Privacy Policy

This Privacy Policy describes a user's privacy rights regarding our collection, use, storage, sharing and protection of personal information.

1. Introduction

ADDA Consulting Limited ("ADDA", "we", "our" or "us") is committed to protecting the privacy and personal data of its clients, website visitors, business partners and other individuals who interact with our website, software solutions and technology services. This Privacy Policy explains how we collect, use, store, disclose and otherwise process personal data in connection with our enterprise technology solutions, including but not limited to enterprise resource planning (ERP), customer relationship management (CRM) implementation, website and software development, cybersecurity services, artificial intelligence (AI) automation, business process automation, network infrastructure, managed IT services and other related digital solutions.

We process personal data in accordance with the Nigeria Data Protection Act, 2023 (NDPA) and any other applicable data protection laws and regulations. By accessing or using our website, products or services, you acknowledge that you have read and understood this Privacy Policy.

In processing Personal Data, ADDA Consulting Limited is guided by the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality and accountability in accordance with applicable data protection laws.

2. Scope

This Privacy Policy applies to personal data collected through:

• the ADDA Consulting Limited website;
• software applications and digital platforms developed or operated by ADDA;
• communications with clients and prospective clients;
• business relationships with customers, vendors and partners;
• technical support and managed services;
• recruitment activities (where applicable); and
• any other products or services provided by ADDA that involve the processing of personal data.

This Privacy Policy shall apply to all users of our services unless otherwise governed by a separate written agreement. Where ADDA processes personal data solely on behalf of a client, such processing shall be carried out in accordance with the applicable contractual arrangements between ADDA and that client, together with all applicable data protection laws.

3. Categories of Personal Data We Collect

Depending on the nature of your interaction with us and the services we provide, we may collect and process the following categories of personal data:

3.1 Information You Provide to Us

This may include:

• Full name;
• Email address;
• Telephone number;
• Residential or business address;
• Company name and job title;
• Login credentials (where applicable);
• Billing and payment information (where applicable); and
• Any other information voluntarily provided when you contact us or use our services.

3.2 Information Collected Automatically

When you access our website or digital platforms, we may automatically collect certain technical information, including:

• IP address;
• Browser type and version;
• Device information;
• Operating system;
• Date and time of access;
• Pages visited;
• Referral source; and
• Other website usage and analytics information.

3.3 Information Received from Third Parties

We may receive personal data from third-party service providers, business partners or clients where such disclosure is necessary for the provision of our services and is permitted by applicable law.

4. How We Collect Personal Data

We collect personal data through various means, including:

• when you visit or interact with our website;
• when you submit enquiries through our website or other communication channels;
• when you engage us to provide products or services;
• when you create an account or access any of our digital platforms (where applicable);
• during the performance of contractual obligations;
• through cookies and similar tracking technologies;
• from our business partners, service providers or clients where authorized; and
• from publicly available sources where permitted by law.

5. Purposes for Processing Personal Data

ADDA Consulting Limited processes personal data only where it is necessary for legitimate business purposes, the performance of contractual obligations, compliance with applicable legal requirements, or with the consent of the data subject where required.

Depending on the nature of your interaction with us, we may process your personal data for one or more of the following purposes:

• providing, operating, maintaining and improving our products and services;
• implementing enterprise technology, software development, digital transformation and managed IT solutions;
• creating and administering user accounts;
• verifying the identity of users and authorized representatives;
• communicating with clients regarding enquiries, projects, support requests and service updates;
• managing contractual relationships and fulfilling our contractual obligations;
• processing payments and maintaining financial records where applicable;
• monitoring, maintaining and improving the security, performance and functionality of our website, software and IT infrastructure;
• detecting, preventing and investigating fraud, cybersecurity incidents, unauthorized access and other unlawful activities;
• complying with applicable laws, regulatory obligations, court orders and lawful requests from competent authorities;
• conducting internal business administration, auditing, reporting, risk management and record keeping;
• carrying out research, analytics and service improvement initiatives; and
• any other purpose that is compatible with the purpose for which the personal data was originally collected or as otherwise permitted by applicable law.

Personal data shall not be processed for purposes that are incompatible with the purposes set out in this Privacy Policy unless required or permitted by law or with the consent of the relevant data subject.

6. Lawful Basis for Processing Personal Data

Where required under applicable data protection laws, ADDA Consulting Limited shall process personal data on one or more of the following lawful bases:

6.1 Consent

Where the data subject has freely given clear, informed and unambiguous consent for the processing of his or her personal data for one or more specific purposes. Where processing is based on consent, the data subject may withdraw such consent at any time, without affecting the lawfulness of any processing carried out prior to such withdrawal.

6.2 Performance of a Contract

Where processing is necessary for the performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into such contract.

6.3 Compliance with a Legal Obligation

Where processing is necessary to comply with applicable legal or regulatory obligations, including obligations relating to taxation, employment, corporate governance, regulatory compliance or lawful requests from competent authorities.

6.4 Legitimate Interests

Where processing is necessary for the legitimate interests pursued by ADDA Consulting Limited or a third party, provided such interests are not overridden by the rights and freedoms of the data subject.

Such legitimate interests may include:

• ensuring network and information security;
• protecting ADDA's systems, infrastructure and intellectual property;
• improving our products and services;
• preventing fraud and other unlawful activities;
• managing business operations and customer relationships; and
• exercising or defending legal claims.

6.5 Other Lawful Grounds

Where otherwise permitted or required under the Nigeria Data Protection Act, 2023 or any other applicable law.

7. Disclosure of Personal Data

ADDA Consulting Limited may disclose Personal Data where such disclosure is necessary for the provision of its Services, compliance with legal obligations, the protection of its legitimate business interests, or with the consent of the relevant Data Subject.

Personal Data may be disclosed to the following categories of recipients:

7.1 Service Providers

Third-party vendors and service providers engaged by ADDA to support the delivery of its Services, including providers of cloud hosting, information technology infrastructure, cybersecurity, software support, communication services, analytics, payment processing and other business support services. Such service providers shall only process Personal Data on ADDA's documented instructions and shall be subject to appropriate contractual and confidentiality obligations.

7.2 Business Partners

Business partners, consultants, subcontractors and professional advisers engaged in connection with the provision of ADDA's Services, where disclosure is necessary and proportionate.

7.3 Regulatory Authorities and Law Enforcement Agencies

Government agencies, regulators, law enforcement authorities, courts or other competent authorities where disclosure is required by applicable law, regulation, court order or other lawful process.

7.4 Consent

Where a Data Subject has expressly authorized ADDA to disclose Personal Data to another person or organization, ADDA Consulting Limited does not sell Personal Data to third parties and shall not disclose Personal Data for unrelated commercial purposes except with the consent of the relevant Data Subject or where otherwise permitted or required by applicable law.

8. International Transfers of Personal Data

Where Personal Data is transferred outside Nigeria, ADDA Consulting Limited shall ensure that such transfer is carried out in accordance with the Nigeria Data Protection Act, 2023 and any other applicable laws.

Where required, ADDA shall implement appropriate safeguards to ensure that Personal Data transferred internationally continues to receive an adequate level of protection. Such safeguards may include:

• contractual safeguards with recipients;
• transfers to jurisdictions providing an adequate level of data protection;
• approved transfer mechanisms recognized under applicable law; or
• any other lawful safeguard prescribed by applicable legislation.

Where required by law, Data Subjects shall be informed of such international transfers.

9. Data Security

ADDA Consulting Limited implements appropriate technical, organizational and administrative measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, unauthorized access or any other unlawful form of processing.

Such measures may include:

• access control mechanisms;
• encryption technologies where appropriate;
• network and infrastructure security controls;
• cybersecurity monitoring;
• secure authentication procedures;
• periodic security assessments;
• employee confidentiality obligations; and
• other industry-standard safeguards appropriate to the nature of the Personal Data processed.

In the event of a Personal Data breach that is likely to result in a risk to the rights and freedoms of Data Subjects, ADDA Consulting Limited shall promptly assess and manage the incident in accordance with applicable data protection laws. Where required by law, ADDA shall notify the Nigeria Data Protection Commission and affected Data Subjects within the prescribed timelines and shall take appropriate steps to mitigate the impact of the breach.

10. Data Retention

ADDA Consulting Limited shall retain Personal Data only for as long as is reasonably necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying contractual obligations, complying with applicable legal and regulatory requirements, resolving disputes and enforcing its legal rights.

Upon expiration of the applicable retention period, or where the Personal Data is no longer required for the purposes for which it was collected, ADDA shall securely delete, anonymize or otherwise dispose of such Personal Data in accordance with its internal data retention procedures and applicable law.

Where retention is required by law or pursuant to a lawful request from a competent authority, ADDA may retain the relevant Personal Data for such additional period as may be required.

11. Data Subject Rights

Subject to the provisions of the Nigeria Data Protection Act, 2023 and any other applicable laws, you may have the following rights in relation to your Personal Data:

• Right of Access: You may request confirmation as to whether we process your Personal Data and obtain a copy of such Personal Data.
• Right to Rectification: You may request that we correct or update any inaccurate, incomplete or outdated Personal Data.
• Right to Erasure: You may request the deletion of your Personal Data where there is no lawful basis for its continued processing or retention.
• Right to Restrict Processing: You may request that we restrict the processing of your Personal Data in circumstances permitted by applicable law.
• Right to Object: You may object to the processing of your Personal Data where such processing is based on our legitimate interests or for direct marketing purposes, subject to applicable legal requirements.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw such consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

12. Cookies and Similar Technologies

Our website may use cookies and similar technologies to enhance user experience, analyze website traffic, improve the functionality of our Services and support the security of our digital platforms. Cookies are small text files stored on your device when you visit a website. They enable us to recognize your device, remember your preferences and understand how visitors interact with our website.

You may configure your browser to refuse or delete cookies. However, disabling certain cookies may affect the functionality and performance of some features of our website.

13. Compliance with Applicable Data Protection Laws

ADDA Consulting Limited is committed to processing Personal Data in accordance with the Nigeria Data Protection Act, 2023 and any other applicable data protection and privacy laws. We periodically review our data protection practices, policies and procedures to ensure continued compliance with applicable legal and regulatory requirements and to reflect evolving industry standards.

14. Changes to this Privacy Policy

ADDA Consulting Limited may amend or update this Privacy Policy from time to time to reflect changes in applicable laws, regulatory requirements, technology, business operations or our data processing practices. Where material changes are made, we will take reasonable steps to notify users through our website or by such other means as may be appropriate.

The updated Privacy Policy shall become effective on the date specified at the top of the revised version unless otherwise stated.

15. Contact Us

If you have any questions regarding this Privacy Policy, wish to exercise your rights as a Data Subject, or have any concerns regarding the processing of your Personal Data, please contact us through the following channels:

Where applicable, requests relating to Personal Data may also be directed to ADDA's designated Data Protection Officer or designated privacy contact.