Privacy Policy

This policy covers the website ndprtoolkit.com.ng(the “Site”), operated by Tanta Innovatives as data controller. It does not cover the open-source @tantainnovative/ndpr-toolkit library itself: that code runs entirely inside your own application and sends no data to us. When you build with the toolkit, youare the data controller for your users’ data.

We only collect personal data in two situations:

• NDPA audit report requests. When you use the audit tool and ask us to email your report, we collect your name, email address, organisation name (optional), and your overall score band and rating. We use these to deliver your report and respond to your request. If the form falls back to your own email app, the pre-filled draft also contains your per-module scores and top recommendations; you can edit that draft, and nothing leaves your device until you press send.
• Usage analytics. We use PostHog to collect anonymised/pseudonymised usage data (pages viewed, interactions, approximate location, device/browser) to understand how the Site is used and improve it. This relies on cookies and similar local storage.

The compliance audit itself is computed in your browser. Your individual answers are never sent to us; only the details listed above are, and only if you ask for the report.

• Audit requests — your consent, given when you submit the form, and our legitimate interest in responding to and improving the service.
• Analytics — our legitimate interest in measuring and improving the Site, balanced against your rights; where consent is required for cookies, we rely on it.

We do not sell your personal data. We share it only with the service providers (data processors) needed to run the Site:

• Web3Forms — a form service hosted outside Nigeria; receives audit report requests (name, email, organisation, score band and rating) and delivers them to us by email.
• PostHog — product analytics.
• Our hosting/CDN provider — serves the Site and processes standard server logs.

Some of our processors (e.g. PostHog and Web3Forms) operate outside Nigeria, including in the United States. Where personal data is transferred abroad, we rely on the transfer conditions permitted under the NDPA — such as the processor’s own data-protection commitments and contractual safeguards — and limit transfers to what is necessary to run the Site.

Audit report requests.Submitting the “Email me my report” form on the audit page transmits your name, email address, organisation name, overall score band and rating to Web3Forms’ servers outside Nigeria so they can be emailed to us. The form says so before you submit, and nothing else from the audit is sent. If you would rather not use that service, email us directly at hello@ndprtoolkit.com.ng.

We keep audit-request details only for as long as needed to respond to you and for reasonable follow-up, then delete them. Analytics data is retained in line with our analytics provider’s defaults and used in aggregate.

As a data subject under the NDPA 2023, you have the right to:

• access the personal data we hold about you;
• request rectification of inaccurate data;
• request erasure of your data;
• restrict or object to our processing;
• request portability of data you provided; and
• withdraw consent at any time (without affecting prior processing).

To exercise any of these, email privacy@tantainnovative.com. We will respond within the timeframe required by the NDPA.

We use cookies and local storage only for analytics (via PostHog). You can block or delete cookies in your browser settings, and use your browser’s “Do Not Track” or tracker-blocking features; the Site remains fully usable without analytics cookies.

We apply reasonable technical and organisational measures to protect personal data. No method of transmission or storage is perfectly secure, but we work to limit the data we hold and who can access it.

If you believe we have mishandled your data, please contact us first so we can put it right. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

Questions about this policy or your data? Email privacy@tantainnovative.com, or open an issue on GitHub.

We may update this policy as the Site evolves. Material changes will be reflected here with a new “last updated” date.