Privacy policy

01Who we are

Nexcified Limited ("Nexcified", "we", "us") is a technology company based in Abuja, Nigeria. We design, build, host and support websites, web and mobile applications, software and AI solutions for businesses.

We are the data controller for the personal data described in this policy: we decide why and how it is used. When we host or process data on a client's behalf (for example their website visitors or customers), we act as that client's data processor under our agreement with them, and the client's own privacy policy applies to that data.

This policy covers nexcified.co, Nexcified Client (client.nexcified.co), Nexcified Pay (pay.nexcified.co), our emails, live chat, calls and our services generally.

02The laws we follow

We process personal data in line with the Nigeria Data Protection Act 2023 (NDPA) and the regulations and guidance of the Nigeria Data Protection Commission (NDPC).

Where we offer services to people in the United Kingdom or the European Economic Area, or monitor their behaviour on our website, we also follow the UK GDPR and the EU General Data Protection Regulation (GDPR) for that processing.

03Personal data we collect

We only collect what we need for the purposes below.

Contact and identity details: name, job title, company, email address, phone or WhatsApp number, and country or region.
Enquiry and project details: what you tell us in forms, chats, calls, emails, proposals and project discussions, including files you share with us.
Account details: your sign-in email, sign-in history, devices and sessions, two-step verification status and your role in your company's client account. We never store sign-in passwords; you sign in with one-time email codes.
Billing details: invoices, payments, billing address, tax ID if you give it, and payment status. Card details are collected by our payment partners, not by us (see "Payments" below).
Service and technical data: for services we run for you, such as hosting accounts, domains, uptime and security monitoring results.
Website and device data: IP address, browser, device type, pages viewed, referring page and approximate location derived from your IP address, collected through server logs and, only if you agree, analytics cookies.
Communications: messages you send us and records of emails, SMS and WhatsApp messages we send you about your account and services.
Marketing preferences: whether you subscribed to our newsletter and your cookie choices.

We do not intentionally collect special categories of personal data (such as health, religion or biometric data). Please don't send us such data unless a project specifically requires it and we have agreed how it will be protected.

04Where we get it from

From you, when you fill in a form, chat with us, book a call, sign up, accept a proposal, pay an invoice or use our apps.
Automatically, from your browser or device when you use our websites (see the cookie policy).
From your organisation, when a colleague adds you to your company's client account.
From public and business sources, for business-to-business outreach: company websites, business directories and map listings (for example Google Maps), and professional contact-finding services. We only use business contact details, for business purposes (see "Business outreach").
From partners, such as payment providers confirming a payment, or a client who refers you to us.

05How we use it and our lawful bases

We only use personal data when the law allows it. Each use has a lawful basis under the NDPA (and the GDPR where it applies):

To answer enquiries, prepare proposals and book calls: steps you ask us to take before a contract, or our legitimate interest in responding to business enquiries.
To deliver our services: running projects, hosting, maintenance, monitoring and support. Basis: performance of our contract with you or your organisation.
To run your accounts and keep them secure: sign-in codes, two-step verification, session management and fraud and abuse detection. Basis: contract and our legitimate interest in security.
To bill you and collect payments, including renewals, receipts and payment reminders. Basis: contract and legal obligation (tax and accounting records).
To send service messages by email, SMS or WhatsApp, such as invoices, downtime alerts and project updates. Basis: contract.
To send our newsletter and marketing emails: your consent, which you can withdraw at any time with the unsubscribe link.
For business outreach to companies that may benefit from our services: our legitimate interest in promoting our business (see below). You can object at any time.
To improve our website and services, using analytics only where you have allowed analytics cookies. Basis: consent.
To meet legal obligations and respond to lawful requests from authorities. Basis: legal obligation.
To establish, exercise or defend legal claims. Basis: legitimate interest.

Where we rely on legitimate interests, we have balanced them against your rights and expectations. You can ask us for details of that assessment.

06Business outreach

We sometimes contact businesses that publicly show a need for our services, for example a business without a working website, using contact details published by the business or found through business contact services.

We only use business contact details and only to offer services relevant to that business.
Every outreach email says who we are and includes a one-click unsubscribe link. Once you unsubscribe or ask us to stop, we add your email or domain to our do-not-contact list and won't contact you again.
We stop following up when you reply.
You can ask us at any time what information we hold about you and where it came from.

07Payments

Payments on Nexcified Pay are processed by licensed payment providers: Flutterwave and Stripe. With Flutterwave, you type card details on Nexcified Pay and they are encrypted on your device before they leave the page, then passed straight to Flutterwave. With Stripe, you type them on Stripe's own page.

We never store your full card number, security code (CVV) or card PIN. If you choose to save a card for renewals, the provider gives us only a token together with the card brand, last four digits and expiry date, so we can show which card is on file and charge renewals you have agreed to. The providers process your payment data under their own privacy policies and the PCI DSS security standard.

08Automated decisions and AI

We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.

We use automated tools to support our team, for example scoring how likely a business is to need a new website based on public signals, or drafting replies for a person to review. A member of our team reviews these before anything that affects you is decided. Where AI services help us process content you send us, that content is shared only with providers bound by data processing terms, and is not used to train their public models where the provider allows us to opt out.

10International transfers

Some of our providers store or process data outside Nigeria, for example in the European Union, the United Kingdom or the United States.

When personal data leaves Nigeria we follow Part VIII of the NDPA: we transfer it only to countries with adequate protection, or with appropriate safeguards such as standard contractual clauses or binding corporate rules, or on another basis the NDPA allows. For data covered by the GDPR, we use the European Commission's standard contractual clauses or the UK equivalent. You can ask us for a copy of the safeguards that apply.

11How long we keep it

We keep personal data only as long as we need it for the purpose it was collected, then delete or anonymise it.

Enquiries and chats that don't lead to work: up to 24 months after our last contact.
Client account, project and support records: for as long as you are a client, then up to 6 years, in case of questions or claims.
Invoices, payments and accounting records: 6 years after the end of the financial year they relate to, as required by Nigerian tax law.
Hosting accounts and website files we host: until the service ends, then up to 30 days so you can retrieve them, unless you ask for earlier deletion.
Backups: overwritten on a rolling basis, normally within 30 days.
Security and sign-in logs: 12 months.
Uptime monitoring results: about 95 days.
Business outreach records: until you object or unsubscribe (your email or domain then stays on our do-not-contact list so we can honour it), and otherwise no longer than 24 months without a reply.
Newsletter subscribers: until you unsubscribe.
Cookie consent records: 12 months, as described in the cookie policy.

12How we protect it

We use technical and organisational measures appropriate to the risk, including:

encryption in transit (HTTPS/TLS) on all our websites and apps, and encryption at rest for sensitive secrets such as server access tokens;
sign-in with one-time email codes, optional two-step verification, session limits and automatic sign-out after inactivity;
role-based access, so team members can only see what their role needs, with an audit log of administrative actions and a security log of sign-ins and sensitive events;
bot protection on public forms, rate limiting and monitoring for suspicious activity;
regular backups, security updates, uptime and vulnerability monitoring of the systems we run;
confidentiality obligations for our team and contractors, and data processing agreements with our providers.

No system is completely secure. If a personal data breach is likely to put your rights at risk, we will notify the NDPC within 72 hours of becoming aware of it as the NDPA requires, and tell you without undue delay where the risk is high.

13Your rights

Under the NDPA (and the GDPR where it applies) you have the right to:

be informed about how your data is used (this policy);
access the personal data we hold about you and receive a copy;
correct inaccurate or incomplete data;
delete your data where there is no good reason for us to keep it;
restrict how we use it in some circumstances;
object to processing based on legitimate interests, including business outreach, and to direct marketing at any time;
data portability: receive data you gave us in a common machine-readable format, or have it sent to another organisation;
withdraw consent at any time, without affecting processing that took place before;
not be subject to decisions based solely on automated processing that significantly affect you.

To use any of these rights, email privacy@nexcified.co. We may ask you to confirm your identity. We respond within 30 days, and we don't charge a fee unless a request is clearly unfounded or excessive. Clients can also see and update much of their information directly in Nexcified Client.

14Complaints

If you are unhappy with how we have handled your personal data, please contact us first at privacy@nexcified.co and we will do our best to resolve it.

You also have the right to complain to the Nigeria Data Protection Commission (ndpc.gov.ng). If you are in the UK, you can complain to the Information Commissioner's Office (ico.org.uk); in the European Economic Area, to the data protection authority in your country.

15Children

Our websites and services are for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, please contact us and we will delete it.

16Links to other websites

Our websites may link to other websites and services, such as social networks or a client's website. We are not responsible for their privacy practices; please read their own policies.

17Changes to this policy

We may update this policy as our services or the law change. We will post the new version here with a new "last updated" date, and if the changes are significant we will tell clients by email or in Nexcified Client before they take effect.

18Contact us

For anything about privacy or this policy, including requests to exercise your rights, contact our data protection team:

Email: privacy@nexcified.co
General enquiries: info@nexcified.co
Post: Nexcified Limited, Abuja, Nigeria