Privacy Policy
Last updated:
1. Who we are
This website, nuxfamily.ng (the "Site"), is operated by NuxFamily Nigeria (referred to as "NuxFamily", "we", "us" or "our"). For the purposes of the Nigeria Data Protection Act 2023 (the "NDPA") we are the data controller of the personal data described in this policy.
- Controller: NuxFamily Nigeria
- Email for privacy matters: info@nuxfamily.ng
We also operate a centre of excellence in Madrid, Spain, run by our European affiliate. Where that affiliate processes your data on our behalf, it does so as a processor under the safeguards described in section 8.
This policy explains what personal data we collect through the Site, why we collect it, how long we keep it, who we share it with and what rights you have. It does not cover data we process as a service provider for our clients under a contract; that processing is governed by the relevant contract and the client's own privacy notice.
2. Personal data we collect
We collect personal data only when you provide it or when it is generated by your use of the Site.
Data you provide through forms. When you submit the contact form, request a discovery session, download a whitepaper, subscribe to Insights or complete the data localisation readiness quiz, we collect some or all of the following: your name, work email address, company, job role, telephone number, the message you write and, for the quiz, your answers and the resulting score.
Data collected automatically. Our hosting provider records standard server logs (IP address, browser type, requested page, timestamp) for security and availability. With your consent we use Google Analytics 4 to understand how the Site is used; see our Cookie Policy for details. Without consent, analytics is not loaded.
Data from the private administration area. A small number of NuxFamily staff sign in to a private administration area of the Site. Their sign-in data is processed by our authentication provider (section 7). Visitors never interact with this area.
We do not ask for, and you should not send us, sensitive personal data such as health information, religious or political views, or financial account details through the Site.
3. Why we process your data and on what lawful basis
The NDPA requires us to have a lawful basis for each processing purpose.
| Purpose | Data | Lawful basis (NDPA s. 25) |
|---|---|---|
| Answering an enquiry or scheduling a discovery session | Name, email, company, role, phone, message | Legitimate interest in responding to a request you made; steps prior to entering a contract |
| Delivering a whitepaper or quiz result you requested | Name, email, company, quiz answers | Legitimate interest; performance of the request you made |
| Sending Insights articles by email | Name, email | Your consent, which you may withdraw at any time using the link in each email |
| Following up commercially with organisations that contacted us | Name, email, company, role | Legitimate interest in business development with organisations that have expressed interest, balanced against your reasonable expectations |
| Security, fraud prevention and availability of the Site | Server logs | Legitimate interest in keeping the Site secure |
| Usage analytics | Analytics identifiers | Your consent, given through the cookie banner |
| Complying with legal obligations | Any of the above as required | Legal obligation |
Where we rely on legitimate interest we have assessed that the processing is necessary and does not override your rights. You may object at any time (section 9).
4. How long we keep your data
- Enquiries and discovery requests: for the duration of our correspondence and up to 24 months after our last contact, unless a commercial relationship follows, in which case the data is kept under the relevant contract.
- Whitepaper and quiz submissions: 24 months from submission.
- Insights subscriptions: until you unsubscribe, plus a short suppression record so we do not email you again.
- Server logs: up to 90 days.
- Analytics data: 14 months, as configured in Google Analytics 4.
When a retention period ends we delete or anonymise the data. We may keep it longer if a legal obligation, a dispute or a regulatory request requires it.
5. Automated decision-making
The readiness quiz calculates a score from your answers using a fixed formula and shows you a band and general recommendations. This is informational only. It produces no legal or similarly significant effect on you and no decision about you is made on the basis of it.
6. Cookies and similar technologies
The Site uses browser storage for strictly necessary functions and, only after your consent, Google Analytics 4 cookies. The full list, the purposes and how to change your choice are set out in our Cookie Policy, which forms part of this policy.
7. Who receives your data
We share personal data only with service providers who process it on our instructions under written contracts, and with authorities where the law requires it. Our providers are:
- Email delivery provider: sends form notifications to us and confirmation or subscription emails to you.
- Vercel: hosts the Site and processes server logs.
- Neon: stores form submissions, quiz results and subscriptions in a managed PostgreSQL database.
- Clerk: provides authentication for the private administration area used by NuxFamily staff only.
- Google (Google Analytics 4): processes usage analytics, only if you consent.
We do not sell personal data and we do not share it with third parties for their own marketing.
8. International transfers
NuxFamily Nigeria is established in Nigeria. Some of the providers above, and our European centre of excellence, process data outside Nigeria, including in the European Union and the United States.
Where we transfer personal data outside Nigeria we do so in accordance with Part VIII of the NDPA. We rely on one or more of the following: a transfer to a country that the Nigeria Data Protection Commission (NDPC) has determined provides adequate protection; binding contractual clauses with the recipient that impose data-protection obligations equivalent to the NDPA; or, in limited cases, your explicit consent or the necessity of the transfer to perform a contract with you. A copy of the applicable safeguards can be requested from the email address in section 1.
Our European affiliate is subject to the EU General Data Protection Regulation, which the NDPC recognises as providing a comparable level of protection.
9. Your rights under the NDPA
You have the right to:
- Access the personal data we hold about you and receive a copy.
- Rectify data that is inaccurate or incomplete.
- Erase your data where there is no longer a lawful reason to keep it.
- Restrict processing in certain circumstances.
- Object to processing based on legitimate interest, including direct marketing, at any time.
- Portability: receive the data you gave us in a structured, machine-readable format.
- Withdraw consent where processing is based on consent, without affecting processing already carried out.
- Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.
To exercise any of these rights, email info@nuxfamily.ng with the subject line "Data subject request". We may ask you to confirm your identity. We will respond within 30 days, or tell you within that period if we need more time for a complex request. There is no charge unless a request is manifestly unfounded or excessive.
10. Complaints
If you are not satisfied with how we handle your data or your request, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC), the supervisory authority under the NDPA, at ndpc.gov.ng. We would welcome the chance to address your concern first, but you are not required to contact us before complaining to the NDPC.
11. Security
We apply technical and organisational measures appropriate to the risk, including encryption in transit (HTTPS with HSTS) and at rest, access control based on least privilege, multi-factor authentication for administrative access, logging of access to stored submissions, and contractual security obligations for every processor listed above. No system is entirely secure; if we become aware of a breach that is likely to result in a risk to your rights we will notify the NDPC and, where required, you, within the timeframes set by the NDPA.
12. Children
The Site is intended for professionals and organisations. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with data, contact us and we will delete it.
13. Changes to this policy
We may update this policy to reflect changes in law, our providers or our processing. The date at the top shows when it was last revised. Material changes will be highlighted on the Site for a reasonable period. Continued use of the Site after a change does not by itself imply consent to processing that requires consent; we will ask for it again where necessary.
14. Contact
Questions about this policy or about your personal data: info@nuxfamily.ng, or by email to the contact in section 1.
This policy describes how we handle personal data. It is not legal advice on the NDPA, the Central Bank of Nigeria's data localisation requirements or any other regulation applicable to your organisation.