Data protection policy

1. Purpose

This Data Protection Policy sets out how Amtel Web Design & Graphics Technology ("AmtelWeb", "we") handles personal data in our operations and in the Services we deliver. It is our operational commitment to compliance with the Nigeria Data Protection Act (NDPA) 2023, the Nigeria Data Protection Regulation (NDPR) 2019, and related guidance from the Nigeria Data Protection Commission (NDPC).

It complements and operationalises our Privacy Policy. Where the Privacy Policy tells you what to expect, this Policy tells our team and clients how we make it happen.

2. Scope

This Policy applies to:

• All AmtelWeb employees, contractors, interns, and consultants;
• All personal data we process, whether on our systems or on client systems we manage;
• All client engagements in which we act as a data processor;
• All third-party sub-processors we rely on.

3. Principles

We handle every piece of personal data under the seven principles of the NDPA 2023:

1. Lawfulness, fairness, and transparency — we process only where we have a legal basis and we tell data subjects what we're doing.
2. Purpose limitation — we collect data for specified, explicit purposes and do not re-use it for incompatible purposes.
3. Data minimisation — we collect only what is necessary.
4. Accuracy — we keep data up to date and correct errors promptly.
5. Storage limitation — we keep data only as long as necessary.
6. Integrity and confidentiality — we secure data against unauthorised access, loss, or destruction.
7. Accountability — we document our decisions and can demonstrate compliance.

4. Roles

Controller — when we decide the purpose and means of processing (for example, our own marketing list, our staff records, enquiries to our Site). Our responsibilities: legal basis, notices, handling data subject requests, breach reporting.

Processor — when we process on behalf of a client (for example, building and operating a fintech product that handles customer data). Our responsibilities: follow the client's documented instructions, sign a Data Processing Agreement (DPA), apply appropriate security, and assist the client with their obligations.

Every client engagement that involves personal data is backed by a written Data Processing Agreement aligned to the NDPA 2023.

5. Data Classification

We classify data to apply proportionate controls:

• Public — content intended for open publication (marketing copy, public case studies). No special controls beyond integrity.
• Internal — business operations data, internal communications. Access limited to staff.
• Confidential — client business data, project briefs, SOWs. Access on a need-to-know basis.
• Sensitive personal data — data revealing racial or ethnic origin, religious or political beliefs, health, sexual orientation, biometric or genetic data, and data relating to children, as defined in the NDPA 2023. Strictest controls: explicit consent where required, encrypted storage, restricted processing.

6. Technical and Organisational Measures

We apply security measures appropriate to the risk of the processing.

Technical controls

• Encryption — TLS 1.2+ in transit; AES-256 at rest for sensitive stores.
• Access control — identity-based sign-in on Google Workspace and role-based access in production systems.
• Multi-factor authentication — required for all admin, production, and privileged accounts.
• Network security — firewalls, VPC segmentation, least-privilege IAM on Google Cloud Platform.
• Endpoint protection — disk encryption and anti-malware on all staff devices.
• Logging and monitoring — audit logs retained for at least twelve (12) months, with alerting on anomalous activity.
• Backup and recovery — daily encrypted backups with tested recovery procedures.
• Secure development — code review, dependency scanning, secrets never committed to source control, security testing before production releases.

Organisational controls

• Written policies reviewed annually.
• Annual mandatory data protection training for all staff.
• Non-disclosure agreements with every staff member and contractor.
• Clean-desk and clear-screen practice.
• Documented offboarding that revokes all access within twenty-four (24) hours.

7. Access Control and Least Privilege

Access to personal data is granted on a need-to-know basis. We:

• Provision access through named individual accounts (no shared logins);
• Review access quarterly and on every role change;
• Separate production from development environments;
• Require approval from the data owner for any standing access to client production data.

8. Sub-Processors and Third Parties

Before engaging any sub-processor that will handle personal data, we:

1. Assess their security posture and data protection track record;
2. Sign a DPA or equivalent contract that binds them to our standards;
3. Document the engagement in our sub-processor register;
4. Where a client engagement is affected, give the client advance notice and the opportunity to object.

Our current principal sub-processors include Google Cloud Platform, Firebase, Paystack, Flutterwave, Termii, and GitHub. The current list for a given engagement is shared in the relevant DPA.

9. Data Protection Impact Assessments (DPIAs)

We carry out a DPIA before any new processing activity that is likely to result in high risk to individuals. High-risk triggers include:

• Large-scale processing of sensitive personal data;
• Systematic monitoring of public spaces or online behaviour;
• Automated decision-making with significant effects;
• Processing data of children at scale.

DPIA outcomes are documented and, where residual risk remains high, referred to the NDPC as required by the NDPA 2023.

10. Data Subject Requests

Requests to access, correct, delete, export, or restrict personal data are handled by our DPO. Our service levels:

• Acknowledge within five (5) business days;
• Resolve within thirty (30) days, extendable once by a further thirty (30) days for complex cases with notice to the data subject.

When a request concerns data we process for a client, we forward it to the client without undue delay and assist them in responding.

11. Breach Response

If we become aware of a personal data breach, we:

1. Contain the breach and preserve evidence;
2. Assess the risk to affected individuals;
3. Notify the NDPC within seventy-two (72) hours where the breach is likely to cause harm, as required by the NDPA 2023;
4. Notify affected data subjects without undue delay where the breach is likely to cause significant harm;
5. For client data, notify the client promptly (within forty-eight (48) hours of becoming aware, unless a shorter time is agreed in the DPA);
6. Document every breach, its causes, and the remedial actions taken.

We maintain an incident response runbook and rehearse it at least annually.

12. Retention and Disposal

We retain personal data only for as long as necessary. Our default retention schedule is published in our Privacy Policy. Secure disposal means:

• Digital data — cryptographic erasure or overwriting to industry standards;
• Paper records — cross-cut shredding;
• Backups — purged on the next rotation cycle after the retention period ends.

13. Cross-Border Transfers

Where we need to move personal data outside Nigeria, we follow the transfer rules under the NDPA 2023 — either a destination with adequate protection recognised by the NDPC, or appropriate safeguards such as standard contractual clauses. Transfers are logged in our records of processing activities.

14. Training and Awareness

Every team member completes data protection training on joining and refresher training annually. Training covers the NDPA 2023, phishing and social engineering, secure handling of client data, breach reporting, and data subject rights.

15. Audit and Review

This Policy is reviewed at least annually and whenever Nigerian law or our operations change materially. The DPO audits compliance and reports findings to management each quarter.

16. Accountability

Overall accountability for data protection at AmtelWeb rests with the Managing Director. Day-to-day responsibility sits with the Data Protection Officer (DPO). Every employee is personally responsible for following this Policy; breaches may result in disciplinary action up to dismissal, and in legal action where the law requires it.

17. Enforcement

Non-compliance with this Policy will be treated as a serious matter. In addition to internal discipline, violations may trigger regulatory action by the NDPC, which under the NDPA 2023 may impose administrative sanctions calculated as a percentage of annual gross revenue or a set amount, whichever is higher. We take that exposure seriously on behalf of ourselves, our staff, and our clients.

18. Contact

• Data Protection Officer: dpo@amtelweb.com
• General privacy queries: privacy@amtelweb.com
• Post: [Your registered address], Abuja, FCT, Nigeria
• Regulator: Nigeria Data Protection Commission — https://ndpc.gov.ng