Privacy Policy

Jadings360 Limited ("Jadings360", "we", "us" or "our") provides business advisory, compliance and governance services to small and medium sized businesses in Nigeria. This Privacy Policy explains how we collect, use, disclose, store and protect personal data through our website at www.jadings360.com (the "Website"), in our dealings with prospective clients, and in the course of our client engagements.

It is issued in compliance with the Nigeria Data Protection Act, 2023 (the "NDPA") and the Nigeria Data Protection Act General Application and Implementation Directive, 2025 (the "GAID") issued by the Nigeria Data Protection Commission (the "NDPC"), together with any other law applicable to the protection of personal data in Nigeria.

Jadings360 Limited is a company registered in Nigeria under RC 2882939, with its registered office at 39 Alfred Rewane Road, Ikoyi, Lagos. References in this Policy to Jadings360 are references to that entity.

• "Data Controller" means a person who alone or jointly with others determines the purpose and manner of processing personal data.
• "Data Processor" means a person who processes personal data on behalf of or on the instruction of a data controller.
• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Sensitive Personal Data" means personal data of the categories listed in section 30 of the NDPA, including data revealing health status, religious or political belief, and trade union membership.
• "Data Subject" means the individual to whom personal data relates, including a website visitor, a prospective client, a client contact, or a director, shareholder or employee of a client.
• "Client" means a person who has accepted our written scope letter.
• "Client Data" means personal data that a Client gives us, or that we obtain on a Client's behalf, in order to carry out an engagement.

Our role depends on the category of personal data involved.

• Enquiry Information, Marketing Information, Website Usage Information and our own billing and Client relationship records. Jadings360 is the data controller of this information because we determine the purpose and manner of its processing.
• Client Data. In most engagements, such as payroll and tax filings, data protection officer services, NDPA audit support and governance work, the Client is the data controller and Jadings360 acts as a data processor. We process Client Data on the Client's instructions, for the purpose of the engagement, and under the data processing terms attached to our scope letter. Where the law requires us to keep our own records of an engagement, we are the data controller of those records.

Where we act as a data processor, we do not use Client Data for any purpose of our own, including marketing, analytics or product development, unless the information has first been irreversibly anonymised so that no Data Subject can be identified from it.

• Enquiry Information, including your name, email address, phone number, company name, role, the service you are interested in, and anything you write in your message.
• Client Engagement Information, including details of the business and its directors, shareholders and officers, such as names, addresses, and identification and tax numbers where a filing requires them. It also includes company records, contracts and documents provided for review, staff details needed for payroll and tax work, billing information, and our communications with you.
• Marketing Information, including your contact details, your preferences for newsletters and updates, and the record of your consent.
• Website Usage Information, including your IP address, browser type, device, pages viewed and referring website, together with information collected through cookies and similar technologies as described in section 8.

We collect only the information that is adequate, relevant and limited to what is necessary for the purposes described in this Policy, in line with the data minimisation principle in section 24 of the NDPA. We do not ask for Sensitive Personal Data through the Website. Where an engagement requires us to handle Sensitive Personal Data, we agree the handling in the scope letter and apply additional safeguards.

We rely on the following lawful bases under section 25 of the NDPA.

• Enquiry Information is processed to take steps at your request before entering a contract, and for our legitimate interest in responding to enquiries.
• Client Engagement Information is processed for the performance of our contract with the Client and to comply with legal obligations that apply to us, such as record keeping and any anti money laundering duties.
• Where we act as a data processor, we process Client Data on the Client's instructions. The Client is responsible for having a lawful basis for giving us that data, as set out in section 12.
• Marketing Information is processed on the basis of your consent.
• Website Usage Information is processed on the basis of our legitimate interest in securing and maintaining the Website. Analytics cookies are used only with consent.

Where we rely on legitimate interest, we balance that interest against your rights and freedoms and do not rely on it where your rights override it.

• To respond to your enquiry and arrange your free first call.
• To provide the advisory, compliance and governance services you engage us for, including making filings and registrations with regulators on your behalf.
• To invoice you, receive payment and manage our relationship with you.
• To send you insights, newsletters and updates, where you have consented.
• To maintain, secure and improve the Website.
• To detect, investigate and prevent unauthorised access or fraudulent activity.
• To comply with a legal obligation or a lawful request from the NDPC or another competent authority.

We do not process information for a purpose that is incompatible with the purpose for which it was collected unless a further lawful basis and, where required, prior notice to you is obtained.

• Where we rely on consent, for example for newsletters or for analytics cookies, we ask for a clear and specific opt in before the processing starts, and we keep a record of that consent.
• Consent is never bundled with acceptance of this Policy, our Terms of Use or a scope letter. You may decline an optional feature without losing access to our services.
• You may withdraw consent at any time by using the unsubscribe link in a message, through the cookie settings on the Website, or by writing to dpo@jadings360.com.
• Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal and takes effect within 5 working days.

Jadings360 is the data controller of personal data collected through cookies and similar technologies on the Website. These are small files stored on your device that help a site work, remember your choices and show how it is used. This section is issued in line with Article 19 of the GAID.

Strictly necessary cookies do not need consent because the Website cannot function securely without them. We do not use them to track you across other websites. Client Data is never placed in a cookie or sent to an analytics service.

A banner appears before any optional cookie is set. You may accept all, reject non-essential cookies, or choose by category. Optional categories are off by default, rejecting is as easy as accepting, and your choice does not affect access to the Website or our services. You may change or withdraw consent at any time through the "Cookie settings" link in the footer of every page, and withdrawal does not affect earlier use. You may also block cookies in your browser, although parts of the Website may then not work properly. We will ask for your choice again if the cookies we use change materially.

Our analytics provider acts on our behalf under a written agreement. Any transfer of this information outside Nigeria follows section 11. Your rights in relation to information collected through cookies are those described in section 13.

We do not make decisions about you based solely on automated processing. Where we use AI tools to support our work, we do not enter Client Data into any tool unless it has been approved for that use and the data is anonymised or the Client has agreed. Output from such tools is reviewed by a qualified person before it reaches a Client.

Jadings360 does not sell personal data. We disclose information only in the following circumstances.

• With service providers engaged to operate our business, such as website hosting, email, scheduling and cloud storage providers, each of which is bound by a written agreement that restricts use of the information to the services provided to us.
• With other professional partners, where your engagement includes services we do not solely provide, and only after we have told you.
• With regulators and government agencies, where we make a filing or registration on a Client's behalf, limited to the information the filing requires.
• Where required by law, regulation, a valid court order or a lawful directive of the NDPC.
• With professional advisers and insurers, under duties of confidentiality.
• In connection with a merger, acquisition or sale of assets, subject to equivalent protections being maintained for any personal data transferred.

Where personal data is stored or processed outside Nigeria, for example through cloud infrastructure located in another country, we transfer it only where one of the following applies, in accordance with sections 41 to 43 of the NDPA.

• The recipient country or the recipient organisation has been assessed as providing an adequate level of data protection by the NDPC.
• Appropriate safeguards are in place, such as standard contractual clauses or binding corporate rules incorporated into our agreement with the service provider.
• The transfer is necessary for a reason permitted under the NDPA, such as the performance of a contract or the protection of the vital interest of the Data Subject, and no less restrictive means is reasonably available.

Where a Client gives us personal data about its directors, shareholders, employees, customers or other individuals, the Client remains responsible, as data controller, for the following.

• Having the authority and a lawful basis under the NDPA to share that data with us for the engagement.
• Informing those individuals that their data will be shared with its advisers.
• Ensuring that the data is accurate and giving us only what is necessary for the engagement.
• Telling us in advance if any of the data is Sensitive Personal Data.
• Directing requests from those individuals about their rights to the Client in the first instance.

Subject to the exceptions permitted under the NDPA, a Data Subject has the following rights in respect of their personal data.

• The right to be informed of how their personal data is processed.
• The right to access a copy of their personal data.
• The right to request correction of inaccurate or incomplete personal data.
• The right to request erasure of personal data that is no longer necessary for the purpose for which it was collected.
• The right to request restriction of processing in defined circumstances.
• The right to object to processing carried out on the basis of legitimate interest, and to object to direct marketing at any time.
• The right to data portability, where processing is based on consent or contract and carried out by automated means.
• The right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
• The right to lodge a complaint with the NDPC.

Because we act as a data processor of most Client Data, a person wishing to exercise a right in respect of that information should direct the request to the relevant Client in the first instance. We will support the Client in responding. A request concerning Enquiry Information, Marketing Information, Website Usage Information or our own Client records, or a request to withdraw consent given directly to us, may be sent to us using the contact details in section 18, and we will respond within 72 hours. We may ask for information that confirms your identity before acting on a request.

Personal data is stored using cloud infrastructure with appropriate technical and organisational safeguards. We retain personal data only for as long as necessary for the purpose for which it was collected, to comply with a legal obligation, or to establish, exercise or defend a legal claim, after which it is securely deleted or anonymised.

• Enquiry Information that does not lead to an engagement is retained for 12 months after our last contact with you.
• Client Engagement Information is retained for the duration of the engagement and for six years after it ends, or for any longer period the law requires.
• Marketing Information is retained until you withdraw consent.
• Website Usage Information is retained for 12 months.
• Records of personal data breaches and complaints are retained for six years.

A Client may ask us to return or delete Client Data when an engagement ends, subject to records we are required to keep by law or professional duty.

• Encryption of data in transit.
• Secure authentication and access controls limiting access to information on a need to know basis.
• Storage of Client files only in approved systems.
• Confidentiality and data protection undertakings from everyone who works with us.
• Secure deletion of data at the end of its retention period.
• Periodic review of our technical and organisational measures.

We carry out a Data Protection Impact Assessment before starting any processing that is likely to result in a high risk to Data Subjects, such as a new service involving large scale processing of Sensitive Personal Data, and we review the assessment periodically in line with the GAID.

Where we become aware of a personal data breach that is likely to result in a risk to the rights and freedoms of a Data Subject, we will notify the NDPC within seventy two hours of becoming aware of the breach, in accordance with section 40 of the NDPA. Where the breach is likely to result in a high risk to a Data Subject, we will also notify the affected Data Subject without undue delay. Where the breach affects Client Data that we hold as a data processor, we will notify the Client without undue delay so that the Client can meet its own duties.

Jadings360 has appointed a Data Protection Officer responsible for overseeing our compliance with the NDPA and the GAID, handling data protection enquiries, and receiving requests to exercise Data Subject rights or to withdraw consent.

• Name: Blessing Agboola.
• Email: dpo@jadings360.com.
• Phone: 08068964260.

A Data Subject who believes that their data privacy right has been violated may submit a Standard Notice to Address Grievance to us at dpo@jadings360.com, describing the concern in reasonable detail. We will acknowledge the notice promptly and respond within 72 hours. If the Data Subject is not satisfied with our response, or does not receive a response within the stated timeline, they may escalate the matter to the NDPC at www.ndpc.gov.ng.

The Website and our services are intended for businesses and their representatives. We do not knowingly collect personal data from individuals under the age of 18. Where Client Data relates to a child or a person lacking legal capacity, we treat it with the same safeguards applicable to Sensitive Personal Data, and the Client remains responsible for the lawful basis for sharing it.

We may update this Privacy Policy periodically to reflect changes in our practices, services or legal requirements. Where a change is significant, we will notify Clients by email and post a notice on the Website before the change takes effect. The version number and effective date at the top of this Policy indicate the current version in force.

Questions about this Privacy Policy or how personal data is handled may be directed to the following.

• Data Protection Officer: see section 18 above.
• General enquiries: hello@jadings360.com.
• Nigeria Data Protection Commission, for complaints not resolved directly with us.