Privacy Policy
How Rayida Tech collects, safeguards, and processes personal information in full compliance with the Nigeria Data Protection Act (NDPA) 2023.
1. Introduction & Scope
Rayida Tech (“we”, “our”, or “us”) is a digital technology studio and engineering consultancy registered and operating in Nigeria. We specialize in bespoke product design, artificial intelligence systems, full-stack software development, and technical consultation.
This Privacy Policy outlines how we collect, store, utilize, protect, and disclose personal data when you interact with our website (rayidatech.name.ng), submit project inquiries, engage our engineering services, or communicate with our team.
We are deeply committed to respecting your privacy, upholding data minimization, and complying with the Nigeria Data Protection Act (NDPA) 2023 and the regulatory directives issued by the Nigeria Data Protection Commission (NDPC).
2. Rayida Tech as Data Controller vs. Data Processor
Under the NDPA 2023, personal data responsibilities differ based on the processing context:
- Rayida Tech as Data Controller: When you visit our website, submit inquiries, subscribe to our newsletter, or enter into direct client contracts with us, we determine the purposes and means of processing your personal data.
- Rayida Tech as Data Processor: When we build, host, or manage software applications, databases, or API infrastructure on behalf of our enterprise clients, our clients act as the Data Controllers, and we process personal data strictly in accordance with their contractual instructions and our B2B Data Processing Agreement.
3. Information We Collect
We collect only information reasonably necessary to achieve legitimate business and technical objectives. The data categories include:
| Data Category | Specific Data Items | Collection Purpose |
|---|---|---|
| Contact Inquiries | Full name, email address, phone/WhatsApp number, company name, project brief, estimated budget. | Reviewing project scopes, preparing feasibility proposals, and replying to client requests. |
| Newsletter Subscribers | Email address, subscription timestamp. | Sending engineering articles, product case studies, and occasional studio announcements. |
| Technical Telemetry | IP address, browser type, operating system, screen dimensions, referrer URL, dwell time. | Detecting infrastructure bottlenecks, diagnosing errors, preventing malicious cyberattacks, and optimizing UI performance. |
| Admin Authentication | Admin user email, encrypted password hashes, session tokens. | Restricting access to the internal portfolio content management system to verified administrators. |
4. How We Collect Personal Data
We collect personal information through the following mechanisms:
- Direct Submission: Information submitted via our website contact form (/contact) or newsletter subscription input.
- Electronic Communications: Communications conducted via email (info@rayidatech.name.ng) or verified business messaging channels (WhatsApp).
- Automated Technologies: Client-side logging and session beacons triggered during page visits (only activated upon your consent via our Cookie Preferences system).
5. Why We Process Your Data
Your personal data is processed strictly for clear, legitimate operational purposes:
- To review technical project briefs and formulate accurate delivery timelines and budgets.
- To execute contracts, deliverables, milestones, and design handoffs.
- To provide post-launch warranties, code maintenance, and ongoing client support.
- To safeguard our application from denial-of-service (DoS) attacks, injection vulnerabilities, and malicious automated bot activity.
- To dispatch transactional email notifications regarding inquiries or newsletter subscriptions.
- To comply with statutory legal, accounting, tax, or regulatory obligations in Nigeria.
6. Lawful Bases for Processing (NDPA 2023)
In accordance with Section 25 of the Nigeria Data Protection Act 2023, we process personal information only when at least one lawful basis applies:
A. Contractual Necessity (NDPA Sec. 25(1)(b))
Processing is necessary to take steps at your request prior to entering into a contract (e.g. scoping briefs, proposals) or to perform an existing engineering contract.
B. Consent (NDPA Sec. 25(1)(a))
Where you have given specific, informed, and unambiguous consent, such as opting into our newsletter or accepting analytics telemetry via our Cookie Consent banner. You may withdraw consent at any time.
C. Legitimate Interests (NDPA Sec. 25(1)(f))
Where processing is necessary for the genuine business interests of Rayida Tech (e.g. maintaining network security, preventing fraud, and optimizing application responsiveness), provided such interests do not override your fundamental rights.
D. Legal Obligation (NDPA Sec. 25(1)(c))
Where processing is required to comply with statutory legal, tax, or regulatory reporting duties under Nigerian law.
7. Data Sharing & Third-Party Service Providers
Rayida Tech never sells, leases, or trades personal data to third parties.
We share personal information strictly with vetted third-party infrastructure and service providers operating as data processors under confidentiality agreements:
- Supabase Inc.: Cloud-hosted managed PostgreSQL database providing authenticated Row-Level Security (RLS) data storage.
- Resend Inc.: Transactional email delivery service utilized to dispatch administrative alerts and confirmation messages.
- Zoho Corporation: Professional business email hosting (
info@rayidatech.name.ng) for client correspondence. - Vercel Inc.: Cloud application hosting, edge middleware routing, and deployment infrastructure.
- Public Authorities: Law enforcement, courts, or regulatory bodies (including the NDPC) solely when compelled by applicable Nigerian law or court order.
8. International Data Transfers
Because Rayida Tech utilizes modern global cloud infrastructure (such as Vercel and Supabase cloud nodes and Resend European infrastructure), personal data may be stored or transferred outside Nigeria.
In compliance with Part VIII of the NDPA 2023, all cross-border data transfers are executed under recognized legal safeguards, including:
- Transfers to jurisdictions recognized by the NDPC as providing adequate levels of personal data protection.
- Standard Contractual Clauses (SCCs) and binding data processing terms guaranteeing equivalent protection.
- Strict end-to-end encryption in transit (TLS 1.3) and at rest (AES-256).
9. Data Retention Schedule
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, subject to legitimate business needs and statutory retention requirements:
| Record Type | Retention Period | Disposal Mechanism |
|---|---|---|
| Contact Inquiries (Uncontracted) | 12 months from inquiry date | Automated database purge |
| Active Client Contracts & Invoices | 6 years following project completion (statutory accounting) | Archived securely; purged upon expiry |
| Newsletter Subscribers | Until user unsubscription or consent withdrawal | Immediate deactivation upon unsubscribe |
| Technical Visitor Logs & Telemetry | 90 days rolling window | Truncated and purged automatically |
10. Technical & Organizational Security Controls
Rayida Tech implements robust technical safeguards to prevent unauthorized access, alteration, disclosure, or accidental destruction of your personal data:
- Encryption in Transit: Strict HTTPS enforcement, HSTS headers, and TLS 1.3 protocol usage across all public and API routes.
- Database Security: Row-Level Security (RLS) policies isolating database tables; no direct client write access to administrative logs.
- Centralized Access Guards: Mutating administrative actions protected by server-side cryptographic session verification (
requireAdminSession). - Injection Protection: Strict email header sanitization, HTML entity escaping in dynamic templates, and parameterized SQL queries.
- Rate Limiting & Anti-Spam: Sliding-window IP rate limiting on public endpoints and hidden honeypot fields to neutralize automated bot abuse.
- Zero Secret Exposure: API credentials (such as Resend API keys) are stored strictly in server-side environment variables without frontend exposure.
11. Your Data Subject Rights (NDPA 2023)
Under Part VI of the Nigeria Data Protection Act 2023, you are entitled to exercise the following rights regarding your personal information:
Right to Access
Request confirmation and a copy of the personal data we hold about you.
Right to Rectification
Request immediate correction of inaccurate or incomplete personal records.
Right to Erasure
Request deletion of personal data where retention is no longer legally justified.
Right to Restrict Processing
Request that processing be temporarily suspended while accuracy is contested.
Right to Data Portability
Receive your personal information in a structured, commonly used machine-readable format.
Right to Withdraw Consent
Withdraw consent at any time for activities based on consent (e.g. newsletter or telemetry).
How to Exercise Your Rights
To exercise any of your statutory rights, please send an email to info@rayidatech.name.ng with the subject line “Data Subject Rights Request”. We will acknowledge your request within 48 hours and provide a full resolution within 30 calendar days as required by the NDPA 2023.
You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng if you believe your rights have been violated.
12. Children's Privacy
Our website and technology services are directed exclusively at business professionals, adult clients, and individuals aged 18 and older. We do not knowingly collect, solicit, or maintain personal data from minors under the age of 18 without verifiable parental or guardian consent.
If you become aware that a minor has provided us with personal information, please notify us immediately at info@rayidatech.name.ng so we can delete such records.
14. Policy Updates & Official Contact
We may periodically revise this Privacy Policy to reflect evolving technical capabilities, regulatory requirements, or changes to Nigerian law. Any modifications will be posted directly to this page with an updated “Effective Date”.