Effective date: May 11, 2026
Last updated: September 24, 2026
1. Who We Are
KiboRise (“KiboRise”, “we”, “us”, “our”) is an independent digital financial education publication available at https://kiborise.com.ng (the “Site”). KiboRise is owned and operated by Chimezie Victor, who is the data controller for personal data processed through the site.
This Privacy Policy explains what personal data we collect, why we collect it, the legal basis on which we process it, how long we keep it, who receives it, and the rights you hold over it. We have written it to be read, not merely filed. If any part is unclear, contact us through our Contact page.
2. Legal Framework
We process personal data in accordance with the laws that apply to our operations and our audience:
- The Nigeria Data Protection Act 2023 (NDPA), together with the regulations, directives and guidance issued by the Nigeria Data Protection Commission (NDPC), and, to the extent it remains applicable, the Nigeria Data Protection Regulation 2019 issued by the National Information Technology Development Agency (NITDA).
- The General Data Protection Regulation (EU) 2016/679 (GDPR) and the UK GDPR, where we process the personal data of individuals in the European Economic Area or the United Kingdom.
- The California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), where its requirements apply to our processing of California residents’ personal information. Where the statutory applicability thresholds are not met, we nonetheless extend the core rights described in this policy to California residents as a matter of good practice.
Where these regimes differ, we apply the standard that gives you greater protection.
3. The Personal Data We Collect
| Source | Data collected | Purpose |
|---|---|---|
| Newsletter subscription (Jetpack Subscriptions) | Email address; date, time and source page of subscription; IP address and technical data recorded at sign-up for fraud prevention and consent records; your email engagement settings | To deliver new-article notifications and newsletters you have requested |
| Blog comments | Name or display name; email address (never published); optional website URL; the comment text; IP address; browser user-agent string; date and time of submission | To publish and moderate discussion, prevent spam and abuse, and respond to commenters |
| Contact form | Name; email address; message content; any attachments or details you choose to provide | To answer inquiries, process corrections, and handle privacy and legal requests |
| Automatically collected technical data | IP address; device type; browser type and version; operating system; referring page; pages viewed; date, time and duration of visits; approximate geographic location derived from IP address | To operate, secure and improve the Site, and to understand which content is useful |
| Cookies and similar technologies | Cookie identifiers, advertising identifiers and usage data, as described in Sections 6 and 7 | To provide analytics, remember preferences, and serve and measure advertising |
We do not ask you for, and we do not intentionally collect bank account details, card numbers, BVN, NIN, passwords, brokerage account information or any other financial credentials. Please never send these to us, whether through a comment, the contact form or otherwise. We do not knowingly collect special categories of personal data (such as health, biometric or religious data). If you include such information in a message, we will delete it where we can.
4. How We Use Personal Data and Our Legal Bases
| Purpose | Legal basis (NDPA / GDPR) |
|---|---|
| Sending newsletters and article notifications | Consent, which you may withdraw at any time |
| Publishing and moderating comments | Legitimate interests in hosting lawful, on-topic discussion; consent where you tick the cookie-storage box on the comment form |
| Responding to contact requests, corrections and rights requests | Legitimate interests in operating the publication; legal obligation where a request is made under data protection law |
| Site security, spam prevention and fraud detection | Legitimate interests in protecting the Site and its users |
| Analytics and Site improvement | Consent where required by law (including for visitors in the EEA and UK); otherwise legitimate interests |
| Personalised advertising through Google AdSense | Consent where required by law; otherwise legitimate interests subject to your right to object |
| Compliance with law, regulation or lawful requests from authorities | Legal obligation |
We do not use personal data for automated decision-making that produces legal or similarly significant effects on you.
5. Newsletter and Comment Data in Detail
Newsletter (Jetpack Subscriptions). When you subscribe, your email address is stored and processed by Jetpack, a service provided by Automattic Inc., which acts as our data processor. Jetpack sends subscription emails on our behalf and records delivery and unsubscribe status. Every email we send contains an unsubscribe link. Unsubscribing removes you from future mailings. You may also ask us to erase your subscription record entirely. We do not sell, rent or trade subscriber lists, and we will never add you to a mailing list you did not join.
Comments. When you leave a comment, WordPress collects the data listed above. Your name and comment are displayed publicly. Your email address is not displayed. To help detect spam, comment data, including your IP address and user-agent, may be submitted to an automated spam-filtering service such as Akismet, also provided by Automattic. If you are a registered user with a Gravatar, an anonymised hash of your email address may be sent to the Gravatar service so that your avatar can be displayed.
If you tick the box on the comment form to save your name, email and website in your browser, WordPress stores this in cookies on your device for up to one year so you need not re-enter it. Unticking the box, or clearing cookies, prevents this.
Comments are public. Please do not include personal, confidential or financial information in a comment. We may edit, decline or remove comments that breach our Terms and Conditions.
6. Cookies and Similar Technologies
Cookies are small text files placed on your device. We use the following categories:
| Category | Examples and purpose | Typical duration |
|---|---|---|
| Strictly necessary | Session and security cookies that keep the Site functioning and protect it from abuse | Session to 12 months |
| Comment-preference cookies | WordPress cookies that remember the name, email and website you entered on the comment form, if you opt in | Up to 12 months |
| Analytics | Cookies and identifiers from analytics services such as Google Analytics and Jetpack Stats, which measure visits, popular content and technical performance, using aggregated or pseudonymised data | Up to 24 months; data retained in the analytics account for a configured period, generally no longer than 14 months |
| Advertising | Cookies and identifiers used by Google AdSense and its partners to serve, limit, measure and (where permitted) personalise advertisements | Typically up to 13 months |
Consent and control. Where the law requires your consent (including for visitors in the EEA, the UK and other regions with equivalent rules), we do not set non-essential cookies until you have given consent through our cookie consent banner. You can change or withdraw your choice at any time through the cookie-settings link in the Site footer.
Browser controls. You can block or delete cookies through your browser settings. Guidance is available for Chrome, Firefox, Safari and Edge. Blocking essential cookies may impair Site functionality.
Global Privacy Control and Do Not Track. Where our tools technically support it, we treat a Global Privacy Control signal as a valid request to opt out of the sale or sharing of personal information. Because there is no uniform industry standard for “Do Not Track” browser signals, we do not respond to them separately.
7. Advertising and Google AdSense
We use Google AdSense to display advertisements on the Site. Google and its advertising partners use cookies and similar technologies, including the DoubleClick advertising cookie, to serve advertisements based on your visits to this Site and other sites on the internet, and to measure ad performance and prevent ad fraud. Google’s use of advertising cookies enables it and its partners to serve ads to you based on your browsing activity.
Advertisers do not receive the content of your communications with us, and we do not give advertisers your name or email address.
Your advertising choices:
- Manage or disable personalised advertising in your Google Ads Settings.
- Learn how Google uses information from sites that use its services at policies.google.com/technologies/partner-sites.
- Opt out of interest-based advertising from participating providers through the Digital Advertising Alliance, the Network Advertising Initiative or, for European users, Your Online Choices.
- Use your mobile device’s advertising-identifier settings to limit ad tracking.
- Opting out of personalised advertising does not remove advertisements from the Site. It means the advertisements you see will be less tailored to your interests.
Third-party vendors. Third-party vendors, including Google, use cookies to serve ads based on a user’s prior visits to this and other websites. Users may opt out of personalised advertising as described above.
8. Who Receives Your Data
We share personal data only where necessary, and only with:
- Service providers acting as processors, including our hosting provider, Automattic (Jetpack, Akismet and Gravatar), analytics providers, and our email delivery infrastructure, each bound by contractual data protection obligations.
- Advertising partners, including Google, to the extent described in Section 1.7 and subject to your consent choices.
- Professional advisers, courts and authorities, where necessary to establish, exercise or defend legal claims or to comply with law.
- A successor owner, if KiboRise is ever sold or transferred, in which case this policy will continue to bind the new owner with respect to your data.
We do not sell personal data for money. To the extent that advertising cookies constitute “sharing” of personal information for cross-context behavioural advertising under the CCPA/CPRA, you may opt out as described in Section 11.
9. International Transfers
Our providers operate globally, so your personal data may be processed outside Nigeria, including in the United States and the European Union. When we transfer data across borders, we do so in accordance with the NDPA and, where applicable, the GDPR, relying on adequacy findings, standard contractual clauses, or other lawful transfer mechanisms and requiring recipients to maintain an adequate level of protection.
10. Retention
| Data | Retention |
|---|---|
| Newsletter subscription records | Until you unsubscribe or ask us to erase them, followed by a short suppression record so that you are not re-added by mistake |
| Comments and associated data | For as long as the comment remains published, unless you ask us to remove it or we remove it under our Terms |
| Contact-form correspondence | Up to 24 months after the matter is closed; longer only where needed for a legal claim or a documented correction |
| Server and security logs | Up to 90 days, unless needed to investigate abuse |
| Analytics data | As configured in the analytics account, generally no longer than 14 months |
When retention periods end, we delete or irreversibly anonymise the data.
11. Your Rights
Under the NDPA (Nigeria), you have the right to be informed about our processing; to access your personal data; to have inaccurate data rectified; to request erasure; to restrict processing; to object to processing, including for direct marketing; to data portability; to withdraw consent at any time without affecting earlier lawful processing; and not to be subject to decisions based solely on automated processing that significantly affect you. You may lodge a complaint with the Nigeria Data Protection Commission (https://ndpc.gov.ng).
Under the GDPR/UK GDPR, you hold equivalent rights and may complain to your local supervisory authority, such as the UK Information Commissioner’s Office or the data protection authority in your EU Member State of residence.
Under the CCPA/CPRA (California), you may:
- Know the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties with whom it is disclosed;
- Request deletion of personal information we have collected from you, subject to legal exceptions;
- Request correction of inaccurate personal information;
- Opt out of the sale or sharing of your personal information (see the cookie-settings link in the Site footer, or send a Global Privacy Control signal);
- Limit the use of sensitive personal information (we do not intentionally collect it); and
- Receive equal service and pricing: we will not discriminate against you for exercising any of these rights.
Categories of personal information collected in the last 12 months (CCPA): identifiers (such as email address and IP address); internet or network activity (such as browsing and interaction data); and geolocation limited to approximate location. Categories disclosed for a business purpose: identifiers and internet activity, disclosed to service providers. Categories that may be “shared” for cross-context behavioural advertising: identifiers and internet activity, disclosed to advertising partners.
How to exercise your rights. Submit a request through our Contact page, selecting “Privacy Request”. Please tell us which right you wish to exercise and the email address associated with your data. To protect your privacy, we may ask you to verify your identity, and we may decline a request where we cannot do so. You may use an authorised agent, who must provide proof of authority. We respond to verified requests within 30 days (or within any shorter period the applicable law requires), and we may extend this once where the law permits, telling you why. We do not charge a fee unless a request is manifestly unfounded or excessive.
12. Security and Breach Notification
We apply administrative, technical and organisational safeguards appropriate to the risk, including encrypted connections (HTTPS), access controls, software updates and the use of reputable, security-conscious providers. No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the NDPC and, where required, affected individuals, within the time limits set by law (currently 72 hours for notification to the regulator).
13. Children
The Site is intended for adults and is not directed at children. We do not knowingly collect personal data from anyone under 18, and we do not knowingly serve personalised advertising to children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.
14. Third-Party Sites
The Site links to external websites, including regulators, exchanges and financial institutions. We do not control those sites and are not responsible for their privacy practices. We encourage you to read their policies.
15. Changes to This Policy
We may update this policy to reflect changes in law, technology or our practices. The “Last updated” date above shows when it was last revised. For material changes, we will provide a prominent notice on the Site or by email to newsletter subscribers.
16. Contact and Complaints
For any privacy question or request, use our Contact page and select “Privacy Request”. If we do not resolve your concern, you may complain to the Nigeria Data Protection Commission or to the supervisory authority in your country of residence.