Data Policy

Roles

For leads captured on a campaign page, the sponsor decides why the data is collected (the purpose shown in the consent box) and Popcornture collects and stores it on the sponsor’s behalf. For sponsor accounts and our own website, Pop Culture decides.

Consent, recorded

• Every lead form names the sponsor and the purpose before anything is submitted.
• The consent box is never pre-ticked. Marketing consent is a separate, optional box.
• We store the exact wording shown, the notice version and the time of every consent.
• Repeat submissions from the same person are merged into one lead, and each one is logged.

Separation

Every lead, scan and visit is stored against one company and one campaign. Database row-level security checks that link on every query, so a sponsor’s account can only ever return its own data — even if someone edits a link or an ID.

Access

• Sponsor team members see their company’s leads according to their role.
• Popcornture staff access lead data only to support a campaign or handle a data request, and searches and exports are logged.
• Case studies only ever show aggregate numbers, with the sponsor’s permission.

Export and deletion

Sponsors can export leads to CSV or Excel at any time; exports are recorded in an audit log. When an attendee asks us to delete their data, we anonymise every matching lead across all campaigns, and those leads disappear from each sponsor’s lead list and future exports. Sponsors can also erase individual leads themselves.

Retention

Lead data is kept while the sponsor’s account is active and for no longer than 24 months after the event, unless deleted earlier.

Sponsors’ commitments

• Use leads only for the purpose shown at the point of collection.
• Send marketing only to people who ticked the marketing box, and honour unsubscribes.
• Keep exported data secure and delete it when it’s no longer needed.
• Tell us promptly about any request or incident involving the data.

Incidents

If we discover a personal data breach affecting a campaign, we’ll notify the sponsor without undue delay and work with them on notifying the Nigeria Data Protection Commission and affected people where required.

Attendees can exercise their rights through the data request form.