1. Scope
This supplement applies to the processing of personal data of people in Nigeria, and to processing by Trustaige Limited as a data controller established in Nigeria. It adds to our Privacy Policy; where the two differ, this supplement applies.
Trustaige Limited complies with the Nigeria Data Protection Act 2023 (NDPA) and the General Application and Implementation Directive (GAID) 2025 issued by the Nigeria Data Protection Commission (NDPC).
2. Data controller
- Legal Name: Trustaige Limited
- Address: Spacepad Building, KM 18 Lekki-Epe Expressway, Lagos, Nigeria
- Email: shield@trustaige.com
- Data Protection Officer: dpo@trustaige.com
3. Legal basis for processing under the NDPA
Under the NDPA (Sections 25–26), we process your personal data on the following lawful bases:
| Processing Activity | Lawful Basis | Reference |
|---|---|---|
| Platform authentication and session management | Performance of contract | NDPA s.25(1)(b)(i) |
| Sign-up and onboarding | Consent / Pre-contractual steps | NDPA s.25(1)(a), s.25(1)(b)(i) |
| Partner introductions | Consent | NDPA s.25(1)(a), s.26 |
| Audit logging and security monitoring | Legitimate interest (security) | NDPA s.25(1)(b)(v) |
| Threat detection (new device, impossible travel) | Legitimate interest (security) | NDPA s.25(1)(b)(v) |
| Device trust posture collection and compliance evaluation | Legitimate interest (security) / Consent | NDPA s.25(1)(a), s.25(1)(b)(v) |
| Mobile device management (enrollment, inventory, posture, remote actions) | Consent / Legitimate interest (security) | NDPA s.25(1)(a), s.25(1)(b)(v) |
| Compliance reporting and data retention | Legal obligation | NDPA s.25(1)(b)(ii) |
| Website delivery and security (server logs) | Legitimate interest (security) | NDPA s.25(1)(b)(v) |
| Website analytics (Google Analytics) | Consent, which you can withdraw at any time | NDPA s.25(1)(a), s.26, s.35; GAID 2025 |
| Advertising measurement (Google Ads conversions) | Consent, which you can withdraw at any time | NDPA s.25(1)(a), s.26, s.35; GAID 2025 |
| Platform service improvement (excluding website analytics) | Legitimate interest | NDPA s.25(1)(b)(v) |
| Responding to data subject rights requests | Legal obligation | NDPA s.34–38 |
Where we rely on legitimate interest, we have conducted a balancing assessment to ensure our interests do not override your rights and freedoms. Where we rely on consent, you can withdraw it at any time; withdrawal does not affect processing carried out before it (NDPA s.35).
4. Consent for cookies, analytics and advertising
In line with the NDPA and the GAID, website analytics and advertising measurement run only with your prior, specific consent. Our cookie banner offers Accept all and Reject all with equal prominence, lets you choose Analytics and Advertising separately, and loads nothing for a purpose until you allow it. We keep a record of your choice and when you made it in the ta_consent cookie. You can withdraw at any time from Cookie settings in the website footer. See Section 13 of our Privacy Policy and our Cookie Policy.
5. Your rights under the NDPA
Under the NDPA (Sections 34–38), you have the following rights regarding your personal data:
- Right of Access (s.34(1)(a)–(b)): You may request a copy of the personal data we hold about you.
- Right to Rectification (s.34(1)(c)): You may request correction of inaccurate or incomplete personal data.
- Right to Erasure (s.34(1)(d)): You may request deletion of your personal data, subject to legitimate retention requirements and a 30-day grace period.
- Right to Withdraw Consent (s.35): Where we rely on consent, you may withdraw it at any time. For website analytics and advertising, use Cookie settings in the website footer.
- Right to Object (s.36): You may object to processing based on legitimate interest.
- Right to Data Portability (s.38): You may request your data in a structured, commonly used, machine-readable format (JSON).
To exercise these rights, email dpo@trustaige.com with the subject line “Data Subject Request”. We will acknowledge your request within 72 hours and fulfill it within 30 days, or inform you if an extension is necessary.
6. Data Protection Officer
We have designated a Data Protection Officer (DPO) in accordance with NDPA Section 32. The DPO monitors our compliance with the NDPA, advises on data protection obligations, and is the point of contact for data subjects and the Nigeria Data Protection Commission:
- Email: dpo@trustaige.com
7. International data transfers
Where your personal data is transferred outside Nigeria — including to Google, which processes website analytics and advertising data in the United States and other countries where it operates — we ensure appropriate safeguards are in place in accordance with Part VIII of the NDPA (Sections 41–43), as described in Section 8 of our Privacy Policy.
8. Data retention
The retention periods in Section 10 of our Privacy Policy apply the NDPA’s storage-limitation principle (Section 24(1)(d)). Legal-obligation retention, such as payment records kept for 7 years, follows Nigerian tax and legal requirements.
9. Right to complain to the NDPC
If you believe that our processing of your personal data infringes the NDPA, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) under NDPA Section 46:
- Website: https://ndpc.gov.ng
We encourage you to contact our DPO first so we can attempt to resolve your concern directly.
10. Contact
- Data Protection Officer: dpo@trustaige.com
- General inquiries: shield@trustaige.com
- Address: Spacepad Building, KM 18 Lekki-Epe Expressway, Lagos, Nigeria