The short version
- Ekaabo Attendance helps a church, school or company record who attended its services, classes and meetings. The organisation decides what it collects and why. We run the system for it.
- We keep the names and contact details an organisation adds, attendance records, and the details of the organisation's team. Each team member sees only what their role allows.
- We do not sell personal data and we do not use it for advertising. We do not store card details.
- If you are a member, student or staff member, your organisation is the first place to ask about your data. You can also write to privacy@ekaabohq.com.
1. Who we are
Ekaabo Attendance is a product of 1908 Hub Limited ("Ekaabo", "we", "us"). Our address is 13 Ladipo Avenue, Lonlo Bus Stop, Iju-Ishaga, Lagos, Nigeria. For privacy questions write to privacy@ekaabohq.com.
We follow the Nigeria Data Protection Act 2023 and the regulations made under it.
Two roles matter in this notice. For an organisation's own account, its team, billing and sign-in security, we decide why and how the data is used. For the records of the people an organisation keeps, such as members, students and staff, the organisation decides why and how they are used, and we handle them on its behalf and on its instructions.
2. Who this notice covers
- Organisations and their team: the owners, administrators, team leads and children's leaders of a church, school or company that uses Ekaabo Attendance.
- People an organisation keeps records of: members, students, staff, first-time visitors and anyone else who is checked in.
- Door volunteers: people who use a check-in station link to check others in.
- Visitors: people who browse this website.
3. What we collect
About an organisation and its team
The organisation's name, its branches, its logo and colours, and the name, email address and role of each team member. Passwords are stored only as one-way hashes, so no one at Ekaabo can read them. We also keep your IP address when you sign in or use public forms, to limit abuse and protect accounts.
About the people an organisation keeps
What the organisation chooses to add, which can include:
- first name and last name;
- phone number and email address;
- whether the person is a member, a first-timer or a visitor, and the date they joined;
- birthday (day and month, and the year if the organisation adds it);
- groups and programmes the person belongs to;
- whether the person agreed to receive messages, and when and how that was recorded;
- a personal QR code used to check the person in;
- follow-up notes and who is assigned to follow up.
Attendance
Which session a person attended, when they were checked in, and how they were checked in, for example by scanning a QR code, at a check-in station, or by self check-in. Reports are built from these records.
Messages
Emails an organisation sends through the system, the delivery result of each one, and a record of people who stopped receiving them. If WhatsApp or SMS messages are used, we also keep the delivery result of each message.
Share links and check-in stations
Report and follow-up links are protected by a PIN. We store the PIN only as a hash, and we keep an access log of when a link was opened, when a wrong PIN was tried, and from which address. A check-in station is a phone or tablet paired to a branch. It keeps a secret in a cookie, and we store only a hash of it.
Payments
Plans are paid for on Flutterwave's hosted checkout. We keep the payment reference, the amount, the date and the period it covers. We never receive or store card details.
Technical information
The records any online service needs to run and stay secure, such as server logs, and the sign-in cookies described below. Our audit log records which fields changed and who changed them, not the personal details themselves.
4. Sensitive information and children
Some of what an organisation records can be sensitive. A church's member list can reveal religious belief, and a school keeps records about children. The Nigeria Data Protection Act treats this kind of information, and children's information, with extra care.
- The organisation is responsible for having a proper legal basis to keep this information, for telling people what it keeps, and for obtaining a parent's or guardian's consent where a child is involved.
- Organisations should add only what they need.
- You must be 18 or over to create an Ekaabo Attendance account. We do not knowingly create accounts for children.
5. If an organisation keeps your details
If you are a member, student, staff member or visitor, your organisation gave us your details, not you.
- Ask your organisation first about what it holds, to correct it, or to remove it. It can do this in the system.
- Emails sent through the system have a link to stop them. Opening the link shows a page, and you press a button to stop. After that, that organisation branch will not email that address again.
- You can also write to us at privacy@ekaabohq.com and we will help you reach the right person.
6. Why we use it
- To create and run accounts and sign people in securely.
- To record attendance, build reports, run follow-up and send the messages an organisation asks us to send.
- To take payment for plans and keep the financial records the law requires.
- To prevent abuse and fraud, and to keep opt-outs working.
- To answer questions, fix problems and improve the service.
Our legal grounds are: performing our contract with the organisation, the legitimate interests described above (security, preventing abuse, honouring opt-outs), meeting legal obligations, and consent where it is required. We do not sell personal data. We do not use it for advertising.
7. Who can see it
Inside an organisation, access follows the role:
- Owners and branch administrators can see contact details and birthdays.
- Team leads see names, type and groups, but not contact details.
- Check-in stations never see phone numbers, email addresses or birthdays.
- A report or follow-up link hides phone numbers unless an administrator switches them on.
- Each organisation and branch can see only its own records.
Ekaabo staff reach the console only with a second sign-in step. Opening an organisation's contact details needs a stated reason, and that is logged.
9. Data outside Nigeria
Some of these providers process data in other countries. When data leaves Nigeria we rely on the safeguards the Nigeria Data Protection Act allows.
10. How long we keep it
- An organisation's records: while its account is open. An organisation can archive people, and owners can delete archived people for good.
- After a plan ends: check-in keeps working for a grace period, then editing and messages pause. We keep the data for a further period so the organisation can renew, and we tell it before anything is archived.
- Payment records: for as long as the law requires.
- After an organisation asks us to close its account: we delete or anonymise its data within 30 days, except what the law requires us to keep.
11. Your rights
You can ask to see the data we hold about you, correct it, delete it, receive a copy, object to how it is used, or withdraw consent you gave. For records an organisation keeps, ask the organisation first. You can also write to privacy@ekaabohq.com. We reply within 5 business days.
If you are not satisfied you can complain to the Nigeria Data Protection Commission at ndpc.gov.ng.
12. Security
- Passwords and PINs are stored only as one-way hashes.
- Data is encrypted in transit with TLS.
- Sign-in tokens are kept in cookies that page scripts cannot read.
- Every query is limited to the signed-in person's organisation and branch.
- Staff access needs a second sign-in step and is logged.
- If we find a breach that puts personal data at risk, we will tell the people affected and the Commission within 72 hours, as the law requires.
14. Changes to this notice
If we make a material change, we will email account owners at least 14 days before it takes effect. The date at the top of this page always shows when it was last updated.
15. Contact us
Privacy: privacy@ekaabohq.com
General: hello@ekaabohq.com
Address: 1908 Hub Limited, 13 Ladipo Avenue, Lonlo Bus Stop, Iju-Ishaga, Lagos, Nigeria