PRIVACY POLICY

Last updated: 19 October 2026

1. Data Controller

1.1 This Privacy Policy is issued by FVA70K Services, a business name duly registered with the Corporate Affairs Commission of Nigeria (registered 9 August 2024), proprietor Fortune Godson, of Mama's Mart, Ibusa Road by ULO Junction, Asaba, Delta State, Nigeria (the "Data Controller").

1.2 The Data Controller is committed to the lawful, fair and transparent processing of personal data in accordance with the Nigeria Data Protection Act 2023 and its subsidiary legislation.

2. Definitions

(a) "Personal Data" means any information relating to an identified or identifiable individual;

(b) "Processing" means any operation performed on Personal Data, including collection, storage, use and erasure;

(c) "Data Subject" means the individual to whom Personal Data relates.

3. Categories of Personal Data Collected

3.1 The Data Controller collects only such Personal Data as is necessary for the provision of its services:

(a) Identity and contact data: full name, email address and telephone number, provided when making enquiries, booking consultations or requesting demonstrations;

(b) Business data: business name, service descriptions, pricing and content supplied for website development;

(c) Technical data: anonymised analytics data, including pages visited, device type and approximate location;

(d) Correspondence data: records of chat sessions, support tickets and emails exchanged with the Data Controller.

3.2 The Data Controller does not engage in cross-site tracking and does not collect sensitive personal data unless strictly necessary and with explicit consent.

4. Lawful Basis and Purpose of Processing

4.1 Personal Data is processed on the following lawful bases:

(a) Contract: to respond to enquiries, prepare quotations and perform service agreements;

(b) Legitimate interests: to maintain and improve the Data Controller's website and services, including through anonymised analytics;

(c) Consent: to send non-essential communications, where consent has been given and may be withdrawn at any time.

4.2 Personal Data shall not be used for any purpose incompatible with the purpose for which it was collected.

5. Non-Disclosure and Non-Sale of Data

5.1 The Data Controller shall not sell Personal Data under any circumstances and shall not disclose Personal Data to advertisers or marketing third parties.

6. Disclosure to Processors

6.1 Personal Data may be disclosed to trusted service providers strictly as necessary for the provision of the services:

(a) Cloudflare: hosting and infrastructure;

(b) Google: anonymised analytics;

(c) Paystack: payment processing (card details are handled exclusively by Paystack and are never visible to the Data Controller);

(d) Zoho: email delivery infrastructure.

6.2 All such processors are engaged under terms requiring appropriate technical and organisational safeguards.

7. Protection of Credentials and Sensitive Information

(a) Passwords, API keys and similar credentials shall be transmitted only through encrypted channels and never by plain email or chat;

(b) such credentials shall be stored in encrypted form with access restricted to assigned personnel;

(c) working copies of client credentials shall be deleted upon project handover, save for such credentials as are required for active maintenance under a maintenance plan, and then only with the client's consent.

8. Data Retention

(a) Client project data shall be retained for the duration of active maintenance and erased within ninety (90) days of termination of services, unless the client requests earlier erasure or longer retention;

(b) support correspondence shall be retained for twelve (12) months for quality assurance;

(c) anonymised analytics data may be retained indefinitely.

9. Rights of the Data Subject

9.1 In accordance with the Nigeria Data Protection Act 2023, every Data Subject is entitled to:

(a) access: confirmation of whether Personal Data is held and a copy thereof;

(b) rectification: correction of inaccurate or incomplete data;

(c) erasure: deletion of Personal Data where there is no lawful basis for continued retention, to be effected within thirty (30) days;

(d) objection and withdrawal of consent: objection to processing and withdrawal of consent at any time.

9.2 Requests may be directed to [email protected] , by call on +234 814 239 5738, or via WhatsApp on +234 813 024 4617.

10. Security Measures

The Data Controller implements appropriate technical and organisational measures, including encryption in transit and at rest, access controls, personnel training and periodic security reviews. Further detail is set out in the Security Framework.

11. Cookies

The website employs a limited number of cookies: strictly necessary cookies required for the operation of the site, and analytics cookies used to understand anonymised usage patterns. Cookies may be disabled through browser settings without affecting core functionality.

12. Amendments

This Policy may be amended from time to time. Material amendments shall be communicated to active clients by email prior to taking effect.

13. Contact

Enquiries concerning this Policy or the exercise of data subject rights should be directed to the Data Controller at [email protected], by call on +234 814 239 5738, by WhatsApp on +234 813 024 4617, or through the contact page.