At Hexagon Dataprotect, we value your privacy and are committed to safeguarding the personal data you share with us. This Privacy Policy explains how we collect, use, store, and protect your information in accordance with the Nigeria Data Protection Act (NDPA) 2023 and global best practices.
By engaging our services or interacting with us, you trust us with your information. We respect that trust and are dedicated to protecting your rights.
Who We Are
Hexagon Dataprotect is a leading provider of data protection, compliance, and cybersecurity solutions. In our role as a Data Controller, we determine how your personal data is collected and processed.
What Data We Collect
We may collect the following categories of personal data:
Identity Information- Name
- Date of birth
- Nationality
- Gender
Contact Information- Phone number
- Email
- Postal address
Professional Information- Job title
- Employer
- Work history
Financial Information- Bank account details
- Billing information
Technical Information- IP address
- Device identifiers
- Website browsing activity
Training & Certification Records- Training participation
- Certifications
- Audit records
We do not intentionally collect sensitive personal data unless necessary and with appropriate safeguards.
Why We Process Your Data
We use personal data strictly for legitimate and transparent purposes, including:
- Delivering our services (training, audits, compliance support).
- Registering clients as data controllers or processors.
- Conducting audits and issuing compliance documentation.
- Improving our services and customer experience.
- Managing contracts, invoicing, and legal obligations.
- Sharing updates, newsletters, and educational materials (with your consent).
Lawful Grounds for Processing
In line with the NDPA, we process personal data based on:
- Consent: When you agree to receive updates, newsletters, or non-essential communications.
- Contract: To fulfill obligations under service agreements.
- Legal Obligation: To comply with Nigerian laws and regulations.
- Legitimate Interest: For service improvements, client relations, and security purposes.
How Long We Keep Your Data
We retain personal data only for as long as necessary to meet the purposes outlined in this Policy or as required by law. Once retention periods expire, we securely delete, anonymize, or archive the data.
Who We Share Your Data With
We may share your personal data only when necessary and under strict safeguards, such as with:
- Regulators: Nigeria Data Protection Commission (NDPC) and other lawful authorities.
- Service Providers: Payment processors, IT service providers, and cloud hosting partners.
- Business Partners: Limited disclosures where collaboration requires it.
We never sell or trade your personal data.
Cross-Border Transfers
If your data needs to be transferred outside Nigeria, we will ensure:
- The receiving country has adequate data protection laws, OR
- Strong contractual and security safeguards are in place, OR
- Your explicit consent is obtained.
Your Rights as a Data Subject
Under the NDPA 2023, you have the right to:
- Be informed about how your data is used.
- Access the data we hold about you.
- Request corrections to inaccurate or incomplete data.
- Request deletion of your data (where lawful).
- Restrict or object to certain processing activities.
- Receive your data in a portable format.
- Lodge a complaint with us or the Nigeria Data Protection Commission (NDPC).
To exercise these rights, contact our Data Protection Officer via the details provided above.
How We Protect Your Data
We use a combination of technical and organizational measures to secure your personal data:
- Encryption of data at rest and in transit.
- Multi-factor authentication and role-based access controls.
- Firewalls, malware protection, and regular system monitoring.
- Regular security audits and vulnerability assessments.
- Mandatory staff training on privacy and confidentiality.
Cookies & Tracking
Respecting your fundamental right to Informational Self-Determination, our platform is configured to operate without tracking technologies, ensuring that no data is processed for behavioral monitoring or profiling
Children’s Data
Our services are not directed to children under 18. We do not knowingly process children’s personal data without parental or guardian consent.
Changes to This Policy
We may update this Privacy Policy from time to time. Updates will be posted on our website with the revised effective date.
Complaints & Contact
If you believe your privacy rights have been violated or have concerns about our data practices, you may:
- Contact our Data Protection Officer (DPO): Naangwam Dariem, 08144274159,
naangwam.dariem@hexagondpo.com.ng.
- Lodge a complaint with the Nigeria Data Protection Commission (NDPC).
Key Terms & Definitions
- Personal Data: Any information relating to an identified or identifiable natural person. Examples include name, phone number, email, address, bank details, IP address, and training records.
- Data Subject: An individual whose personal data is collected, stored, or processed by Hexagon Dataprotect. (For example: clients, employees, trainees, or website visitors).
- Processing: Any operation performed on personal data, whether automated or manual. This includes collection, recording, storage, use, sharing, disclosure, transfer, and deletion.
- Data Controller: A person or organization that determines the purpose and means of processing personal data.
◦ In this Policy, Hexagon Dataprotect is the Data Controller.
- Data Processor: A person or organization that processes personal data on behalf of a Data Controller.
◦ Example: third-party IT service providers or cloud storage companies.
- Data Protection Officer (DPO): The appointed officer responsible for ensuring compliance with the NDPA, monitoring data protection practices, and acting as the contact point for data subjects and regulators.
- Lawful Basis for Processing: The legal grounds on which personal data may be processed under the NDPA. These include: Consent, Contract, Legal Obligation, Legitimate Interest, Vital Interest, and Public Interest.
- Consent: Freely given, specific, informed, and unambiguous indication of a data subject’s wishes, signified by a clear affirmative action (such as ticking a box or signing a form).
- Legitimate Interest: A lawful basis for processing where the processing is necessary for the Data Controller’s legitimate purposes, provided it does not override the fundamental rights and freedoms of the Data Subject.
- Sensitive Personal Data (Special Category Data): Personal data that requires higher protection due to its nature. This includes data relating to health, biometric identifiers, religion, political opinions, sexual orientation, or trade union membership.
- Cross-Border Data Transfer: The movement of personal data from Nigeria to another country. Such transfers must comply with NDPA safeguards, such as adequacy decisions or Standard Contractual Clauses.
- Encryption: A technical security measure that encodes personal data to prevent unauthorized access.
- Cookies: Small text files placed on a user’s device when visiting a website. They help improve user experience, track website activity, and remember preferences.
- Nigeria Data Protection Commission (NDPC): The regulatory authority established under the NDPA 2023 responsible for enforcing compliance, monitoring data processing activities, and handling complaints.
- Retention Period: The length of time personal data is kept before it is securely deleted, anonymized, or archived.
- Third Party: Any individual or entity other than the Data Subject, Data Controller, or Data Processor who may have access to personal data.
