Get featured
Sign inJoin MDX
Legal

Privacy Policy

Updated

Last updated: 14 October 2026

This Privacy Policy explains how MDX (Motion Design Xperience) ("MDX", "we", "us") collects, uses, shares and protects personal data when you use joinmdx.com and its related services (the "Platform"). MDX is based in Nigeria and processes personal data in line with the Nigeria Data Protection Act 2023 (the "NDPA") and the General Application and Implementation Directive issued under it. MDX is the data controller for the personal data described here.

If you have a question about this policy or want to exercise your rights, email [email protected].

1. Personal data we collect

Information you give us

  • Account information: your email address, username, a password (stored only as a secure one-way hash) and your declaration that you are 16 or older.
  • Profile information: your display name, profile photo, headline, biography, city, discipline, tools and links, if you choose to add them.
  • Content: projects (titles, descriptions, images and links to videos hosted elsewhere), credits, comments, award entries and anything else you post.
  • Mailing lists: for the MDX Lab waitlist, your name, email address and the categories you select; for the newsletter or a launch list, your email address; and, for each list, a record of the terms you agreed to and when you confirmed.
  • Messages: anything you send us, for example to support.

Information collected automatically

  • Activity on the Platform: likes, event registrations, award votes, your token balance and transactions, and when these happened.
  • Security information: sign-in attempts and related security events, and the result of an automated bot check. For each award vote we store a keyed, one-way fingerprint derived from the network address it came from, used only to detect vote manipulation; it cannot be turned back into the address.
  • Strictly necessary cookies: see section 7.

Information from others

  • If you choose to sign in with Google, Google shares your name and email address with us. We never receive your Google password.

We do not ask for sensitive personal data, such as information about health, religion or biometrics. Please do not include it in anything you post.

2. How we use personal data, and our legal bases

  • To create and run your account and the features you use: performance of our agreement with you (our Terms of Use).
  • To send service emails, such as verification codes, password resets and event details: performance of our agreement with you.
  • To send MDX Lab, newsletter or launch emails you signed up for: your consent, which you can withdraw at any time with the unsubscribe link in every email.
  • To run the awards fairly and keep the Platform safe, including preventing spam, fraud, bot activity and vote manipulation: our legitimate interest in operating a safe and fair community.
  • To moderate content and enforce our Terms and Community Guidelines: our legitimate interests and our agreement with you.
  • To comply with the law and respond to lawful requests: legal obligation.
  • To understand and improve the Platform using aggregated information: our legitimate interests.

We do not sell personal data, we do not use it for third-party advertising, and we do not make decisions with legal or similarly significant effects about you solely by automated means.

3. What is public

Anyone can see your username, profile, projects, comments, award entries and results, and the votes you cast on award entries (each entry's ballots are public on its voters list). Your email address, password, token history, mailing-list memberships and security information are never public.

4. Who we share personal data with

We share personal data only as needed to run the Platform, with service providers that process it on our instructions under contracts that require them to protect it:

  • our cloud hosting and infrastructure providers, who host our servers and database;
  • Cloudflare, for content delivery, security, bot protection (Turnstile) and file storage;
  • Resend, for sending email;
  • Google, only if you choose to sign in with Google;
  • Sentry, for error monitoring, configured not to receive the content of your requests.

We may also disclose personal data when the law requires it, to protect the rights, safety or property of MDX, our members or others, or as part of a merger, acquisition or sale of the Platform, in which case we will tell you.

5. International transfers

Some of our service providers process personal data outside Nigeria, including in the United Kingdom, the European Union and the United States. When we transfer personal data outside Nigeria we do so as the NDPA allows: to countries with an adequate level of protection, under appropriate safeguards such as our providers' contractual data-protection commitments, or, where applicable, with your consent.

6. How long we keep personal data

  • An account whose email address is never verified is deleted after 7 days.
  • A mailing-list signup that is never confirmed is deleted after 30 days. Newsletter and launch-list records are deleted 30 days after you unsubscribe. MDX Lab waitlist consent records are kept after you unsubscribe so that we can honour the waitlist terms you accepted.
  • Other account data is kept while your account is open. When you ask us to close your account we delete or anonymise your personal data within a reasonable time, except what we must keep to comply with the law, resolve disputes or enforce our agreements. Published award results may continue to name the entries they ranked.
  • Encrypted database backups are kept for up to 35 days.

7. Cookies

We use only cookies that the Platform needs to work: to keep you signed in, to protect forms against cross-site request forgery, and to remember your light or dark theme. We do not use advertising or third-party tracking cookies. Our security provider may set a cookie that bot protection needs.

8. Security

We protect personal data with measures appropriate to the risk, including encryption in transit (HTTPS), hashed passwords, access controls, multi-factor authentication for staff, audit logs of staff actions and encrypted backups. No system is completely secure. If a personal data breach is likely to put your rights at risk, we will notify you and the Nigeria Data Protection Commission as the law requires.

9. Your rights

Under the NDPA you have the right to:

  • be informed about how we use your personal data;
  • access your personal data and get a copy of it;
  • have inaccurate personal data corrected;
  • have your personal data deleted;
  • restrict, or object to, how we process your personal data;
  • receive your personal data in a structured, commonly used format, and have it sent to another organisation;
  • withdraw your consent at any time, without affecting processing that took place before;
  • not be subject to decisions based solely on automated processing that significantly affect you.

You can change most profile information yourself, and you can leave any mailing list with the unsubscribe link in our emails. To exercise any other right, email [email protected]. We will reply within 30 days and may first need to confirm your identity. If you are not satisfied with our reply, you can complain to the Nigeria Data Protection Commission at ndpc.gov.ng.

10. Children

The Platform is not meant for anyone under 16, and we do not knowingly collect personal data from children under 16. If you believe a child under 16 has given us personal data, contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy. We will post the new version on this page with a new "Last updated" date and, if the changes are significant, tell you by email or on the Platform before they take effect.

12. Contact

MDX (Motion Design Xperience), [email protected].