PRIVACY POLICY

Introduction

In the course of its everyday business operations, IHOD makes use of a variety of data about identifiable individuals, including data concerning:

  • Current, past, and prospective employees

  • Clients and prospective clients

  • Users of its website

  • Subscribers

  • Other stakeholders

In collecting and using this data, IHOD is subject to legislation governing how such activities may be carried out and the safeguards that must be put in place to protect it. The purpose of this policy is to set out the relevant legislation and to describe the steps IHOD takes to ensure compliance.

This policy applies to all systems, people, and processes that constitute IHOD’s information systems, including directors, employees, suppliers, and other third parties who have access to IHOD’s systems.

Governing Legislation

IHOD’s processing of personal data is governed principally by the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation 2019 (NDPR), as enforced by the Nigeria Data Protection Commission (NDPC).

Where IHOD processes the personal data of individuals located in the European Union or the United Kingdom — for example, in connection with international projects or collaborations — it also has regard to the requirements of the EU General Data Protection Regulation (GDPR) and the UK GDPR, insofar as they apply.

It is IHOD’s policy to ensure that its compliance with all applicable data protection legislation is clear and demonstrable at all times.

Definitions

Personal data means any information relating to an identified or identifiable natural person (a “data subject”); an identifiable person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural, or social identity.

Processing means any operation performed on personal data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, disclosure, dissemination, restriction, erasure, or destruction.

Data controller means the person or body which determines the purposes and means of the processing of personal data. For the purposes of this policy, IHOD is the data controller.

Principles Relating to the Processing of Personal Data

IHOD adheres to the core data protection principles established under the NDPA. Personal data shall be:

  1. Processed lawfully, fairly, and in a transparent manner in relation to the data subject.

  2. Collected for specified, explicit, and legitimate purposes, and not further processed in a manner incompatible with those purposes.

  3. Adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed.

  4. Accurate and, where necessary, kept up to date; every reasonable step is taken to ensure that inaccurate data is erased or rectified without delay.

  5. Retained in a form which permits identification of data subjects for no longer than is necessary for the purposes for which it is processed.

  6. Processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical and organisational measures.

IHOD is responsible for, and able to demonstrate compliance with, these principles.

Rights of the Individual

Under the NDPA, data subjects have the following rights:

  1. The right to be informed

  2. The right of access

  3. The right to rectification

  4. The right to erasure

  5. The right to restrict processing

  6. The right to data portability

  7. The right to object

  8. Rights in relation to automated decision-making and profiling

IHOD has procedures in place to support these rights and to respond within the timescales required by law. To exercise any of these rights, please contact info@ihodafrica.com.

Lawful Basis for Processing

IHOD identifies and documents an appropriate lawful basis for each processing activity. The lawful bases relied upon are:

Consent — Unless another lawful basis applies, IHOD obtains clear, explicit consent from the data subject to collect and process their data. Transparent information about how their data will be used, and their rights in respect of it, is provided at the time consent is obtained. Consent may be withdrawn at any time.

Performance of a Contract — Where personal data is required to fulfil a contract with the data subject, consent is not separately required.

Legal Obligation — Where personal data must be processed to comply with the law, such as for employment or taxation purposes, consent is not required.

Vital Interests — Where processing is necessary to protect the vital interests of the data subject or another person.

Legitimate Interests — Where processing is in the legitimate interests of IHOD and does not override the rights and freedoms of the data subject. The reasoning for relying on this basis is documented.

Privacy by Design

IHOD adopts the principle of privacy by design. The definition and planning of all new or significantly changed systems that collect or process personal data are subject to due consideration of privacy issues, including, where appropriate, a data protection impact assessment covering how and why data will be processed, whether the processing is necessary and proportionate, the risks to individuals, and the controls required to address them.

International Transfers of Personal Data

Where personal data is transferred outside Nigeria, IHOD reviews the transfer beforehand to ensure appropriate safeguards are in place, in accordance with the NDPA and any other applicable legislation.

Data Protection Officer

Under the NDPA, the mandatory appointment of a Data Protection Officer applies to data controllers of major importance. IHOD keeps its status under regular review. Regardless of whether a formal appointment is required, responsibility for data protection matters rests with IHOD’s management, and all data protection enquiries may be directed to info@ihodafrica.com.

Breach Notification

It is IHOD’s policy to act fairly and proportionately in responding to any breach of personal data. Where a breach is likely to result in a risk to the rights and freedoms of individuals, IHOD will notify the Nigeria Data Protection Commission and, where required, affected individuals, within the timescales prescribed by the NDPA.

Addressing Compliance

To ensure ongoing compliance, IHOD ensures that the lawful basis for processing is clear; that staff who handle personal data understand their responsibilities; that rules regarding consent are followed; that data subjects can readily exercise their rights; that procedures involving personal data are reviewed regularly; and that privacy by design is adopted for all new or changed systems.

Cookie Policy

What are cookies?

This Cookie Policy explains what cookies are, how we use them, and how you can manage your preferences. Cookies are small text files stored on your device when a website loads in your browser. They help ensure the website functions properly, enhance security, improve your experience, and allow us to analyse performance. Some cookies remain only for the duration of your visit; others persist for a defined period.

How we use cookies

Like most websites, ours uses both first-party and third-party cookies. First-party cookies are primarily necessary for the website to function and do not collect personally identifiable data. Third-party cookies help us understand how the site performs, analyse how visitors interact with it, support security, and improve your experience.

Types of cookies we use

Necessary cookies are required to enable the basic features of the site, such as maintaining essential functionality and recording your consent preferences. These are used without consent as they are essential to providing the service.

Analytics cookies help us understand how visitors interact with the site, providing aggregated information on metrics such as visitor numbers, traffic sources, and engagement. This information is aggregated and does not directly identify you.

Managing your preferences

You can modify your cookie settings at any time via the consent preferences control on our website, which allows you to update or withdraw your consent. You can also block or delete cookies through your browser settings. Please note that blocking strictly necessary cookies may affect how the site functions.