1. Introduction
Commercium Africa Ltd (the Company) is committed to protecting the privacy and security of personal data. This policy explains how the Company collects, uses, and protects personal data in line with applicable Nigerian data protection requirements and the General Data Protection Regulation (GDPR).
2. Scope
This policy applies to employees, contractors, consultants, temporary staff, third-party personnel, and all personal data processed by the Company in electronic, paper, or other formats.
3. Definitions
- Personal Data: information relating to an identified or identifiable natural person.
- Processing: any operation performed on personal data, including collection, recording, organisation, storage, alteration, retrieval, consultation, use, disclosure, erasure, or destruction.
- Data Subject: an individual whose personal data is processed by the Company.
- Data Controller: the entity that determines why and how personal data is processed.
- Data Processor: the entity that processes personal data on behalf of the Data Controller.
4. Data Protection Principles
The Company processes personal data lawfully, fairly, and transparently; for specified and legitimate purposes; and only to the extent necessary. Data should be accurate, retained only as long as needed, and secured against unauthorised processing, accidental loss, destruction, or damage.
5. Legal Basis for Processing
Personal data is processed only where a valid legal basis applies, including consent, performance of a contract, compliance with a legal obligation, protection of vital interests, a task in the public interest, or legitimate interests that are not overridden by the rights and freedoms of the Data Subject.
6. Data Subject Rights
Subject to applicable law, Data Subjects may request access, correction, erasure, restriction, or portability of their personal data; object to processing; and withdraw consent without affecting processing that was lawful before withdrawal.
7. Data Security
The Company uses appropriate technical and organisational safeguards, which may include encryption, resilient systems, incident recovery measures, and regular assessment of security controls.
8. Data Breach Notification
Where required, the Company will notify the relevant supervisory authority and affected Data Subjects of a personal data breach without undue delay and within the period set by applicable law.
9. Data Protection Officer
The Company appoints a Data Protection Officer to advise on data protection obligations, monitor compliance, support impact assessments, cooperate with supervisory authorities, and act as a contact point for Data Subjects.
10. Data Protection Impact Assessments
The Company conducts Data Protection Impact Assessments for processing activities that are likely to create a high risk to Data Subjects, including relevant new projects and significant changes to existing processing.
11. Training and Awareness
Employees receive appropriate training and awareness support on data protection principles, policies, and practices.
12. Policy Review
This policy is reviewed regularly and updated when necessary to reflect changes in law, regulation, or the Company’s processing activities.
13. Contact Information
Questions or concerns about this policy or the Company’s data protection practices may be sent to the Data Protection Officer at [email protected].