How we handle your personal data.

Who we are

This website is operated by PRISM IE Limited (in formation), Abuja, Nigeria (“PRISM IE”, “we”, “us”). We are the data controller for the personal data described in this notice. You can contact our data protection contact at EDIT: DPO email.

This notice covers visitors to this website and people who contact us from anywhere in the world. Personal data processed in the course of client engagements is governed by the contract and data processing agreement for that engagement.

What we collect

• Enquiry details you give us when you email or write to us, such as your name, organisation, role, email address, telephone number and the content of your message.
• Technical data collected automatically when you visit the site, such as your IP address, browser type, device information and the pages you request, held in server and security logs.
• Cookies. The site uses only the cookies needed for it to work and stay secure. EDIT: if you add analytics, list the tool and its cookies here and add a consent banner.

Why we use it, and our lawful basis

We process personal data in line with the data protection law that applies to you. That includes the Nigeria Data Protection Act 2023 and, where you are in the European Economic Area or the United Kingdom, the GDPR or UK GDPR. We rely on the following grounds:

• To reply to your enquiry and arrange briefings, diagnostics or meetings: to take steps at your request before entering into a contract, and our legitimate interest in responding to people who contact us.
• To keep the website secure and working: our legitimate interest in protecting our systems and visitors.
• To meet legal and regulatory obligations: where the law requires us to keep or disclose information.

We do not use your data for automated decision-making that has legal or similar effects on you, and we do not sell it.

Who we share it with

We share personal data only with service providers who help us run the website and our communications, such as our hosting, security and email providers, under contracts that require them to protect it, and with authorities where the law requires. EDIT: name your hosting, CDN and email providers.

Transfers across borders

We are based in Nigeria, and some of our service providers are in other countries, so your data may be transferred across borders. Where this happens, we use the safeguards that the applicable law permits, such as contractual clauses or a recognised adequacy decision.

How long we keep it

We keep enquiry correspondence for up to EDIT: 24 months after our last contact if no engagement follows. Security logs are kept for EDIT: 90 days unless needed to investigate an incident. Where an engagement follows, records are kept for the period set out in the engagement terms and as required by law.

Your rights

Depending on where you live, you may have the right to be informed about our use of your data, to access it, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent where we rely on consent. To use any of these rights, write to our data protection contact. We will respond within the time the law allows.

If you are not satisfied with our response, you may complain to the Nigeria Data Protection Commission or, if you are in the EEA or the UK, to your local data protection authority.

Security

We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit, access controls and separation between client environments.

Changes to this notice

We may update this notice from time to time. The date at the top shows when it was last changed.