Privacy Policy

1. Overview

This Policy applies to all visitors, clients, prospective clients, vendors, and any other individual whose personal data we process. It covers our website, marketing communications, client portals, and any other digital or physical touchpoints.

We comply with the Nigeria Data Protection Regulation (NDPR) 2019, the Nigeria Data Protection Act (NDPA) 2023, and, where applicable to data subjects in the European Economic Area, the EU General Data Protection Regulation (GDPR).

2. Who We Are (Data Controller)

Expozé Nigeria Limited is registered in Nigeria and acts as the Data Controller for personal data collected through this website and in connection with our services.

• Company: Expozé Nigeria Limited
• Address: 1/2 Ijaiye Road, Ogba, Lagos 100218, Nigeria
• Email: privacy@expoze.ng
• Website: https://expoze.ng

For all data protection enquiries, please contact our Data Protection Officer (DPO) at dpo@expoze.ng.

3. Data We Collect

We collect the following categories of personal data:

3.1 Data You Provide Directly

• Full name, email address, phone number when you submit our contact or enquiry form
• Company name, job title, and business information when engaging our services
• Billing and payment information for contracted services (processed via secure third-party payment processors)
• Communications: emails, calls, messages, and any information you voluntarily share with us
• Newsletter subscription preferences

3.2 Data Collected Automatically

• IP address, browser type, operating system, referring URL, pages visited, and time on site via server logs and analytics tools
• Cookie data and local storage (see Section 10 and our Cookie Policy)
• Device identifiers and screen resolution for responsive design optimisation

3.3 Data from Third Parties

• Information from social media platforms when you interact with our social channels (subject to those platforms' privacy policies)
• Business contact information from publicly available sources or referrals for prospecting purposes

We do not collect or process special categories of personal data (such as race, health data, biometric data, political opinions, or religion) unless required by law or with your explicit consent.

4. How We Use Your Data

We use your personal data for the following purposes:

• Service Delivery: To fulfil contracts, provide marketing services, manage accounts, and communicate project updates
• Communication: To respond to enquiries, send proposals, and maintain our client relationship
• Marketing: To send newsletters, case studies, and promotional content — only with your consent or under legitimate interest where lawfully permitted
• Analytics: To understand how visitors use our website and improve our content and user experience
• Legal Compliance: To comply with applicable laws, regulations, court orders, and tax obligations
• Security: To detect fraud, prevent abuse, and protect our systems and users
• Recruitment: If you apply for a role, to evaluate your application and contact you

We will not use your data for purposes incompatible with those listed above without first obtaining your consent or giving you prior notice.

5. Legal Basis for Processing

Under the NDPA 2023 and GDPR (for EEA data subjects), we process your personal data on the following lawful bases:

• Contract Performance: Processing necessary to deliver services you have engaged us for
• Consent: Where you have explicitly consented (e.g., newsletter subscriptions, marketing communications, non-essential cookies)
• Legitimate Interests: For purposes such as direct marketing to existing clients, website analytics, and fraud prevention — where your interests do not override ours
• Legal Obligation: Where processing is required by applicable Nigerian or international law

You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. Contact us at privacy@expoze.ng.

6. Data Sharing & Disclosure

We do not sell, rent, or trade your personal data. We may share it only in the following circumstances:

• Service Providers: Trusted third-party vendors (e.g., cloud hosting, email platforms, analytics tools, payment processors) who process data on our behalf under strict data processing agreements
• Business Partners: With client approval, collaborating agencies or freelancers engaged to deliver contracted work
• Legal Requirements: When required by Nigerian law, court order, regulatory authority (including NITDA), or to protect our legal rights
• Business Transfers: In the event of a merger, acquisition, or sale of business assets — with advance notice to affected individuals

All third-party data processors are contractually required to protect your data and use it only for specified purposes.

7. International Data Transfers

Some of our service providers are located outside Nigeria, including within the European Economic Area (EEA), the United Kingdom, and the United States. Where we transfer your personal data internationally, we ensure adequate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by relevant data protection authorities
• Transfers to countries with adequacy decisions under NDPA or GDPR
• Explicit consent where required and no other safeguard applies

You may request details of international transfer safeguards by contacting our DPO.

8. Data Retention

We retain personal data only as long as necessary for the purposes collected or as required by law:

• Client data: Duration of contract plus 7 years (Nigerian tax and record-keeping obligations)
• Website enquiry data: 24 months from last contact, unless converted to a client
• Marketing data: Until you unsubscribe or withdraw consent
• Analytics data: 26 months (aggregated, anonymised where possible)
• Application/CV data: 12 months after application unless a role is offered

After retention periods expire, data is securely deleted or anonymised.

9. Your Rights

Under the NDPA 2023 and GDPR (where applicable), you have the following rights regarding your personal data:

To exercise any of these rights, email privacy@expoze.ng with your request. We will respond within 30 days. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng. EEA residents may also contact their local supervisory authority.

10. Cookies & Tracking

We use cookies and similar technologies on our website. Full details are available in our Cookie Policy. In summary:

• Strictly Necessary Cookies: Required for the site to function. No consent needed.
• Analytics Cookies: Help us understand site usage. Require your consent.
• Marketing Cookies: Used for targeted advertising. Require your consent.

You can manage your cookie preferences at any time via our Cookie Preferences Centre or by adjusting your browser settings.

11. Children's Privacy

Our website and services are not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact us immediately at privacy@expoze.ng and we will delete such data promptly.

12. Data Security

We implement appropriate technical and organisational security measures to protect your personal data against accidental loss, unauthorised access, disclosure, or destruction. These include:

• TLS/SSL encryption for all data transmitted to and from our website
• Access controls and role-based permissions for internal staff
• Regular security assessments and staff data protection training
• Secure, encrypted data storage with reputable cloud providers

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the NDPC and affected individuals in accordance with applicable law — within 72 hours where required.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. We will post the updated policy on this page with a revised "Last Updated" date. For material changes, we will provide more prominent notice (e.g., email notification to active clients).

Your continued use of our website after any updates constitutes your acknowledgement of the revised policy.

14. Contact Us & Data Protection Officer

For all data protection enquiries, requests, or complaints, please contact:

• Data Protection Officer: dpo@expoze.ng
• General Privacy Queries: privacy@expoze.ng
• Post: DPO, Expozé Nigeria Limited, 1/2 Ijaiye Road, Ogba, Lagos 100218, Nigeria

We aim to respond to all requests within 30 days. If you are not satisfied with our response, you have the right to complain to the Nigeria Data Protection Commission.