Privacy notice
This notice explains how [Company legal name] ("DPO Copilot", "we") handles personal data under the Nigeria Data Protection Act 2023 (NDPA).
Two roles
As a data controller, we process data about people who visit our website, request pilot access, or hold an account with us.
As a data processor, we process the personal data that DPCO firms and their clients put into DPO Copilot, only on the firm's instructions and under a data processing agreement. For that data, the firm (or its client) is the controller. Please contact them first about it.
What we collect as a controller
- Pilot requests: your name, work email, firm name, phone number and message.
- Accounts: name, email, password (stored only as a one-way hash), two-step sign-in settings, and sign-in records.
- Security logs: IP address, browser type and the actions taken in the app.
Why and on what basis
- Responding to a pilot request: steps you asked us to take before a contract (NDPA s.25).
- Providing accounts and the service: performance of our contract with your firm.
- Security, fraud prevention and audit trails: our legitimate interests and legal obligations.
Where your data is kept
We host the service with [hosting provider] in Nigeria. Client data is never used to train AI models. Our sub-processors are listed at [link to sub-processor list].
Who we share it with
Only our sub-processors (such as hosting and email delivery providers), under contract, and authorities where the law requires it. We don't sell personal data.
How long we keep it
- Pilot requests: [12 months] after our last contact, unless you become a customer.
- Account data: for the life of your firm's subscription, then [period] under our data processing agreement.
- Audit logs: [6 years].
Your rights
You can ask for a copy of your personal data, ask us to correct or delete it, object to or restrict how we use it, ask for it in a portable format, and withdraw consent where we rely on it. You can also complain to the Nigeria Data Protection Commission.
Personal data breaches
If a breach affects data we process for a firm, we notify that firm without undue delay so it can meet its own obligations under NDPA s.40.
Contact
Data Protection Officer: [name], [email], [address].