Privacy notice

This notice explains how Estreat Technologies Limited (“Estreat”, “we”, “us”) processes personal data in connection with our website at estreat.ng, our product console, and our business dealings with customers, prospective customers, partners and suppliers. It is written to meet the transparency requirements of the Nigeria Data Protection Act 2023 (the “NDPA”) and the General Application and Implementation Directive 2025 (“GAID 2025”) issued by the Nigeria Data Protection Commission (the “Commission”).

Estreat is not a law firm and does not provide legal advice. This notice describes our own practices. It is not guidance on your obligations as a controller or processor.

1. Controller and processor roles

We act in two distinct capacities, and the difference matters for your rights and for who you should contact.

Where we are a controller

We are a data controller for personal data we process for our own purposes. That includes data about website visitors, prospective customers and their staff, individual users of our product, correspondence with us, supplier and partner contacts, applicants for employment, and our own personnel. This notice governs that processing.

Where we are a processor

Where a customer places content in the Estreat platform, that content frequently contains personal data relating to the customer’s own employees, customers or other data subjects. Examples include a record of processing activities, an impact assessment, a data subject request file, a breach record, or an evidence artefact. In relation to that content we act as a data processor on the customer’s documented instructions. The customer is the controller, the customer’s own privacy notice governs that processing, and our obligations to the customer are set out in our data processing terms.

If you are a data subject whose personal data appears in customer content and you wish to exercise your rights, please contact the organisation that holds the record. If you contact us instead, we will not action the request directly. We will inform the relevant customer without undue delay and assist them, as our contract with them requires.

2. Who we are and how to contact us

Estreat Technologies Limited is a private company incorporated in Nigeria, wholly owned by Nigerian citizens, and based in Lagos, Nigeria. For any question about this notice, about how we handle personal data, or to exercise a right described in section 9, write to us at privacy@estreat.ng. For general enquiries, write to hello@estreat.ng. To report a suspected security vulnerability, write to security@estreat.ng.

We ask that requests are made in writing to the addresses above so that they are logged and answered within the statutory period. A request made informally to an individual member of staff may not reach the right place in time.

3. Categories of personal data we process

Website visitors

When you visit our website we process technical data necessary to serve and secure the site, including internet protocol address, approximate location derived from it, browser and device characteristics, the pages requested, and the date and time of the request. We use this for delivery, security and aggregate measurement of site performance. We do not build advertising profiles from it.

Prospective customers and enquiries

If you contact us, request a demonstration, or complete a form, we process the identifying and business contact details you give us, your organisation and role, the content of your enquiry, and the record of our correspondence and meetings with you. Where a demonstration involves discussing your processing activities, we process the business information you choose to share in that discussion.

Customer users

For individuals who use the product under a customer’s subscription, we process account data as a controller for the limited purpose of operating the service securely: name, business email address, role and permissions, authentication and multi-factor credentials, security and administrative event logs, and support correspondence. Substantive content those users create inside the platform is customer content, processed by us as a processor.

Suppliers, partners and applicants

We process contact, contractual and payment details for suppliers and partners, including licensed Data Protection Compliance Organisation partners. For recruitment we process application materials, correspondence, interview notes and, where an offer is made, pre-engagement screening results permitted by Nigerian law.

Sensitive personal data

We do not seek sensitive personal data in the ordinary course of our business dealings, and we ask that you do not include it in enquiries or support tickets. Where customer content contains sensitive personal data, we process it only as a processor on the customer’s instructions and under the safeguards in our data processing terms.

4. Purposes and lawful basis

Section 25 of the NDPA requires a lawful basis for each processing purpose. We rely on the bases set out below.

Performance of a contract. To provide the platform to a customer, administer accounts and users, provide support, invoice and collect fees, and manage supplier arrangements.
Legitimate interests. To operate and secure our website and systems, to keep records of business dealings, to conduct proportionate business-to-business marketing to organisational contacts, to improve the service using aggregate and de-identified usage data, and to establish, exercise or defend legal claims. Where we rely on legitimate interests we consider the effect on the individual and we do not proceed where that effect outweighs our interest.
Consent. For any optional communication that requires it, and for any non-essential cookie or similar technology should we introduce one. Consent may be withdrawn at any time and withdrawal does not affect processing carried out before withdrawal.
Compliance with a legal obligation. To meet tax, accounting, corporate and data protection obligations under Nigerian law, including our own obligations to the Commission, and to respond to lawful requests from a competent authority.

We do not sell personal data. We do not disclose personal data for another organisation’s independent marketing purposes, and we do not use customer content to train artificial intelligence or machine learning models.

5. Retention

We keep personal data only for as long as it is needed for the purpose for which it was collected, and then delete it or reduce it to a de-identified form. Our working periods are as follows, subject to any longer period required by law or needed for a live dispute.

Website technical and security logs: up to twelve months.
Enquiries that do not become customers: up to twenty-four months from the last meaningful contact.
Customer account and user administration data: for the term of the subscription and up to twelve months after it ends.
Contracts, invoices and accounting records: for the period required by Nigerian tax and corporate law, currently six years from the end of the relevant financial year.
Unsuccessful job applications: twelve months, unless the applicant asks us to keep them on file.
Customer content held as a processor: for the term of the customer’s subscription and then in accordance with the deletion or return obligation in the data processing terms.

6. Disclosure

We disclose personal data only where there is a basis to do so. The recipients are:

Processors acting for us. Cloud infrastructure, transactional email, support tooling and similar providers, each engaged under written terms that restrict them to our instructions and impose confidentiality and security obligations. A current list of subprocessors that touch customer content is provided to customers under contract and on request.
Professional advisers. Legal, accounting, audit and insurance advisers, under duties of confidentiality, where their advice or services require it.
Authorities. The Commission, a court, or another competent authority, where disclosure is required by law. Where we are permitted to do so, we will tell the affected customer before disclosing their content.
A successor in a corporate transaction. On a merger, acquisition or transfer of business or assets, subject to equivalent protection continuing to apply.

We do not disclose customer content to any other party for that party’s own purposes.

7. Cross-border transfer

Customer data is held in a Nigerian cloud region by default, and an EU region is available where a customer requires it. Some of our processors operate infrastructure or support functions outside Nigeria, and a limited transfer of personal data may therefore occur.

Where personal data is transferred outside Nigeria we do so in accordance with Part VIII of the NDPA. That means the transfer is made to a jurisdiction the Commission has determined to provide adequate protection, or it is made subject to a legally binding instrument or contractual terms providing an adequate level of protection, or it falls within another basis permitted by the Act. We record the destination and the mechanism relied on for each transfer, we assess the recipient before engagement, and we review the assessment periodically. Details of the mechanism relied on for a specific transfer are available from privacy@estreat.ng.

8. Security

We apply technical and organisational measures appropriate to the risk, including encryption of data in transit using TLS 1.2 or above, encryption at rest, least-privilege access with multi-factor authentication on administrative access, logging of administrative and record-level actions, encrypted backups with tested restore, peer-reviewed change management, and recurring vulnerability scanning. Our personnel are screened, bound by written confidentiality obligations and trained on data protection.

A fuller description, and our honest current position on certifications, is set out on our trust and security page. Where we become aware of a personal data breach affecting personal data for which we are the controller, we assess it and, where the Act requires, notify the Commission within 72 hours of becoming aware and notify affected data subjects. Where the breach affects customer content, we notify the affected customer without undue delay so that they can meet their own duty.

9. Your rights

Subject to the conditions and exemptions in the NDPA, you have the following rights in relation to personal data for which we are the controller.

Access. To be told whether we process your personal data and to receive a copy of it, together with information about the processing.
Rectification. To have inaccurate personal data corrected and incomplete data completed.
Erasure. To have personal data deleted where it is no longer necessary for the purpose, where consent is withdrawn and no other basis applies, or where the processing is unlawful.
Restriction. To have processing restricted while a dispute about accuracy or lawful basis is resolved.
Objection. To object to processing carried out on the basis of legitimate interests, and to object at any time to direct marketing, which we will stop on request.
Portability. To receive personal data you provided to us in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible.
Withdrawal of consent. To withdraw consent at any time where consent is the basis for the processing.
Complaint. To lodge a complaint with the Nigeria Data Protection Commission. Details are available at ndpc.gov.ng. We would prefer the opportunity to resolve the matter first, but that preference does not limit your right to complain.

To exercise a right, write to privacy@estreat.ng. We will acknowledge the request, verify your identity proportionately before disclosing personal data, and respond within the period the Act allows. If we cannot give effect to a request in whole or in part, we will tell you why and record the reason.

10. Cookies and analytics

We use only what is necessary to operate and secure this website. That means strictly necessary storage such as remembering your light or dark theme preference, and security and load-balancing functions provided by our hosting. We do not use advertising cookies, we do not use cross-site tracking technologies, and we do not participate in advertising networks.

We measure aggregate site performance in a form that does not identify individual visitors. If we later introduce any analytics or similar technology that is not strictly necessary, we will ask for your consent before it is set, we will provide a means to withdraw that consent, and we will update this notice before doing so.

11. Children

Estreat is an enterprise product sold to organisations. Our website and platform are not directed at children, and we do not knowingly collect personal data relating to a child as a controller. If you believe a child’s personal data has been provided to us in that capacity, write to privacy@estreat.ng and we will delete it unless we are required to retain it. Where a child’s personal data appears in customer content, the customer is the controller and their notice and safeguards apply.

12. Automated decision-making

We do not make decisions about individuals by solely automated means that produce legal effects or similarly significant effects. The platform proposes classifications and risk scores to help a data protection officer, but those proposals are reviewed and approved by a person, and the record shows who approved them.

13. Changes to this notice

We review this notice at least annually and whenever our processing changes materially. When we change it, we update the date at the top of the page. Where a change materially affects how we process personal data for which we are the controller, we will take reasonable steps to bring it to the attention of affected individuals, and where the change concerns our processing of customer content we will give notice as the data processing terms require.

14. Contact and complaints

Write to privacy@estreat.ng with any question, request or complaint about this notice or our handling of personal data. We log every such contact, assign an owner, and respond within the statutory period. If you remain dissatisfied, you may complain to the Nigeria Data Protection Commission at ndpc.gov.ng.