Privacy policy

1. Who we are

African Food Network ("AFN", "we", "us") publishes African recipes, food writing and events at afrifoodnetwork.com. We are the data controller for the personal data described in this policy.

Contact: African Food Network, Owena House, 76 Ralph Shodeinde Street, Central Business District, FCT Abuja, Nigeria. Email info@afrifoodnetwork.com.

2. Which laws apply

We are based in Nigeria and this policy is written to meet the Nigeria Data Protection Act 2023.

Because we publish to readers in the United Kingdom and the European Economic Area, and because we run events in the UK, we also apply the UK GDPR and the EU GDPR to those readers. Where the standards differ we apply the higher one rather than the nearer one.

3. What we collect

We collect three kinds of information, and only these.

Information you give us when you create an account: - Your email address. - A password. This is hashed by our authentication provider before storage. AFN staff cannot see it, and neither can anyone else. - A display name, which becomes your public byline, and a profile address derived from it. - Optionally, a short biography, a profile picture and a country.

Information you give us when you contribute: - Recipes and articles you submit, including the title, description, ingredients, method, tips, any heritage note, timings, servings, difficulty, categories, country of origin, tags, and any image and its alternative text. - Comments you post, and any star rating attached to them. - Any message you send us by email.

Information collected automatically: - A two-letter country code derived from your IP address by our hosting network, used to decide which recipes to show first. We store the code. We do not store the IP address it came from. - Standard server and security logs kept by our hosting provider, which include IP addresses, for the purpose of keeping the service running and defending it from abuse. - If, and only if, you agree to analytics cookies: pages viewed, approximate location, device and browser type, collected by Google Analytics. - If, and only if, you agree to advertising cookies: your IP address, the page you are reading and an advertising identifier stored on your device, received by Google AdSense and used to choose which adverts you see and to count whether they were seen.

We do not collect payment details, because the site takes no payments. We do not ask for, and you should never send us, information about your health, beliefs, ethnicity, politics or sexuality.

4. Why we use it, and our lawful basis

Under the NDPA and the GDPR we must have a lawful reason for each use. Ours are:

• To create and run your account, and to send you the emails that make an account work, such as confirming your address or resetting your password. Basis: performance of a contract with you.
• To publish contributions you choose to submit, credited to your name. Basis: performance of a contract with you. Attribution is the point of the archive, and it is described in our Editorial Standards.
• To moderate contributions and comments before they appear, and to keep the site safe from spam, abuse and fraud. Basis: our legitimate interests in running a trustworthy archive, and yours in reading one.
• To show recipes relevant to where you are. Basis: our legitimate interests in a useful homepage. See section 6 on the cookie this uses.
• To measure how the site is used, through Google Analytics. Basis: your consent, given through the cookie banner, which you can withdraw at any time.
• To show adverts, through Google AdSense, and to count whether they were seen. Basis: your consent, given separately through the cookie banner, which you can withdraw at any time. Agreeing to analytics does not agree to advertising.
• To meet legal obligations, and to establish or defend legal claims. Basis: legal obligation and legitimate interests.

We do not sell personal data, and we do not use it to make automated decisions that produce legal effects about you.

If you agree to advertising cookies, Google receives the information described in section 3 and uses it to choose and measure the adverts you see. We do not upload our account, contribution or comment records to Google, and we never give your email address to an advertiser. If you do not agree, no advertising code is loaded and Google receives nothing.

5. Who we share it with

We use a small number of service providers, each of which processes data on our instructions and is bound by contract.

• Supabase: the database, accounts and file storage that the site runs on. Our project is hosted in the European Union (Ireland).
• Vercel: hosting and content delivery for the website itself, operating from servers worldwide.
• Resend: sending the emails your account needs, such as confirmation and password reset. Operating from the European Union.
• Google: Google Analytics, only after you have agreed to analytics cookies, and Google AdSense, only after you have agreed to advertising cookies. These are two separate agreements and either can be refused on its own.

We will also disclose information if the law requires it, or to protect the rights, safety or property of AFN, our contributors or our readers.

6. Sending data outside Nigeria

Our providers store and process data outside Nigeria, principally in the European Union and the United States.

Where personal data leaves Nigeria we rely on the transfer conditions in section 41 of the NDPA 2023. Where personal data of UK or EEA readers is transferred onward, we rely on the standard contractual clauses adopted by the relevant authority, together with the additional safeguards our providers publish.

7. Cookies and similar technology

Our Cookie Policy lists every cookie by name, what it does and how long it lasts.

Two points deserve stating here rather than only there.

The first is advertising. Nothing advertising-related is stored on your device, and no request is made to Google's advertising servers, until you agree to advertising in the cookie banner. Agreeing to analytics does not agree to advertising: they are separate questions with separate answers, and both start off.

The second is that we set a cookie called afn_country, which holds a two-letter country code and is used to choose which recipes appear first on the homepage. It contains no identifier and nothing personal, but it is stored on your device before you are asked about cookies.

8. How long we keep things

• Your account and profile: for as long as your account is open. If you delete it, we remove the account and your profile immediately.
• Recipes and articles you have published: these stay on the site after your account closes, credited to the name you published under. This is how an archive works, and it is why we ask you to agree to it in the Terms before you contribute. You can ask us to remove your name from a published item, and we will.
• Comments: for as long as the recipe or article they are attached to stays published.
• Submissions that were rejected or never published: 12 months, then deleted.
• Server and security logs: kept by our hosting providers for their standard periods, which do not exceed 12 months.
• Analytics data: 14 months, after which Google deletes it.

9. Your rights

You have the right to:

• Ask what personal data we hold about you and receive a copy.
• Have inaccurate data corrected.
• Have your data erased, subject to the note about published contributions in section 7.
• Ask us to restrict how we use your data, or object to our use of it where we rely on legitimate interests.
• Receive the data you gave us in a portable form.
• Withdraw consent to analytics, or to advertising, at any time and separately, through the cookie settings link in the footer of any page. Withdrawing consent does not affect what was collected before you withdrew it.

To exercise any of these, write to info@afrifoodnetwork.com. We will respond within one month. We will not charge you, and we will not ask you to give a reason.

If you are unhappy with how we have handled your data you can complain to the Nigeria Data Protection Commission, or to your own supervisory authority if you are in the UK or the EEA. In the UK that is the Information Commissioner's Office.

10. How we protect it

Passwords are hashed and are never visible to us. The database enforces access rules at row level, so a signed-in reader can reach their own record and not another person's. Staff access to the moderation tools is gated on a role that only a service credential can grant, checked on the server rather than in the browser.

No system is perfect. If a breach occurs that is likely to result in a risk to your rights, we will notify the relevant authority within 72 hours and tell you directly where the law requires it.

11. Children

The site is written for a general audience and is not directed at children.

You must be at least 16 to hold an account. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us their data, write to info@afrifoodnetwork.com and we will delete it.

12. Changes to this policy

We will update this policy when what we do changes. The version number and date at the top of this page always reflect the current text. Where a change materially affects your rights we will tell account holders by email before it takes effect.