Privacy Policy

This Privacy Policy explains how Right Events Ltd(“we”, “us”, “our”) collects, uses, shares, and protects personal data when you use Moments (the “Service”) at moments.rightevents.co. We are the data controller for that personal data. We process it in line with Nigeria’s Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation (NDPR), and, where it applies to you, the EU/UK General Data Protection Regulation (GDPR).

Operator: Moments is operated by Right Events Ltd, registered at 15 Ikpa Road, Uyo, Nigeria. We are in the process of registering with the NDPC and comply with the Nigeria Data Protection Act 2023. Our data protection contact is privacy@rightevents.co. For any privacy questions, reach us at privacy@rightevents.co.

1. Who this policy is about

Moments lets people create a celebration page (a “Moment”) for someone, share it, and collect public messages (“wishes”). That means we hold personal data about three kinds of people:

• Account holders & creators — people who sign in or create a Moment.
• Honorees — the people a Moment celebrates. A Moment is often created about you by someone else. You have rights over that data and can ask us to change or remove it (see Section 7).
• Well-wishers — people who post a wish, claim a gift, or ask to be notified.

2. The personal data we collect

3. How we use it & our lawful basis

We process personal data on these bases (NDPA s.25 / GDPR Art. 6):

• Performance of the Service — to create Moments, show wishes, and run the features you use.
• Consent — for analytics/marketing cookies, and before we send notifications or reminders to a contact. You may withdraw consent at any time.
• Legitimate interests — to keep the Service safe (anti-spam, moderation) and to operate and improve it, balanced against your rights.
• Legal obligation — where we must retain or disclose data to comply with law.

We do not sell your personal data. We do not use it to make decisions with legal effects about you by automated means alone.

4. Who we share it with

Wishes, honoree names/photos, and other content you add to a public Moment are visible to anyone with the link or who finds it on the Service. Beyond that, we share personal data only with service providers who process it on our behalf under a data-processing agreement:

• Convex — our database and file storage (hosted in the EU, Ireland).
• Resend — sending transactional and notification email.
• Meta (WhatsApp Cloud API) — sending WhatsApp messages you have asked for.
• A content-moderation provider — scanning wish text for harmful content.
• Analytics & marketing providers (Google Analytics, Meta, TikTok, Microsoft Clarity) — only if you accept analytics cookies. See the cookies section.

5. International transfers

We operate from Nigeria; our database is hosted in the EU; and some providers above are in the United States or other countries. Where personal data is transferred across borders, we take steps to ensure it remains protected to the standard required by the NDPA and GDPR.

6. How long we keep it

We keep personal data for as long as the related Moment or account is active, and then only as long as needed for the purposes above or to meet legal obligations. You can ask us to delete your data sooner (Section 7). When a Moment or wish is removed, we delete or de-identify the associated content and files in line with our retention schedule.

7. Your rights

Under the NDPA/NDPR and GDPR you have the right to: access your data; correct it; have it deleted (“erasure”); object to or restrict certain processing; withdraw consent; and receive a copy in a portable format. If a Moment features you, you can ask us to edit or take it down even if you didn’t create it.

To exercise any right, email privacy@rightevents.co. We respond within the timeframes required by law. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) or, if you are in the EU/UK, your local data-protection authority.

8. Children

The Service is not directed to children, and a person under 18 should not create an account. A Moment may, however, celebrate a child (for example a birthday). Where we become aware that we hold a child’s personal data without the consent of a parent or guardian, we will remove it on request or where required by law. [Confirm your minors policy and any parental-consent mechanism with counsel.]

9. How we protect your data

We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls, and limiting the data returned by our public pages to what is needed to display them. No system is perfectly secure; if a breach affects your data we will notify you and the relevant authority where the law requires.

10. Cookies & similar technologies

We use a small number of essential browser-storage items to run the Service (for example, to keep you signed in and to prevent spam). These are always on because the Service cannot work without them.

We also use analytics and marketing technologies — Google Analytics, the Meta Pixel, the TikTok Pixel, and Microsoft Clarity — to understand usage and improve the Service. These set cookies and may share data with those providers. They load only after you accept them in our cookie banner. You can decline, and you can change your choice at any time by clearing the site’s storage in your browser. If you decline, none of these load.

11. Changes to this policy

We may update this policy from time to time. We will change the “Last updated” date above and, for significant changes, take reasonable steps to tell you.

12. Contact

Questions or requests: privacy@rightevents.co. See also our Terms of Service.