CCW Check-in is used by the CCW Lagos Region RBC Choir to record who comes to rehearsal. This notice explains what personal data is kept, why, who can see it, and what your rights are. It is written to follow the Nigeria Data Protection Act 2023, and the same principles found in other data protection laws such as the UK and EU GDPR.
Who is responsible
The CCW Lagos Region RBC Choir (the choir) decides why and how your details are used. It is the data controller. Contact: your Campus Music Director, or the Global Admin of the choir.
What personal data is kept
- Member details: Member ID, name, email address, campus, part, and membership status.
- Attendance: which rehearsal you attended, the time, and how you were marked (QR code or by a member of the admin team).
- Absence requests you send, and the decisions made on them, including the reason you give.
- Staff roles: for choir staff, the role they have been given and who gave it.
- Device marker: a scrambled code made from your phone's browser, used only to notice when one phone checks in several members. It cannot be turned back into anything about you.
- Sign-in details: your email address, and a short-lived sign-in code. If you sign in with Google, Google confirms your name and email address to us. Nothing else is requested.
- Records of changes: who changed a record, when, and why.
What is not kept
- Your location. At check-in, your phone's position is compared once with the rehearsal venue. Only the yes or no result is kept, for that rehearsal day. The position itself is never saved.
- Google sign-in tokens are checked and not saved.
- This public website holds no member data.
Why it is used, and the legal basis
- To run rehearsals and keep the choir's attendance records, and to deal with absence requests. The basis is the choir's legitimate interest in running its rehearsals fairly.
- To check that you are at the rehearsal venue when you check in. The basis is your consent, which the check-in page asks for before your phone's location is read. You can refuse; a member of the admin team can then mark you by hand.
- To keep the system secure and prevent mistakes or misuse, for example the device marker and the records of changes.
Your details are not sold, not used for advertising, not used to profile you, and not used to make automatic decisions about you.
Who can see it
Only the choir's admin team, and only what their role needs. For example, a Campus Music Director sees their own campus. You can see your own check-in and your own absence requests. Your details are not shared with anyone outside the choir's leadership, except the service providers below.
Service providers and where data is stored
- Google: sign-in, email codes, and the Google Sheets workbook where records are kept. Google may store data on servers outside Nigeria, and Google's own data protection terms apply.
- Google Maps: the rehearsal venue address only, never your own location.
- GitHub Pages: hosts this public page, with no member data on it.
How it is protected
- Sign-in by a Google account or a code emailed to you, which expires after 10 minutes. Repeated wrong codes lock the sign-in for a while.
- Each person sees only what their role needs, and nobody can approve their own check-in or change.
- Every change is recorded with who made it and when.
- The check-in QR code renews every few minutes, and the connection is encrypted.
If your information is ever put at risk in a way that could harm you, the choir will tell you and the data protection regulator as the law requires.
How long it is kept
- Member details and attendance records: while you are a member, and for 2 years after you leave.
- Absence requests, including the reason you give: 12 months.
- Records of who changed what: 3 years.
- Sign-in codes and sessions: minutes to hours, then they expire.
- Your location: never saved.
The choir's System Administrator checks the records at least once a year and removes anything past these periods. You can also ask for your details to be corrected or removed at any time (see below).
Children
CCW Check-in is for choir members and staff. If a member under 18 ever joins, the choir will first get a parent's or guardian's permission.
Your rights
You can ask the choir to:
- tell you what details it holds about you and give you a copy;
- correct details that are wrong or incomplete;
- delete your details, or limit how they are used, where the law allows;
- stop using your details for a purpose you object to;
- take back a consent you gave, such as for location, at any time (this does not affect what was done before).
To do any of this, ask your Campus Music Director or the Global Admin. If you are not happy with the answer, you can complain to the Nigeria Data Protection Commission (NDPC), or to the data protection authority where you live.
Changes to this notice
If the system changes in a way that affects your details, this notice will be updated first, and the date at the top will change.