What we collect, and why

What this policy covers

This policy covers fatoldtechnologies.com and our client portal at portal.fatoldtechnologies.com.

It does not cover the products we build for our clients. When we work on a client's software we act as a data processor on their instructions, and their own privacy policy governs the people who use it. It also does not cover other companies' websites we link to.

What we collect

Almost everything we hold is something you typed and sent us on purpose.

• When you book a call: your name, email address, company, and whatever you write in the message field.
• When you email us: your address and the contents of the thread.
• If you have a client portal account: your name, work email, company details, the project briefs you submit, files you upload, and the meetings and invoices attached to your account.
• When you apply for a role: your CV and anything else you send us.
• Server logs kept by our hosting provider, which include IP addresses and request details, and exist so the site stays up and abuse can be traced.

We do not run analytics, advertising or session-recording tools on this site, and we do not build behavioural profiles. See the Cookie Policy for the detail.

Why we use it, and our lawful basis

Section 25 of the Nigeria Data Protection Act 2023 requires a lawful basis for every use of personal data. Ours are:

• To reply to an enquiry and work out whether we can help — our legitimate interest in responding to people who contact us, and steps taken at your request before entering a contract.
• To deliver a project and run your portal account — performance of our contract with you or your employer.
• To keep the site and portal secure and working — our legitimate interest in defending our own systems.
• To meet tax, accounting and other legal duties — compliance with a legal obligation.
• To send anything optional, if we ever do — your consent, which you can withdraw at any time.

Who we share it with

We do not sell personal data, and we do not share it for anyone else's marketing. We share it only with:

• Service providers who run parts of our operation — website and application hosting, business email, file storage and payment processing — and only what each needs to do its job. We use a small number of established providers; write to us for the current list.
• Professional advisers such as our accountants and lawyers, where they need it.
• A regulator, court or law enforcement body where we are legally required to, or where it is necessary to establish or defend a legal claim.
• A buyer, if the business is ever sold — subject to the same protections set out here.

Where it goes

Some of our providers store data outside Nigeria. Where that happens we rely on the transfer conditions in Part IX of the Nigeria Data Protection Act 2023, and we choose providers who commit contractually to an adequate standard of protection. Ask us and we will tell you where a particular category of data sits.

How long we keep it

Only as long as there is a reason to.

• Enquiries that do not become projects: 12 months, then deleted.
• Client project records: for the life of the engagement and 6 years afterwards, so we can support what we built and answer questions about it.
• Records we must keep for tax and accounting purposes: 6 years, the period Nigerian law requires.
• Job applications: 6 months unless you ask us to keep them on file for future roles.

Your rights

Under the Nigeria Data Protection Act 2023 you can ask us to:

• Give you a copy of the personal data we hold about you.
• Correct anything that is wrong or incomplete.
• Delete data we no longer have a good reason to keep.
• Restrict what we do with it while a dispute is sorted out.
• Send it to you, or to another provider, in a portable format.
• Stop processing it where we are relying on legitimate interests.
• Withdraw consent, where consent was the basis — without affecting anything done before you withdrew it.

Write to [email protected] and we will respond within 30 days. There is no charge. If you are not satisfied with how we handle it, you can complain to the Nigeria Data Protection Commission.

Keeping it safe

Traffic to this site and the portal is encrypted in transit. Access to client data is limited to the people working on that engagement, and portal sign-in uses a one-time code sent to your email rather than a password you might reuse elsewhere.

No system is perfectly secure, and we would rather say so than imply otherwise. If a breach ever affects your data we will notify the Nigeria Data Protection Commission within 72 hours as the Act requires, and tell you directly where there is a real risk to you.

Children

This site and the portal are for businesses. They are not directed at children, and we do not knowingly collect data from anyone under 18. If you believe we have, tell us and we will delete it.

Changes

If we change this policy we will update the date at the top. Where a change materially affects how we use data you have already given us, we will tell you directly rather than relying on you to check.