Privacy Notice

1. Who we are

2. Scope

This notice covers personal data we collect through our website, digital portals and online forms, and through our services:

• Contract, commercial and legal documentation coordination
• HR management, recruitment and employee administration
• Sales setup, staff training and prospect operations
• Customer support and customer care management
• Regulatory mapping, permits and government registrations
• Intellectual property support and registry filing coordination

It does not cover third-party sites we link to, such as government portals.

3. Personal data we collect

Data you give us

• Identity and contact: name, job title, company, business address, email, phone number.
• Corporate and compliance: director and shareholder details, Tax Identification Numbers, CAC documents, and licence details supplied for filings or contract work.
• HR and workforce (managed HR or recruitment engagements): CVs, identity documents (NIN, driver's licence, international passport), employment history, bank details for payroll, emergency contacts and background-check details.
• Support and sales: enquiries, support tickets, call logs, message histories and prospect lists.
• Know-your-client and billing: identification and payment records needed to take on and invoice a client.

Data we collect automatically

• IP address, browser type, device and operating system, referring page, pages viewed and cookie choices.

Sensitive personal data. We ask for sensitive data (for example health status, biometric data, religion or ethnic origin) only where a service needs it, and only with your explicit consent or another ground in section 30 of the NDP Act, such as employment and social security obligations.

Data from others. For managed services, a client may give us personal data about its customers, staff or applicants. We also compile B2B prospect lists from publicly available or lawfully obtained directories.

4. Why we use your data and our lawful basis

We process personal data only where section 25 of the NDP Act allows it.

This notice is information, not a request for consent. Where we need consent, we ask separately, in plain language, with a clear option to accept or decline.

5. Our role: controller or processor

• SCS as controller. For data about our own clients and prospects, website visitors, vendors, job applicants to SCS and SCS staff, we decide why and how data is used.
• SCS as processor. When we run managed services for a client (customer support, personnel files, sales databases), the client is the controller. We act only on its written instructions under a Data Processing Agreement. If your data reached us this way, please send rights requests to that client or tell us, and we will pass them on without delay.

6. Who we share data with

We do not sell, rent or trade personal data. We share it only with:

• Accredited professionals: solicitors, trademark or patent agents and other specialists engaged for formal filings or legal work.
• Government and regulators: CAC, the Nigeria Revenue Service (NRS), the Nigeria Data Protection Commission (NDPC), NAFDAC and other authorities, where a filing, licence or legal duty requires it.
• Service providers (sub-processors): cloud hosting, data centres, IT security and software vendors, each bound by a written agreement and confidentiality duties. We tell clients before we add a new one.
• Legal and safety needs: where law, a court order or a lawful official request requires disclosure, or to protect life, public health or prevent crime.

We do not share personal data with third parties for their own marketing without your explicit consent.

7. Transfers outside Nigeria

We host data Nigeria. If personal data is stored or transferred outside Nigeria, including to cloud providers such as AWS or Microsoft Azure, we transfer it only where the recipient is bound by a law, binding corporate rules, contractual clauses, a code of conduct or certification that gives an adequate level of protection, or where another ground in section 43 of the NDP Act applies, such as your informed consent after we explain the risks (sections 41 to 43). We record the basis for each transfer. You can ask us for details.

8. How long we keep data

When the period ends we securely erase, shred or irreversibly de-identify the data under our Data Retention and Secure Disposal Policy.

9. How we protect your data

• Access control: role-based access and multi-factor authentication for electronic records.
• Encryption: SSL/TLS in transit and encryption at rest in our databases.
• Physical security: restricted archive rooms, locked cabinets and clean-desk rules.
• People and process: confidentiality undertakings, regular data protection training, security testing, backups and a disaster-recovery plan.
• Breaches: if a breach puts your rights at high risk, the responsible controller will tell you immediately and notify the NDPC within 72 hours.

10. Cookies and similar tools

When you first visit our website, a cookie notice appears at the front of the page with clear Accept and Reject choices.

• Necessary cookies (security, network stability, accessibility) do not need consent.
• All other cookies (analytics, advertising, personalisation) are used only if you accept them. Rejecting them does not block basic website use.
• You can change or withdraw your choice at any time through the cookie settings link in the footer.

11. Children

Our services are for businesses and adults. We do not knowingly collect data from children. If you believe a child has given us data, contact the DPO and we will delete it. Where a client's service involves children's data, consent comes from a parent or legal guardian (section 31).

12. Automated decisions

We do not make decisions that have legal or similarly significant effect on you solely by automated means. If that changes, we will tell you first and you will have the right to human review, to give your view and to contest the decision (section 37).

13. Your rights

Under sections 34 to 38 of the NDP Act you can:

• Access: ask whether we process your data and get a copy, with details of purposes, recipients and retention.
• Correct: have inaccurate, incomplete or outdated data corrected, free of charge where the error is ours.
• Erase: have data deleted where it is no longer needed or we have no lawful basis to keep it.
• Restrict: pause processing while a request or objection is resolved.
• Object: object to processing, and stop direct marketing at any time.
• Withdraw consent: as easily as you gave it. This does not affect earlier lawful processing.
• Port: receive your data in a structured, commonly used, machine-readable format where this applies.
• Human review: not be subject to a solely automated decision with significant effect.

To use a right, email info@stephencorporateservices-scs.com or write to our address above. We may ask you to verify your identity. We reply without undue delay and within [30] days.

14. Complaints

Please contact our DPO first so we can fix the problem quickly. You may also serve a Data Subject's Standard Notice to Address Grievance (SNAG) on us, and we will decide it within the period you state or 30 days, whichever is earlier.

You do not have to use our process first. You can complain at any time to the Nigeria Data Protection Commission (NDPC) at info@ndpc.gov.ng or ndpc.gov.ng, and you can seek redress in the Federal or State High Court.

15. Contact us

Service providers used on this website

To run this website and respond to you, we use the following service providers, who process personal data for us:

• Netlify, Inc. — website hosting, and processing of the forms you submit.
• Plausible Analytics (Plausible Insights OÜ) — website analytics, loaded only if you accept analytics cookies.
• Google Workspace (Google LLC) — the email systems we use to respond to you.
• Cal.com, Inc. — our online booking calendar. Our website only links to it: when you choose "Book a Discovery Call" you leave our site, and the details you enter on Cal.com are processed under Cal.com's own terms and privacy policy, and shared with us so we can hold the call.
• GitHub, Inc. and Netlify — used only by our own staff to edit website content (the /admin area). Editors sign in with a GitHub account; visitors are never asked to.

[CLIENT TO CONFIRM: cross-border transfer safeguards and retention periods for these providers]

Our free tools and business assessment

When you use tools such as Assess your Business, the Compliance Starter Checklist, the Business Structure Chooser or Find My Service, your answers are processed in your browser to show you a result. Nothing is sent to us unless you choose to submit your details.

If you submit your details after using a tool, we receive your contact details together with your answers and result. SCS staff can view these to prepare for any conversation with you and to analyse and improve our tools and services.

We contact you about your submission only if you tick the consent box on the form. You can withdraw consent, or ask us to delete your submission, at any time by contacting info@stephencorporateservices-scs.com.

[CLIENT TO CONFIRM: retention period for tool submissions and enquiries]

16. Changes to this notice

We will update this notice when our practices or the law change, and show the new date at the top. For material changes we will notify you by email or a notice on the website. Our Terms of Use and this notice should be read together.