Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

Data Protection Officer (DPO)

In accordance with the Nigeria Data Protection Act (NDPA) 2023, we have appointed a Data Protection Officer who is responsible for:

• Advising the organization on data protection compliance
• Monitoring compliance with the NDPA and internal policies
• Acting as the contact point for the Nigeria Data Protection Commission (NDPC)
• Handling data subject requests and inquiries

For data protection inquiries or to exercise your rights, please contact our Data Protection Officer at dpo@truehistory.com.ng.

2. Personal Data We Collect

We collect different types of personal data depending on how you interact with our services:

2.1 Information You Provide Directly

• Account Information: Name, email address, phone number, company name, job title when you register or contact us.
• Biometric Data: Fingerprint templates (stored as encrypted mathematical representations, not actual images) when using our biometric services.
• Communication Data: Information you provide when contacting our support team or submitting inquiries.
• Transaction Data: Payment information, billing address, and purchase history when you subscribe to our services.

2.2 Information Collected Automatically

• Device Information: IP address, browser type and version, operating system, device identifiers.
• Usage Data: Pages visited, time spent on pages, click patterns, referring/exit pages, date/time stamps.
• Location Data: General geographic location based on IP address (not precise GPS location).
• Cookie Data: Information collected through cookies and similar tracking technologies (see Section 9).

2.3 Information from Third Parties

• Business Partners: Information from employers or schools who use our services on your behalf.
• Analytics Providers: Aggregated usage data from analytics services.

3. Legal Basis for Processing

We process your personal data only when we have a valid legal basis to do so. The legal bases we rely on include:

4. How We Use Your Data

We use your personal data for the following purposes:

5. Data Sharing and Disclosure

We do not sell your personal data. We may share your data with the following categories of recipients:

• Service Providers: Third-party vendors who assist us in operating our business (hosting providers, payment processors, analytics services). These providers are contractually bound to protect your data.
• Your Employer/Organization: If you use our services through an employer or school, we share relevant attendance and access data with them as the data controller.
• Legal Authorities: When required by law, court order, or to protect our legal rights, or in response to lawful requests by public authorities.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity.
• With Your Consent: We may share data with other third parties when you have given explicit consent.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected. Our retention periods are:

After the retention period expires, we securely delete or anonymize your personal data.

7. Your Data Protection Rights

Under GDPR and NDPR, you have the following rights regarding your personal data:

Supervisory Authorities

You have the right to lodge a complaint with the relevant data protection authority:

• Nigeria: Nigeria Data Protection Commission (NDPC) - ndpc.gov.ng
• EU/EEA: Your local Data Protection Authority
• UK: Information Commissioner's Office (ICO) - ico.org.uk

8. International Data Transfers

Your personal data may be transferred to and processed in countries outside Nigeria, including countries in the European Economic Area (EEA), the United States, and other jurisdictions where our service providers operate.

NDPA Requirements for Cross-Border Transfers

Under the Nigeria Data Protection Act (NDPA) 2023, we can only transfer your personal data outside Nigeria if the receiving country or organization provides an adequate level of data protection comparable to what the NDPA guarantees within Nigeria.

When we transfer your data internationally, we ensure appropriate safeguards are in place:

• Adequacy Assessment: We verify that the destination country has adequate data protection laws recognized by the NDPC, or that the receiving organization has equivalent protection measures.
• Standard Contractual Clauses: We use contractual terms approved by relevant authorities that provide appropriate data protection guarantees.
• Binding Corporate Rules: Internal rules for transfers within corporate groups that ensure consistent protection.
• Your Explicit Consent: In some cases, transfers occur with your explicit, informed consent after being advised of possible risks.
• Contractual Necessity: Where the transfer is necessary for the performance of a contract between you and us.

For more information about international transfers and the safeguards in place, please contact our Data Protection Officer.

9. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect information about your browsing activities. Cookies are small text files stored on your device.

Types of Cookies We Use

Managing Cookies

You can control and manage cookies in several ways:

• Browser Settings: Most browsers allow you to refuse or delete cookies through settings.
• Cookie Preferences: Use our cookie consent banner to manage your preferences.
• Opt-Out Links: Visit allaboutcookies.org for more information.

10. Children's Privacy

Our website is not intended for children under the age of 16. We do not knowingly collect personal data from children under 16 without parental consent.

School Security Services: When providing services to schools, we may process data of minors (students) on behalf of the school. In such cases:

• The school is the data controller and is responsible for obtaining appropriate parental consent.
• We act as a data processor under the school's instructions.
• We implement additional safeguards for children's data.
• Biometric data of minors is only processed with explicit parental consent.

If we learn that we have collected personal data from a child under 16 without appropriate consent, we will take steps to delete that information promptly.

11. Data Security

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction.

While we strive to protect your personal data, no method of transmission over the Internet or electronic storage is 100% secure. If you have reason to believe that your interaction with us is no longer secure, please contact us immediately.

12. Data Breach Notification

In compliance with the Nigeria Data Protection Act (NDPA) 2023, we have established procedures to detect, report, and investigate personal data breaches.

Our Breach Response Procedures

Breach Notification Will Include:

• Description of the nature of the personal data breach
• Categories and approximate number of individuals affected
• Name and contact details of our Data Protection Officer
• Description of likely consequences of the breach
• Measures taken or proposed to address the breach and mitigate effects

13. Data Protection Impact Assessments (DPIAs)

In accordance with the Nigeria Data Protection Act (NDPA) 2023, we conduct Data Protection Impact Assessments (DPIAs) before undertaking any processing that is likely to result in high risk to individuals' rights and freedoms.

When We Conduct DPIAs

We perform DPIAs for processing activities that involve:

• Biometric Data Processing: Any collection or processing of fingerprint data or other biometric identifiers.
• Large-Scale Processing: Processing personal data of a large number of individuals.
• Systematic Monitoring: Regular and systematic monitoring of individuals (e.g., time and attendance tracking).
• Children's Data: Processing personal data of minors in school security contexts.
• New Technologies: Use of new technologies that may pose privacy risks.

Our DPIA Process Includes:

• Description of processing operations and purposes
• Assessment of necessity and proportionality
• Identification and assessment of risks to data subjects
• Measures to address and mitigate identified risks
• Consultation with our Data Protection Officer
• Regular review and updates as processing changes

Where required, we consult with the Nigeria Data Protection Commission (NDPC) before proceeding with high-risk processing activities.

14. Automated Decision-Making

We do not use your personal data for automated decision-making or profiling that produces legal effects or similarly significantly affects you.

Our biometric systems perform automated identity verification, but this is used solely for access control and time tracking purposes as part of our contracted services, and does not make decisions that significantly affect your rights.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

When we make material changes:

• We will update the "Last Updated" date at the top of this policy.
• We will notify you by email (if we have your email address) or by posting a notice on our website.
• Where required by law, we will obtain your consent to material changes.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.

16. Contact Us

If you have any questions about this Privacy Policy, want to exercise your data protection rights, or have a complaint, please contact us:

We aim to respond to all legitimate requests within 30 days. Occasionally, it may take longer if your request is particularly complex or you have made multiple requests.