Legal
ENYEMAKA Privacy Policy
Version 1.1 · Effective August 5, 2026
1. About this policy
1.1 This policy explains how ENYEMAKA collects, uses, shares, protects and deletes personal data, and the rights people have over their personal data.
1.2 It applies to everyone whose personal data we process, including:
- visitors to enyemaka.co;
- people who send us an enquiry or a project request;
- clients and the people who represent them;
- people who apply to work with us as specialists, and the specialists we engage ("contractors");
- people we engage to review applications and assessments ("reviewers");
- business contacts, suppliers and professional advisers; and
- individuals whose data appears in material a client gives us for a project.
1.3 This policy is written to meet the Nigeria Data Protection Act 2023 ("NDPA") and, where it applies to us, the UK General Data Protection Regulation and the Data Protection Act 2018.
1.4 In this policy, "we", "us" and "our" mean the company named in section 2. "You" means the person whose personal data we process.
2. Who we are and how to contact us
2.1 ENYEMAKA is a managed professional services business. Clients engage us for defined pieces of work, and we deliver that work through vetted specialists whom we assign, manage and quality-check.
2.2 ENYEMAKA is operated by Enyemaka Consulting LTD, a company registered in Nigeria with registration number 9668273, whose registered office is at Suleiman Barau Road suleja. That company is the data controller for the personal data described in this policy.
2.3 For any question about this policy or your personal data, or to exercise any of your rights, contact us at:
- Email: privacy@enyemaka.co
- Post: Suleiman Barau Road suleja
2.4 In some client projects, we process personal data on the client's instructions, for example where a client asks us to analyse its customer records. In those cases the client is the data controller for that data, we act on its behalf, and the project agreement sets out how we handle it.
3. The personal data we collect
3.1 What we collect depends on how you deal with us.
| Category | Examples | Where it comes from |
|---|---|---|
| Identity and contact | Name, email address, phone or WhatsApp number, business name, job title | You, or the business you represent |
| Enquiries and project requests | The service you are interested in, your description of the problem or project, budget range, preferred timeline, links to your website or social profiles, files you attach, and how you found us (such as the page that referred you) | You |
| Account | Login email, account identifiers, role, password-setup and password-reset records, login times | You, and our systems |
| Project | Scope, deliverables, milestones, messages, revision requests, quality-check records, approvals and handover records | You, our team and the specialists working on the project |
| Payments and refunds | Amount, currency, payment status, transaction reference, payment provider, refund requests, your refund statement and the supporting evidence you send | You, and our payment providers |
| Specialists and applicants | Application answers, skills, experience, portfolio links, CV, assessment work, scores and reviewer notes, performance scores, assignment history, and bank details for payouts | You, our reviewers and our team |
| Reviewers | Account details, review activity, scores and notes entered, and signed confidentiality and engagement agreements | You, and our systems |
| Signed documents | Your drawn signature, the date and time of signing, and the IP address and browser details recorded when you sign | You, and our systems |
| Technical | IP address, approximate country derived from it, browser and device type, session information, security logs, and page-view statistics | Our systems and service providers |
| Business contacts | Name, role, employer, business email or phone number, professional profile, and where we found the details | Public business websites, professional networks and directories, and referrals |
3.2 We do not need sensitive personal data, such as health, religious or biometric data, to provide our services, and we ask you not to send it unless a project genuinely requires it. If a project does involve sensitive data, we agree how it will be handled before any work starts.
3.3 Card details are entered directly on our payment providers' pages. We do not see or store full card numbers.
4. How we use personal data and our legal bases
4.1 We only use personal data for the purposes below. We do not use it for an unrelated purpose without a lawful basis.
| Purpose | Legal basis |
|---|---|
| Replying to enquiries and reviewing project requests | Taking steps you have asked for before entering a contract; our legitimate interest in responding to business enquiries |
| Agreeing scope, delivering projects, quality checks and handover | Performance of our contract with you |
| Taking payments and processing refunds | Performance of our contract; compliance with legal obligations |
| Assessing applicants, engaging specialists and reviewers, and paying them | Taking steps before a contract; performance of our contract with them |
| Choosing which currency to show you, based on your approximate location | Our legitimate interest in showing prices in a relevant currency |
| Keeping accounts secure, preventing fraud and keeping audit records | Our legitimate interests; compliance with legal obligations |
| Understanding how the website is used, using anonymous page-view statistics | Our legitimate interest in improving the website |
| Contacting businesses that may need our services | Our legitimate interest in business development, balanced against your rights (see section 13) |
| Publishing testimonials or portfolio examples | Your consent, or the client's permission under the project agreement |
| Keeping financial and tax records, and responding to lawful requests | Compliance with legal obligations |
| Handling complaints, disputes and legal claims | Our legitimate interest in protecting our legal rights |
4.2 Where we rely on consent, you can withdraw it at any time by contacting us. Withdrawing consent does not affect anything we did before you withdrew it.
5. Access by specialists and reviewers
5.1 A specialist assigned to a project receives only the information needed to carry out that assignment. Specialists do not receive clients' contact details, and they communicate with clients only through ENYEMAKA.
5.2 Reviewers see only the applications and assessments they are asked to review.
5.3 Specialists and reviewers are bound by written confidentiality obligations. They must not use, copy, keep or share personal data for any purpose other than their assigned work, and their access ends when that work ends.
5.4 A specialist does not acquire any right to a client's data because they worked on the client's project.
6. Who we share personal data with
6.1 We do not sell personal data.
6.2 We share personal data only with the following, and only as far as needed:
| Recipient | Purpose |
|---|---|
| Supabase | Hosts our database, user accounts and stored files |
| Vercel | Hosts our website and provides anonymous page-view statistics |
| Resend and Zoho | Send and receive our email |
| Paystack | Processes payments and refunds in Naira, and payouts to specialists |
| Flutterwave | Processes payments and refunds in pounds and US dollars |
| ipapi.co | Receives your IP address to estimate your country, so the request form can show a relevant currency |
| Specialists and reviewers | Carry out assigned work, as described in section 5 |
| Professional advisers | Lawyers, accountants and auditors, under duties of confidentiality |
| Authorities | Where the law, a court order or a regulator requires it, or to prevent fraud or protect legal rights |
6.3 Our service providers process personal data on our instructions and under contractual terms that require them to protect it. Paystack and Flutterwave also process payment data as controllers in their own right, under their own privacy policies.
6.4 If our business is reorganised, sold or merged, personal data may be transferred to the new owner, who must continue to protect it in line with this policy.
7. Transfers outside Nigeria
7.1 Some of our service providers store or process data outside Nigeria, including in the European Union, the United Kingdom and the United States. Our specialists may also be located in different countries.
7.2 Where we transfer personal data outside Nigeria, we do so in line with the NDPA, relying on adequate data protection in the receiving country or on appropriate safeguards, such as contractual terms that require the recipient to protect the data to the standard the NDPA requires.
8. How long we keep personal data
8.1 We keep personal data only for as long as we need it for the purpose it was collected for, or as long as the law requires.
| Records | How long we keep them |
|---|---|
| Enquiries and project requests that do not become projects | 24 months after our last contact |
| Client project records | For the duration of the project, then 6 years after it ends |
| Payment, refund and accounting records | 6 years after the end of the financial year they relate to |
| Unsuccessful applications and assessment work | 12 months after the decision |
| Specialist and reviewer records | For the duration of the engagement, then 6 years after it ends |
| Signed agreements | For as long as the agreement applies, then 6 years |
| Business contact records | Until you ask us to stop contacting you, or 24 months after our last contact |
| Security and server logs | As kept by our hosting providers, generally no more than 90 days |
8.2 Our database provider keeps backups for a limited period, after which deleted data is no longer recoverable.
8.3 When we no longer need personal data, we delete it or anonymise it. We may keep it longer where we need it to deal with a dispute or legal claim, and only for that purpose.
9. Cookies, browser storage and analytics
9.1 Our public website does not set cookies.
9.2 When you sign in to a client, specialist or admin account, we set a cookie that keeps you signed in. Without it the account area cannot work.
9.3 Your browser also stores your light or dark display choice and whether you have closed certain notices. These stay on your device and are not sent to us. If you arrive through one of our campaign links, your browser also remembers the campaign details for that visit and sends them with any enquiry or project request you submit, so we know which of our activities led you to us.
9.4 We use Vercel Web Analytics to count page views. It does not use cookies and does not identify individual visitors.
9.5 We do not use advertising or cross-site tracking technologies. If we introduce any non-essential cookies in future, we will ask for your consent first where the law requires it.
10. How we protect personal data
10.1 We protect personal data with technical and organisational measures appropriate to the risk, including:
- encryption of data in transit between your device and our systems;
- access to our database only through server-side systems, with no direct public access;
- role-based access, so that clients, specialists, reviewers and staff see only what their role requires;
- time-limited links for downloading stored files;
- card payments handled entirely by our payment providers;
- records of significant administrative actions; and
- written confidentiality obligations for everyone who works with personal data on our behalf.
10.2 No system is completely secure. We review our measures as our systems change, and we act on weaknesses we identify.
11. Your rights
11.1 Under the NDPA, and the UK GDPR where it applies, you have the right to:
- be told how we use your personal data, which is the purpose of this policy;
- get a copy of the personal data we hold about you;
- have inaccurate or incomplete data corrected;
- have your data deleted where we no longer have a lawful reason to keep it;
- ask us to restrict how we use your data;
- object to our use of your data where we rely on legitimate interests, and to stop direct marketing at any time;
- receive data you gave us in a commonly used electronic format, and have it sent to another organisation where technically possible;
- withdraw consent where we rely on it; and
- not be subject to a decision based solely on automated processing that significantly affects you (see section 12).
11.2 To exercise any of these rights, contact us using the details in section 2. We may ask you to confirm your identity before acting on a request.
11.3 We will respond within one month of receiving a verified request. If a request is complex, we may extend this where the law allows, and we will tell you why.
11.4 Some rights are limited. For example, we may need to keep certain records to meet legal obligations or to deal with a legal claim. If we cannot fully meet a request, we will explain why.
12. Automated decisions
12.1 We use structured scoring to help our team assess project requests, specialist applications and performance, and refund eligibility.
12.2 These scores support decisions. They do not make them. Every decision that affects you, including accepting or declining an application, assigning work, approving a payout and deciding a refund, is made by a person.
13. Business contacts and marketing
13.1 We may contact businesses that we believe could benefit from our services, using business contact details we find in public sources such as company websites, professional networks and directories, or through referrals.
13.2 When we first contact you this way, we tell you who we are and how we found your details, and we give you a simple way to ask us not to contact you again.
13.3 If you ask us to stop, we record your request and do not contact you again for marketing.
13.4 Emails about an enquiry you made, a project, an application or a payment are service messages, not marketing. We send them because they are part of the relationship you have with us.
14. Children
14.1 Our services are for businesses and adults. We do not knowingly collect personal data from anyone under 18.
14.2 If we learn that we hold a child's personal data without a lawful basis, we will delete it. If a client project involves children's data, we agree the safeguards in writing before any work starts.
15. Personal data breaches
15.1 If we become aware of a breach of security affecting personal data, we will act promptly to contain it, assess the risk to the people affected, and take steps to limit any harm.
15.2 Where the law requires it, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of the breach, and the UK Information Commissioner's Office where UK law applies. Where a breach is likely to result in a high risk to you, we will also tell you directly, without undue delay, what happened and what you can do.
15.3 We keep a record of every breach, including those we are not required to report.
16. Changes to this policy
16.1 We update this policy when our services, systems or legal obligations change. The version number and effective date at the top show when it last changed.
16.2 If we make a significant change to how we use personal data, we will tell people affected by it, by email or through their account, before the change takes effect.
17. Complaints
17.1 If you are unhappy with how we have handled your personal data, please contact us first using the details in section 2. We will acknowledge your complaint, look into it and reply.
17.2 You also have the right to complain to the Nigeria Data Protection Commission (ndpc.gov.ng). If you are in the United Kingdom, you can complain to the Information Commissioner's Office (ico.org.uk).