we will also notify you without undue delay, describing the nature of the breach and the steps we are taking to address it.

wehna is intended for adults. You must be at least 18 years old to create a wehna account, and we do not knowingly collect personal data directly from children.

Under section 31 of the NDPA, a child is a person under 18 years of age, aligned with the Child Rights Act. Some associations — such as student unions, youth wings, or family savings circles — may keep records that include minors. Where an association enters data about a member under 18, the association, as data controller, must first obtain the verifiable consent of a parent or legal guardian and apply appropriate age-verification measures, except in the limited situations the NDPA permits. We process that data solely on the association's instructions.

If you believe a child's data has been provided to us without appropriate consent, please contact us at hello@wehna.app and we will investigate and, where appropriate, delete the data.

Innovelox Ltd. is based in Nigeria. Personal data is stored and processed outside Nigeria by the subprocessors listed in Section 5 (most of which are in the United States), which means your data may be transferred to and processed in countries outside Nigeria.

Under sections 41 to 43 of the NDPA, we transfer personal data outside Nigeria only where the recipient is subject to a law or instrument ensuring an adequate level of protection, or is subject to appropriate safeguards — specifically the contractual data-protection commitments (data processing agreements) we have in place with each subprocessor — or where another condition permitted under the NDPA applies.

We may update this Privacy Policy from time to time. When we do:

• We will revise the “Last updated” date at the top of this page
• For material changes, we will provide a more prominent notice, such as an in-app message or email
• Your continued use of wehna after the effective date means you accept the updated policy

For any privacy-related question, request, or concern, please get in touch:

The Nigeria Data Protection Commission (NDPC) is the supervisory authority for data protection in Nigeria. If you believe we have not handled your personal data lawfully, you may lodge a complaint with the NDPC (see Section 7).