1. ABOUT US

www.zurielconsulting.com.ng is operated by ZURIEL CONSULTING Limited (“ZURIEL CONSULTING”, “we”, “us”, or “our”). We are registered under the laws of the Federal Republic of Nigeria, with our registered office at 14a Da Silva Street, off Chris Madueke Drive, Lekki Phase 1, Lagos, Nigeria.

For the purposes of the Nigeria Data Protection Act 2023 (NDPA) and other applicable data protection laws in Nigeria, ZURIEL CONSULTING Limited acts as the Data Controller in respect of personal data collected through this website and during the provision of our services.

2. SCOPE AND GOVERNING LAW

This Privacy Policy sets out how we collect, process, store, share, and protect your personal data across all our service points, digital platforms, and physical offices.

This policy is governed by and drafted in compliance with the Nigeria Data Protection Act 2023 (NDPA) and directives issued by the Nigeria Data Protection Commission (NDPC). By accessing our website, engaging our services, or interacting with us, you acknowledge the data practices described in this policy.

3. LEGAL BASES FOR PROCESSING PERSONAL DATA

We process your personal data only where we have a valid legal basis under Section 25 of the NDPA 2023, including:

  • Performance of a Contract: Processing necessary to execute an agreement with you or take pre-contractual steps at your request.
  • Legal Obligation: Processing required to comply with statutory requirements, tax obligations, or regulatory requests.
  • Legitimate Interests: Processing necessary for our legitimate operational or business interests, provided such interests do not override your fundamental rights and privacy interests.
  • Consent: Where you have given explicit, clear, and unambiguous consent for specific processing operations (e.g., subscribing to promotional updates).
  • Vital Interests: Processing necessary to protect your vital interests or those of another individual.
  1. PERSONAL INFORMATION WE COLLECT

We collect personal information that you provide to us directly or that is generated automatically when you interact with our digital channels and physical offices, including:

  • Identity Data: Full name, job title, company name, government-issued IDs, and passport photographs.
  • Contact Data: Email address, telephone number, billing address, and residential/business location.
  • Technical & Usage Data: IP address, browser type, operating system, device characteristics, pages visited, and interaction logs.
  • Service & Financial Data: Instructions, correspondence records, payment details, transaction logs, and billing history related to services consumed or requested.
  1. PURPOSE OF PROCESSING

We use your personal data for the following specific purposes:

  • To deliver, manage, and execute our legal advisory, corporate, and consulting services.
  • To verify your identity and conduct regulatory due diligence/KYC checks.
  • To communicate with you regarding updates, client matters, operational changes, or inquiries.
  • To manage internal record-keeping, client invoicing, and accounting requirements.
  • To protect the security, integrity, and operational safety of our website and digital systems.
  • To send marketing and promotional communications, subject to your explicit opt-in preference.
  • To comply with extant Nigerian laws, court orders, and regulatory requests.
  1. CONSENT & MARKETING COMMUNICATIONS

Where processing relies on consent, such consent must be freely given, specific, informed, and unambiguous.

  • Direct Marketing: We will only send you promotional materials if you have explicitly opted in. You maintain an absolute right to unsubscribe or withdraw consent at any time via the “unsubscribe” link in our emails or by contacting our Data Protection Officer.
  • Withdrawal: Withdrawing consent does not affect the lawfulness of any processing conducted prior to such withdrawal, nor does it affect processing grounded in other lawful bases (such as legal obligations or contractual necessity).
  1. INFORMATION SHARING & DISCLOSURE

We do not sell, rent, or trade your personal data to third parties. We may disclose your personal data only under the following circumstances:

  • Third-Party Service Providers: Trusted vendor partners, cloud infrastructure providers, IT support contractors, and auditors operating under legal obligations of confidentiality and data processing agreements.
  • Legal & Regulatory Obligations: Statutory bodies, law enforcement agencies, tax authorities, or courts where required by law, subpoena, or judicial order.
  • Corporate Transactions: Affiliates or successors in the event of a merger, acquisition, restructuring, or asset transfer, subject to strict data security standards.
  1. INTERNATIONAL DATA TRANSFERS

Where personal data is transferred, stored, or processed outside the Federal Republic of Nigeria (such as through cloud hosting systems or international software platforms), we ensure that such transfers comply strictly with Sections 41–43 of the NDPA 2023. We enforce adequate safeguards, including Standard Contractual Clauses, transfers to jurisdictions with approved data protection adequacy frameworks, or explicit data subject consent where required.

  1. DATA SECURITY & BREACH MANAGEMENT

We implement robust technical, physical, and organizational security measures—including encrypted communication channels, access restrictions, and secure server environments—to safeguard your personal data against unauthorized access, loss, corruption, or alteration.

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware, and notify affected data subjects without undue delay in accordance with Section 40 of the NDPA 2023.

  1. DATA RETENTION

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including satisfying any legal, regulatory, accounting, or statutory reporting obligations. Once personal data is no longer required, it is securely destroyed, deleted, or permanently anonymized.

  1. YOUR DATA SUBJECT RIGHTS UNDER THE NDPA 2023

Subject to applicable legal exceptions, you hold the following statutory rights regarding your personal data:

  • Right of Access: Request confirmation of whether we process your data and receive a copy of your personal data held by us.
  • Right to Rectification: Request immediate correction of inaccurate or incomplete personal data.
  • Right to Erasure (“Right to be Forgotten”): Request the deletion of your personal data where it is no longer necessary for the purpose collected, or where consent is withdrawn.
  • Right to Restrict or Object to Processing: Object to or restrict processing grounded in legitimate interests, or object unconditionally to direct marketing/profiling.
  • Right to Data Portability: Request a copy of your personal data in a structured, commonly used, and machine-readable format for transfer to another controller.
  • Right against Automated Decision-Making: Object to automated individual decision-making and profiling that produces legal or significant effects.
  1. COOKIES AND TRACKING TECHNOLOGIES

Our website utilizes cookies and similar tracking technologies to enhance user experience, evaluate traffic patterns, and optimize site administration. Technical cookies essential for browsing do not require consent, whereas operational, analytical, or preference cookies require your explicit opt-in via our website cookie consent banner. Please review our standalone Cookie Policy for comprehensive details.

  1. DATA PROTECTION OFFICER & REMEDIES

If you have any questions, complaints, or wish to exercise your rights under this Privacy Policy or the NDPA 2023, please contact our Data Protection Officer (DPO) using the details below:

Data Protection Desk / DPO

ZURIEL CONSULTING Limited

14a Da Silva Street, off Chris Madueke Drive, Lekki Phase 1, Lagos, Nigeria

Email: dpo@zuriel.com.ng | info@zuriel.com.ng

Response Time: We will acknowledge and respond to all legitimate requests within fourteen (14) days of receipt.

If you remain dissatisfied with our response, you have the right to lodge an official complaint directly with the Nigeria Data Protection Commission (NDPC) at www.ndpc.gov.ng.

  1. UPDATES TO THIS PRIVACY POLICY

We review and update this Privacy Policy periodically to reflect statutory updates, technology changes, and operational enhancements. Any amendments will be published on this page with an updated revision date.