Last Updated: January 2026.
Version: 1.0INTRODUCTIONThis Privacy Notice explains how OnaTech Governance (“we,” “us,” “our”), acting as a data controller, collects, uses, stores, discloses, and safeguards personal data obtained through our website, in accordance with the Nigeria Data Protection Act 2023 (NDPA) and the General Application and Implementation Directive 2025 (GAID) issued by the Nigeria Data Protection Commission (NDPC).This Notice is designed to fulfil our transparency and accountability obligations under Nigerian data protection law and sets out how personal data is processed when individuals interact with our website.1. Scope and ApplicabilityThis Privacy Notice applies to the processing of personal data relating to:
• Visitors who browse or otherwise interact with our website; and
• Individuals who communicate with us through website contact forms, email links, or similar online interfaces.This Privacy Notice does not apply to personal data processed in the context of employment relationships, customer or client engagements, or other offline or contractual interactions, which are governed by separate and specific privacy notices, where applicable.2. Categories of Personal Data We CollectDepending on how you interact with our website, we may collect the following categories of personal data. We collect only personal data that is relevant, necessary, and proportionate for the purposes described in this Privacy Notice.(a) Identification and Contact Data
• Name
• Email address
• Telephone number
• Any information voluntarily provided through website contact forms or inquiry fields(b) Technical and Usage Data
• Internet Protocol (IP) address
• Browser type and version
• Device identifiers
• Pages visited, interactions with website content, and time spent on the website
• Referring URLs(c) Communications Data
• Messages, inquiries, or requests submitted through the website or related communication channelsWe do not intentionally collect or process sensitive personal data through our website, except where such processing is expressly required, lawful, and carried out in accordance with applicable data protection
laws.
3. Purposes of Processing and Legal BasisWe process personal data collected through our website only where such processing is lawful, fair, and necessary for specified purposes, in accordance with the Nigeria Data Protection Act 2023 (NDPA).Where processing is based on consent, individuals have the right to withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal.4. Cookies and Similar TechnologiesOur website may use cookies and similar technologies that are necessary for the operation and security of the website, as well as cookies used to analyze website usage and improve functionality and user experience.Cookies may be session-based or persistent and may be placed by us or by third-party service providers that support website analytics or functionality.You may manage or disable cookies through your browser settings at any time. Where required under applicable data protection law, we will obtain your consent before placing non-essential cookies on your device.5. Data Sharing and DisclosureWe may disclose personal data collected through our website only where such disclosure is necessary and lawful, and for purposes consistent with this Privacy Notice.Personal data may be shared with the following categories of recipients:• Third-party service providers that support website hosting, analytics, information technology services, or communications, solely for the purpose of enabling website functionality and related services;• Professional advisers, including legal or compliance consultants, where such disclosure is necessary for advisory or compliance purposes; and• Regulatory or law-enforcement authorities, where disclosure is required by applicable law or regulatory obligation.All third parties with whom personal data is shared are required to process such data in accordance with applicable data protection laws and are subject to appropriate contractual or other legally recognized safeguards.
We do not sell personal data collected through our website.6. International Data TransfersWhere personal data collected through our website is transferred outside Nigeria, we ensure that such transfers are carried out lawfully and in accordance with the requirements of the Nigeria Data Protection Act 2023 (NDPA) and the General Application and Implementation Directive 2025 (GAID).International transfers of personal data may occur, for example, where we engage service providers or technology infrastructure located outside Nigeria. In such circumstances, we implement appropriate safeguards and transfer mechanisms approved, recognized, or otherwise permitted by the Nigeria Data Protection Commission (NDPC), as applicable.Further information regarding applicable safeguards for international data transfers may be made available upon request.7. Data Retention
We retain personal data collected through our website only for as long as is necessary to fulfil the purposes for which the data was collected, in accordance with the principles of data minimization and storage limitation under the Nigeria Data Protection Act 2023 (NDPA).Personal data may be retained for longer periods where required to comply with applicable legal, regulatory, accounting, or reporting obligations, or where necessary to establish, exercise, or defend legal
claims.In determining appropriate retention periods, we consider:• the nature and sensitivity of the personal data;
• the purpose for which the data is processed; and
• applicable legal or regulatory requirements.8. Data Security MeasuresWe implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure, taking into account the nature of the personal data processed and the risks associated with such processing.These measures include, where appropriate, access controls, secure systems and infrastructure, and internal governance procedures aimed at ensuring the confidentiality, integrity, and availability of personal data.While we take reasonable steps to safeguard personal data processed through our website, no method of transmission over the internet or electronic storage can be guaranteed to be completely secure.9. Your Rights as a Data Subject
Under the Nigeria Data Protection Act 2023 (NDPA), individuals whose personal data is processed through our website have the following rights, subject to applicable legal limitations:• Right of access: to request confirmation as to whether we process your personal data and to obtain access to such data;
• Right to rectification: to request correction of inaccurate or incomplete personal data;• Right to erasure: to request the deletion of personal data where there is no lawful basis for its continued processing;• Right to object or restrict processing: to object to, or request restriction of, certain processing activities, where applicable;• Right to withdraw consent: where processing is based on consent, to withdraw such consent at any time without affecting the lawfulness of processing carried out prior to withdrawal; and• Right to lodge a complaint: to lodge a complaint with the Nigeria Data Protection Commission (NDPC) where you believe your data protection rights have been infringed.Requests relating to the exercise of these rights may be submitted using the contact details provided in this Privacy Notice. We will assess and respond to such requests in accordance with the timelines and requirements prescribed under applicable data protection law.10. Contact Information
For questions, requests, or complaints relating to this Privacy Notice or our personal data processing practices, including requests to exercise your rights under the Nigeria Data Protection Act 2023 (NDPA), please contact:OnaTech Governance
Email: [email protected]You also have the right to lodge a complaint directly with the Nigeria Data Protection Commission (NDPC) if you believe your data protection rights have been infringed.11. Updates to This Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in our data processing practices, operational requirements, or applicable legal and regulatory obligations.Where updates are made, the revised version of this Privacy Notice will be published on our website with an updated “Last Updated” date. We encourage you to review this Privacy Notice periodically to remain
informed about how we process personal data.