Your privacy is our priority. Learn how ETROG collects, uses, and protects your data in compliance with NDPR and global privacy regulations.
ETROG Limited ("ETROG," "we," "us," or "our") is committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, products, and services.
This policy applies to all visitors to our website, users of our services, customers, partners, and any individuals whose personal data we process in the course of our business operations.
We adhere to the following privacy principles:
Important: This Privacy Policy is compliant with the Nigeria Data Protection Regulation (NDPR) 2019, and aligns with global standards including the EU General Data Protection Regulation (GDPR).
We collect various types of information to provide and improve our services. The data we collect falls into the following categories:
In certain service contexts (such as biometric security solutions), we may process special category data. This processing only occurs with explicit consent or under specific legal provisions, with enhanced security measures in place.
We use your personal data for the following purposes, based on legitimate legal grounds:
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Service Delivery | Contact, identity, professional data | Contract Performance |
| Customer Support | Contact, identity, usage data | Legitimate Interest |
| Marketing Communications | Contact, professional, usage data | Consent |
| Service Improvement | Usage, technical, device data | Legitimate Interest |
| Security & Fraud Prevention | Technical, device, usage data | Legal Obligation |
| Compliance & Legal | All relevant data categories | Legal Obligation |
Where we rely on legitimate interests, we conduct a balancing test to ensure our interests don't override your rights and freedoms. Examples include service improvement, fraud prevention, and direct marketing to existing customers about similar services.
We may share your personal data with third parties in the following circumstances:
We engage trusted third-party service providers who assist in operating our business, such as cloud hosting, payment processing, email delivery, and customer support. These providers are contractually bound to protect your data and only process it for specified purposes.
We may disclose your data if required by law, regulation, legal process, or governmental request. This includes responding to court orders, subpoenas, or requests from law enforcement agencies.
In the event of a merger, acquisition, reorganization, bankruptcy, or sale of company assets, your personal data may be transferred as part of the transaction. We will notify you of any such change in ownership or control of your personal data.
We may share your data with third parties when you have given us explicit consent to do so. This includes sharing information with partners for joint marketing initiatives or service integrations.
Data Processing Agreements: All third-party service providers processing personal data on our behalf sign comprehensive Data Processing Agreements (DPAs) that include data protection obligations, security requirements, and restrictions on data use.
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction.
Data in transit (TLS 1.2+) and at rest (AES-256) encryption
Role-based access, multi-factor authentication, least privilege principle
Firewalls, intrusion detection, regular security audits
Data Breach Notification: In the unlikely event of a data breach, we will notify affected individuals and relevant authorities within 72 hours of becoming aware of the breach, as required by NDPR and other applicable laws.
Under NDPR, GDPR, and other data protection laws, you have certain rights regarding your personal data:
You can request a copy of your personal data we hold and information about how we process it.
You can request correction of inaccurate or incomplete personal data.
You can request deletion of your personal data in certain circumstances.
You can request temporary restriction of data processing in certain situations.
You can receive your data in a structured, machine-readable format and transmit it to another controller.
You can object to processing based on legitimate interests or for direct marketing purposes.
You have rights regarding automated decision-making, including profiling.
You can withdraw consent at any time where processing is based on consent.
Exercising Your Rights: To exercise any of these rights, please contact our Data Protection Officer using the details in Section 11. We will respond to your request within 30 days and may ask for additional information to verify your identity.
Our services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16.
If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately. If we become aware that we have collected personal data from children without verification of parental consent, we will take steps to remove that information from our servers.
Age Verification: For services that may be used by individuals under 18 (such as our school management solutions), we implement additional safeguards and obtain parental consent where required by law.
As a global technology provider, we may transfer your personal data to countries outside Nigeria, including to our service providers in other jurisdictions.
When transferring data internationally, we implement appropriate safeguards as required by data protection laws:
Our primary data centers are located in Nigeria. Backup and disaster recovery sites may be located in other jurisdictions with appropriate safeguards in place.
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors.
When we make material changes to this Privacy Policy, we will:
Policy Archive: Previous versions of this Privacy Policy are available upon request. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Data Protection Officer:
ETROG Limited
You have the right to lodge a complaint with the relevant data protection authority if you believe our processing of your personal data violates applicable laws.
The supervisory authority for data protection in Nigeria
ndpb.gov.ngResponse Time: We aim to respond to all privacy-related inquiries within 7 business days. Complex requests may require additional time, but we will acknowledge receipt within 48 hours.
Effective Date: March 1, 2025
Last Updated: March 15, 2025
ETROG Limited | RC: 1234567 | VAT: NG1234567890