Privacy Policy

1. About this policy

This policy explains how Crestmas Hub (“we”, “us”) handles personal data when you use Crestmas Form, the form, survey and quiz platform at this website, whether you are a person with an account or someone answering a form that another person built.

We handle personal data in line with the Nigeria Data Protection Act 2023 (NDPA) and the rules and guidance of the Nigeria Data Protection Commission (NDPC). In short, we try to collect only what we need, use it only for the reasons given here, keep it safe, keep it no longer than necessary, and respect your choices.

2. Our role: controller or processor

Who is responsible for data depends on whose data it is:

• Account holders’ data (the people who sign up to build forms): we decide why and how it is used, so we are the data controller.
• Responses to a form (what a respondent types, uploads or has captured while answering): the person who built the form decides why they are collecting it and for how long, so that form owner is the data controller and we act as their data processor. We store the responses securely and only access them to run, protect or fix the platform, or where the law compels us. Our Terms require form owners to tell respondents what they collect and why, and to have a lawful basis for it.

If you answered someone’s form and want to see, correct or delete your answers, the form owner is the first person to ask. If you can’t reach them, contact us and we will help pass your request on (Section 14).

3. What we collect

When you create an account

• Your name, email address, country and phone number. The phone number is collected for identification only and is not verified.
• Optional profile details you choose to add: organization, role or purpose, city, state and a profile photo.
• Your password, stored only as a one-way hash. We cannot read it or email it to you.
• That you accepted our Terms (the date and which version), and that you passed our age check. You enter your date of birth at signup only so we can confirm you meet the minimum age; we do not store the date of birth, only the fact that the check was passed.

When you build forms

• The forms, questions, themes, images and files you create or upload, and the email addresses of collaborators you invite.

When you answer a form

• Your answers and any files you attach, when you started and finished, and your score or result where the form is a quiz.
• Your IP address and browser type, recorded with the submission so the form owner can spot duplicates and misuse.
• Your name or email only if the form asks for it.
• If the owner turns on proctoring: events such as leaving the full-screen or switching tabs, and, only if you allow it, camera still photos (Section 6).
• On a public leaderboard, names are partly hidden to protect participants.

When you pay

• Your plan, amounts, payment references, any coupon you used, and the name, email and phone number used for the payment.
• For bank transfers, the receipt you upload.
• For card payments, the payment is handled by Paystack. Your card details go to Paystack, not to us, and we never see or store your full card number.

When you contact us or report something

• Comments you leave on forms, reports about a form, and questions you send us about a payment or a suspension, together with our replies.

Technical and security data

• IP address and browser details in our security and activity logs (for example failed login attempts, which we use to limit repeated guessing), and in error logs used to fix problems.

You can browse our public pages (home, pricing, FAQ, Terms and this policy) without giving us any personal data, although your IP address is still visible to our server as it is to any website.

4. Why we use it

The NDPA requires a lawful basis for every use of personal data. These are ours:

Where we rely on legitimate interests, we weigh them against your rights and interests and only go ahead if yours do not outweigh ours. We do not use your data for advertising and we do not sell it.

5. Sensitive data & children

Sensitive data. The NDPA gives extra protection to data about things like health, religion, ethnicity, sexual orientation, disability or criminal history. We do not ask for any of this ourselves. A form owner may ask for it in their own form, and then it is the owner’s responsibility to have a proper basis (usually explicit consent) and to protect it. Please think twice before putting sensitive details into a form you did not expect to ask for them.

Children. Under Nigerian law a child is a person under 18, and children’s data needs extra care, usually a parent or guardian’s consent. You must be at least 18 to create an account, and we check this at signup, so we do not knowingly hold accounts belonging to children. Children can still be respondents, for example in a school quiz. In that case the school, teacher or other form owner is responsible for getting any parental or guardian consent before collecting a child’s answers, and for any photos taken under Section 6. If you believe a child has created an account, tell us and we will remove it.

6. Camera proctoring photos

If a form owner turns on camera proctoring for a quiz, you are shown a clear message before you start and you choose to allow the camera or continue without it. Declining does not stop you taking the quiz.

• It takes still photos only, a small number per attempt. It never records video or audio.
• The photos are shown to the form owner as part of your result. They are automatically deleted 90 days after they were taken, or sooner if the form owner deletes the response or form, or the owner’s account is deleted. Your answers and score stay with the form owner.
• We store the photos on the owner’s behalf and do not use them for anything else.

7. Cookies & similar tools

We use only the cookies the site needs to work:

• A session cookie. It keeps you signed in, remembers your progress in a form, and protects forms against cross-site request forgery. It is removed when your session ends or after a period of inactivity.
• A visit-counting cookie (30 days). It is set only if you click a link in one of our announcement emails, so we can tell that the visit came from that email. It is not set for anyone else.

We do not use advertising cookies, third-party analytics, session-recording tools or social-media tracking pixels. Our fonts, icons and scripts are served from our own site, so your browser does not contact outside font or script providers when it loads our pages.

Two things can involve other companies: if a form owner embeds a YouTube or Vimeo video, that provider loads when you view that video and may set its own cookies; and if you click the WhatsApp help button, you leave our site and WhatsApp’s own terms apply. Your browser settings let you block or delete cookies, but the site will not work properly for signed-in features without the session cookie.

8. Emails we send

• Account emails (email verification, password reset, payment and subscription notices) are part of running your account, so they are sent regardless of your announcement choice.
• Announcements about the platform are optional. Every one has an Unsubscribe link, and many mail apps also show their own unsubscribe button. Signed-in users can also switch announcements off under Account Settings → Email preferences. Unsubscribing takes effect for future announcements, and you can resubscribe the same way.
• For announcements we can see whether an email was opened and which links in it were clicked, using a tiny image and tracked links, and whether the person then visited our site. These counts help us see whether announcements are useful. Mail apps that pre-load images can make opens look higher than they are, and if you unsubscribe you stop receiving, and so stop being measured by, these emails.
• When a form owner sends results to a respondent, the email is sent on the owner’s behalf, with their name and reply address.

9. Who we share it with

We do not sell personal data. We share it only in these ways:

• Service providers who help us run the platform and act on our instructions: our web hosting provider, our email delivery provider (for the emails above) and Paystack for card payments.
• Form owners and their collaborators. Responses are visible to the owner and to anyone the owner invites as an editor or viewer, as the owner configures their access.
• Platform administrators, who may see account, billing, report and form details to run the service, answer payment queries and handle reports of misuse.
• Courts, regulators and law enforcement where the law requires it, including the NDPC.
• A successor, if our business is ever sold or reorganised, who would have to honour this policy.

10. Transfers outside Nigeria

Crestmas Hub is run from Nigeria, but some of the providers we use, such as hosting, email or payment services, may store or process data in other countries, and form owners and respondents can be anywhere in the world. When personal data leaves Nigeria we follow the NDPA’s conditions for transfers: the destination must offer adequate protection, or we must have suitable safeguards in place (such as contract terms from the provider), or the transfer must otherwise be permitted by law, for example with your consent. If you want to know more about where a particular type of data is processed, ask us (Section 17).

11. Security & breaches

We protect personal data with measures that include: passwords stored only as hashes; encrypted (HTTPS) connections; protection of every form against cross-site request forgery; email verification before login; limits on repeated sign-in attempts; checks on the type and size of uploaded files and malware scanning where available; a strict browser content-security policy; and administrator tools restricted to administrator accounts. No online service can promise perfect security, but we work to reduce the risk and to fix problems promptly.

If a personal data breach happens that is likely to put people’s rights and freedoms at risk, we will tell the NDPC within 72 hours of becoming aware of it, as the NDPA requires, and we will tell affected people without undue delay when the risk to them is high. If the affected data is form responses, we will tell the form owner promptly so they can meet their own duties.

12. How long we keep it

• Account data: for as long as your account is open. You can delete your account yourself at any time under Account Settings → Delete account. It is then permanently erased straight away, together with all the forms and responses it owns and the files and photos stored with them. You can also ask us to do it by email (we aim to respond within 30 days). Your announcement-email opt-out is kept so we never email you again.
• Forms and responses: the form owner decides how long to keep them. Deleting a form removes it from the owner’s dashboard and switches off its link at once, and we then erase it permanently, with its responses and files, 30 days later (a short safety window in case of a mistaken delete). If you need it erased sooner, email us.
• Camera proctoring photos: automatically deleted 90 days after they are taken (Section 6).
• Payment records: for as long as accounting and tax law require. If you delete your account, we remove your name, phone number, receipt and notes from them and keep only the reference, plan, amount, status and dates.
• Security and error logs: records of sign-in attempts are removed after 30 days; other logs are kept only as long as needed to protect the service and fix faults.
• Email choices: an unsubscribe is kept so that we do not email the address again.

We may keep a minimal record where the law requires it, or where we need it to handle a legal claim.

13. Automated decisions

We do not use automated decision-making or profiling that has legal or similarly significant effects on a person. Two tools on the platform are automated, but are controlled by the form owner: quizzes can be auto-graded, and an owner can set a proctored quiz to auto-submit after repeated tab-leaving or exits from full screen. Proctoring events and photos are given to the owner as information, and it is the owner, not us, who decides what to do with them. If an automated result seems wrong, ask the form owner to review it.

14. Your rights

Under the NDPA you have the right to:

• be told how your data is used (this policy);
• access the personal data we hold about you and get a copy;
• have inaccurate data corrected;
• have data erased, where the law allows;
• restrict, or object to, certain uses of your data, including direct marketing, which you can stop at any time through the unsubscribe link;
• receive your data in a portable format;
• withdraw consent you gave us, without affecting what was done before you withdrew it;
• not be subject to a decision based only on automated processing that significantly affects you; and
• complain to the NDPC (Section 15) and seek a remedy from a court.

How to use them: you can delete your account yourself under Account Settings, change your profile details there, and switch announcement emails on or off. For anything else, such as getting a copy of your data, email info@crestmashub.com from the address on your account, or sign in and write to us. We may ask you to confirm who you are before sharing or changing data, so that it does not reach the wrong person. We aim to respond within 30 days and will tell you if a complex request needs longer and why. Making a request is free unless it is clearly unfounded or excessive. Where we need to keep something by law, we will explain what and why.

15. Complaints & the NDPC

If you have a concern about how we handle your data, please contact us first so we can investigate and put it right. You also have the right to complain to the Nigeria Data Protection Commission:

• Website: ndpc.gov.ng

16. Changes & versions

We will update this policy when our practices, the platform or the law change. The date and version at the top of this page always show the current text. For material changes, we will tell signed-in users by email or in the app before they take effect.

17. Contact us

Privacy questions and requests:

• Email: info@crestmashub.com
• Phone: +234 906 193 8955
• Address: Ibadan, Oyo State, Nigeria