Privacy Policy

01Data we collect

We collect only what is necessary to respond to you and to operate this website securely.

• Enquiry data — name, email address, organisation, telephone number, country, subject and message content submitted through the contact form.
• Recruitment data — name, contact details, CV or résumé, links to professional profiles, and any supporting note submitted through the careers application form.
• Technical data — IP address, browser type and version, device characteristics, referring page and pages viewed, collected through server logs and analytics.
• Consent records — your cookie preference, stored locally in your browser, and the timestamp of consent given on any form.

02Lawful basis for processing

We process personal data on the following bases under the Nigeria Data Protection Act 2023 and, where applicable, the UK/EU General Data Protection Regulation:

• Consent — for optional analytics cookies and for retaining recruitment data beyond an active process.
• Legitimate interests — for responding to business enquiries, securing our infrastructure, and understanding aggregate site usage. We have assessed that these interests are not overridden by your rights.
• Contract — where processing is necessary to take steps at your request prior to entering into a contract.
• Legal obligation — where retention or disclosure is required by law, regulation or a competent authority.

03How we use your data

• To route your enquiry to the correct department and respond within the published service commitment.
• To assess job applications and communicate with candidates throughout a recruitment process.
• To maintain the security, availability and integrity of this website, including detecting abuse and rate-limiting automated submissions.
• To measure aggregate site performance and content effectiveness using privacy-first analytics.
• To comply with legal, regulatory, audit and anti-money-laundering obligations.

04We do not sell your data

We do not sell, rent or trade personal data. We do not use your data for advertising profiling, and we do not enable advertising storage in our analytics configuration.

05Data sharing and processors

We share personal data only with processors who act on our documented instructions under a data processing agreement:

• Email delivery — Resend and/or SendGrid, to transmit enquiry and application notifications to the relevant department.
• Hosting and content delivery — our hosting provider, which processes server logs and serves site assets.
• Analytics — Google Analytics 4 (consent-gated, IP anonymised), and privacy-first analytics providers where configured.
• Error monitoring — our error tracking provider, which receives technical diagnostic data and is configured to scrub personal identifiers.
• Content management — our headless CMS provider, which stores editorial content rather than visitor data.

06International transfers

The group operates across Africa, the Middle East, Europe and North America, and some of our processors are located outside your country of residence. Where personal data is transferred internationally we rely on adequacy decisions where available, and otherwise on standard contractual clauses together with supplementary technical measures including encryption in transit and at rest.

07Retention

• Enquiry correspondence — retained for 24 months from the date of last contact, then deleted or anonymised.
• Unsuccessful job applications — retained for 12 months to consider you for other roles, unless you ask us to delete them sooner.
• Successful applications — transferred into the employee record and retained under our HR retention schedule.
• Server and security logs — retained for 90 days.
• Analytics data — retained for 14 months in aggregate form.

08Security measures

• All traffic is served over TLS with HTTP Strict Transport Security enforced.
• A strict Content Security Policy, frame-ancestors restriction and referrer policy are applied at the edge.
• Form endpoints are rate limited, validated server-side against a strict schema, and protected by honeypot fields.
• File uploads are constrained by type and size, filenames are sanitised, and attachments are never executed or stored on a public path.
• Access to mailboxes receiving enquiry data is limited to the relevant department and protected by multi-factor authentication.

09Your rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you and receive a copy.
• Have inaccurate or incomplete data corrected.
• Request erasure of your data where we have no overriding lawful basis to retain it.
• Restrict or object to processing carried out on the basis of legitimate interests.
• Receive your data in a portable, machine-readable format.
• Withdraw consent at any time, without affecting the lawfulness of prior processing.
• Lodge a complaint with the Nigeria Data Protection Commission or your local supervisory authority.

10Exercising your rights

Send requests to n.o_group@outlook.com with sufficient information for us to verify your identity. We acknowledge requests within five business days and respond substantively within thirty days. Where a request is complex we may extend this period and will tell you why.

11Children

This website is not directed at children under sixteen, and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, contact us and we will delete it.

12Changes to this policy

We review this policy annually and whenever our processing activities change materially. Substantive changes are announced on this page with an updated revision date.