Privacy Policy

This policy covers the website ndprtoolkit.com.ng(the “Site”), operated by Tanta Innovatives as data controller. It does not cover the open-source @tantainnovative/ndpr-toolkit library itself: that code runs entirely inside your own application and sends no data to us. When you build with the toolkit, youare the data controller for your users’ data.

We only collect personal data in two situations:

• NDPA audit requests. When you use the audit tool and ask us to email your report, we collect your name, email address, organisation name (optional), and the self-assessment answers and score you submit. We use these to deliver your report and respond to your request.
• Usage analytics. We use PostHog to collect anonymised/pseudonymised usage data (pages viewed, interactions, approximate location, device/browser) to understand how the Site is used and improve it. This relies on cookies and similar local storage.

The compliance audit itself is computed in your browser; your individual answers are sent to us only if you choose to email yourself the report.

• Audit requests — your consent, given when you submit the form, and our legitimate interest in responding to and improving the service.
• Analytics — our legitimate interest in measuring and improving the Site, balanced against your rights; where consent is required for cookies, we rely on it.

We do not sell your personal data. We share it only with the service providers (data processors) needed to run the Site:

• Web3Forms — receives audit-form submissions and delivers them to us by email.
• PostHog — product analytics.
• Our hosting/CDN provider — serves the Site and processes standard server logs.

Some of our processors (e.g. PostHog and Web3Forms) operate outside Nigeria, including in the United States. Where personal data is transferred abroad, we rely on the transfer conditions permitted under the NDPA — such as the processor’s own data-protection commitments and contractual safeguards — and limit transfers to what is necessary to run the Site.

We keep audit-request details only for as long as needed to respond to you and for reasonable follow-up, then delete them. Analytics data is retained in line with our analytics provider’s defaults and used in aggregate.

As a data subject under the NDPA 2023, you have the right to:

• access the personal data we hold about you;
• request rectification of inaccurate data;
• request erasure of your data;
• restrict or object to our processing;
• request portability of data you provided; and
• withdraw consent at any time (without affecting prior processing).

To exercise any of these, email privacy@tantainnovative.com. We will respond within the timeframe required by the NDPA.

We use cookies and local storage only for analytics (via PostHog). You can block or delete cookies in your browser settings, and use your browser’s “Do Not Track” or tracker-blocking features; the Site remains fully usable without analytics cookies.

We apply reasonable technical and organisational measures to protect personal data. No method of transmission or storage is perfectly secure, but we work to limit the data we hold and who can access it.

If you believe we have mishandled your data, please contact us first so we can put it right. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

Questions about this policy or your data? Email privacy@tantainnovative.com, or open an issue on GitHub.

We may update this policy as the Site evolves. Material changes will be reflected here with a new “last updated” date.