This Policy applies to website visitors, prospective and existing clients, client representatives, business contacts, suppliers, applicants and other individuals whose personal data Nerdbug processes in connection with its business. A separate notice or contract may apply where appropriate, including where Nerdbug processes personal data on behalf of a client.

Depending on your interaction with us, we may process:

• Identity and contact information, such as name, email address, telephone number, job title and business contact details.
• Account, communication and enquiry information, including messages, support requests and correspondence.
• Client/project information that you or your organisation provide in connection with a project or service.
• Technical and usage information, such as IP address, browser/device information, log data, pages visited and interactions with our website.
• Recruitment information, such as CVs, employment history, qualifications, references and interview notes.
• Billing and transaction information necessary to administer client engagements and payments.

We do not seek to collect sensitive personal data unless it is necessary, lawful and appropriately protected.

We collect information directly from you, from your organisation or authorised representatives, through our website and communications, and from service providers or publicly available sources where lawful and relevant.

We process personal data for purposes including:

• Responding to enquiries and communicating with clients and business contacts.
• Providing, developing, maintaining and supporting software, technology and related services.
• Managing projects, contracts, billing, payments and business administration.
• Operating, securing, troubleshooting and improving our website and systems.
• Recruitment and assessing applicants.
• Preventing misuse, investigating incidents and protecting our rights and property.
• Complying with legal and regulatory obligations.

Depending on the activity, the lawful basis may be performance of a contract or steps requested before entering into a contract, compliance with a legal obligation, consent, or legitimate interests pursued in a manner that does not override your rights. Where we rely on consent, you may withdraw it at any time, without affecting processing already carried out lawfully.

Our website uses cookies and similar browser technologies. Tools identified for use include Google Analytics and Microsoft Clarity for analytics, and Tawk.to for website chat. Google services may also support website/application functionality. Details about cookie categories, controls and how to manage them are set out in our Cookie Policy. Third-party services may process technical information in accordance with their own terms and privacy notices.

We may disclose personal data to personnel and service providers who need it for the purposes described in this Policy, subject to appropriate contractual or other safeguards. Identified providers include:

• Cloud/hosting: Amazon Web Services (AWS) and DigitalOcean.
• Analytics: Google Analytics and Microsoft Clarity.
• Website chat: Tawk.to.
• Payments: Paystack, Flutterwave and Atlas.
• Email: ZeptoMail.
• Domain/website services: Namecheap.
• Atlas: payment services.

The above list reflects providers identified during preparation of this draft and may be updated. Some providers may act as independent controllers for particular activities. We do not disclose personal data to a provider unless there is a business purpose and an appropriate basis for doing so.

Some service providers may process or store information outside Nigeria, including providers located in the United States or other jurisdictions. Where personal data is transferred internationally, Nerdbug will take steps required by applicable law, which may include assessing the destination and using appropriate safeguards. Hosting regions may vary according to client/project requirements and should be specified in the applicable project documentation where relevant.

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including contractual, legal, accounting, security and dispute-resolution needs. Retention periods depend on the type of data and context. Unsuccessful applicant CVs and recruitment records are retained for six (6) months, after which they are securely deleted unless retention is required by law or the applicant has agreed to a longer period for future opportunities. Client project records, financial records, support records and technical logs are retained according to applicable legal requirements, contractual needs and internal retention schedules.

Nerdbug takes steps intended to protect personal data against unauthorised access, loss, alteration, disclosure or destruction. Specific technical and organisational controls may vary by system and engagement. We do not make claims in this Policy about particular certifications or security measures unless confirmed and documented. No method of transmission or storage is completely secure.

Nerdbug maintains an incident-handling process for identifying, reporting, investigating, containing, resolving and documenting incidents. Where a personal data breach occurs, Nerdbug will assess the incident and make notifications to affected persons and/or the relevant authority as required by applicable law. Client-specific notification arrangements may be set out in the relevant agreement.

Subject to applicable law, you may have the right to:

• Be informed about the processing of your personal data.
• Request access to personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion or restriction of processing in appropriate circumstances.
• Object to processing based on legitimate interests or direct marketing.
• Withdraw consent where processing is based on consent.
• Request portability where applicable.
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC).

Requests may be made using the contact details below. We may need to verify your identity and may be unable to fulfil a request where a lawful exception applies.

Our website and services are not directed at children. If we become aware that we have collected a child’s personal data without a lawful basis or required authorisation, we will take appropriate steps to address it.

Our website may contain links to third-party websites or services. Their privacy practices are governed by their own policies, and we encourage you to review them.

We may update this Policy from time to time. The revised version will be posted on our website with an updated date. Material changes will be communicated where required by law.

For questions, enquiries or requests relating to this Policy or Nerdbug’s services, please contact:

• Email: preciousemmanuel@nerdbug.io
• General enquiries: info@nerdbug.io

Nerdbug Limited, 2J Carrington Place, Milverton Court, Osapa, Lekki, Lagos, Nigeria.