Privacy
statement.

The retention period below still needs the Local Organising Committee's sign-off. Everything else describes what the portal actually does today.

What we collect, and why each item

Your name, because it is printed on your pass and read at check-in. Your email address, because it identifies your account and receives your pass and receipt. Your phone number, so the registration desk can reach you about your booking. Your school or organisation, because the convention is for medical students and the committee reports on which schools attended.

Your gender, for one purpose only: allocating the rooms the committee allocates, which it does by gender. It is not used for a Premium pair who chose each other by room code. If you take the Standard / Feeding only package it is not used at all.

Your delegate type and chosen package, because they set what you pay and what you receive. We also hold your payment status, your ticket identifier, your room pairing if you make one, and a record of changes to your account so you and the desk can see what happened and when.

We do not ask for your address, your date of birth, your matriculation number or your state of residence.

What we never see

Payments happen on Paystack, not here. Your card number, PIN, OTP and bank login never reach this website and we could not store them if we wanted to. Paystack returns a reference, a status, a channel and the amount, which is what lets us activate your pass.

Your password is stored only as a salted one-way hash. Nobody on the committee can read it, and a reset link is the only way back into a forgotten account.

Who can see your details

Members of the Local Organising Committee working on registration, accommodation and check-in. The committee is emailed when a payment is confirmed so the desk has a running list.

If you pair with a roommate, they see your first name, your last initial and your school. They do not see your email address or your phone number, and neither do you see theirs.

Two processors hold data on our behalf: Paystack for payments and SendByte for the emails the portal sends. Delegate records are not sold, rented or shared with anyone else.

How long we keep it

Pending committee approval. The intended rule is that delegate records are deleted twelve months after the convention closes, except payment records, which are kept for six years because financial records have to be. Do not treat this paragraph as final until the committee confirms it.

What you can ask for

You can ask for a copy of what we hold on you, ask us to correct something wrong, or ask us to delete your record. Deletion before the convention cancels your registration, and refunds then follow the terms of registration. Email the address below and the desk will handle it.

Questions

Email info@eksumsa.org, use the official WhatsApp group ↗, or call the registration desk on 08067016177.