In short: we collect only the information we need to respond to you, deliver our services and run our business. We never sell your data, we protect it carefully, and you can ask us to access, correct or delete it at any time. This policy is written to comply with the Nigeria Data Protection Act 2023.
01Who we are
GERLANCE TECHNOLOGY LTD ("Gerlance", "we", "us" or "our") is a private company registered in the Federal Republic of Nigeria. We design, develop, deploy and maintain software, applications, digital platforms and technology solutions, including solutions that use artificial intelligence, and we provide related consultancy, integration, support and training services.
For the purposes of the Nigeria Data Protection Act 2023 (the "NDPA"), we are the data controller of the personal data described in this policy. You can reach us about anything in this policy at privacy@gerlance.com.
02Scope of this policy
This policy explains how we handle personal data when you:
- visit or interact with our website;
- contact us, request a proposal or subscribe to updates;
- become, or act on behalf of, one of our clients, suppliers or partners;
- apply for a job or internship with us; or
- attend our training sessions, workshops or events.
It does not cover personal data we process on behalf of our clients inside the systems we build or operate for them. That processing is described in section 6.
03Information we collect
Information you give us
- Contact details such as your name, email address, phone number, job title and organisation.
- Enquiry and project information you share when you contact us or discuss a project, including any documents you send.
- Business and billing details needed to contract with and invoice you, such as company address and tax information.
- Recruitment information such as your CV, portfolio, employment history, qualifications and references.
- Communications you have with us, including emails, messages and meeting notes.
Information we collect automatically
When you visit our website we may collect technical information such as your IP address, browser type, device information, pages visited and the date and time of your visit. Some of this is collected using cookies, as explained in our Cookie Policy.
Information from other sources
We may receive information about you from your employer or organisation when they engage us, from referees you nominate, and from publicly available sources such as professional networking sites and company registries.
04How we use your information
We use personal data to:
- respond to your enquiries and provide proposals and quotations;
- deliver, support and improve our services under our agreements with clients;
- manage invoicing, payments and our business relationships;
- assess job applications and manage our recruitment process;
- deliver training sessions and issue attendance records or certificates;
- operate, secure and improve our website;
- send you updates about our services where you have agreed to receive them, or where permitted by law (you can opt out at any time);
- comply with our legal, regulatory, tax and accounting obligations; and
- establish, exercise or defend legal claims.
We do not sell your personal data.
05Legal bases for processing
Under section 25 of the NDPA, we only process personal data where we have a lawful basis to do so. Depending on the activity, we rely on:
- Contract: to take steps at your request before entering into a contract, or to perform a contract with you;
- Legal obligation: to comply with laws that apply to us, such as tax and company law;
- Legitimate interests: to run, secure and grow our business, provided those interests are not overridden by your rights and freedoms;
- Consent: for example, for optional marketing communications or non-essential cookies. You may withdraw consent at any time without affecting processing that took place before; and
- Vital interests: in the rare case that processing is necessary to protect someone's life or health.
06Data we process for our clients
When we build, host, maintain or support software for a client, we may process personal data on that client's behalf, such as information about their customers or staff. In those cases the client is the data controller and we act as a data processor.
We process such data only on the client's documented instructions and in accordance with our written agreement with them, which includes appropriate confidentiality, security and data protection terms. If you have questions about how one of our clients uses your data, please contact that organisation directly.
We do not use client data to train artificial intelligence models for any other customer or for our own purposes unless the client has expressly agreed to it in writing.
07How we share information
We share personal data only where necessary, with:
- Service providers who help us run our business, such as cloud hosting, email, collaboration, accounting and recruitment tools, under contracts that require them to protect your data;
- Professional advisers such as lawyers, auditors and insurers, where needed;
- Authorities and regulators where we are required to by law, court order or a lawful request;
- A buyer or successor in the event of a merger, acquisition or sale of all or part of our business, subject to confidentiality obligations; and
- other parties with your consent or at your direction.
08International transfers
Some of our service providers store or process data outside Nigeria. Where personal data is transferred outside Nigeria, we do so in line with Part VIII of the NDPA: either to countries or organisations that ensure an adequate level of protection, or on the basis of appropriate safeguards such as contractual clauses, or another lawful basis recognised by the NDPA and the Nigeria Data Protection Commission.
09How long we keep information
We keep personal data only for as long as necessary for the purposes set out in this policy, including to meet legal, accounting and reporting requirements. As a general guide:
- enquiries that do not lead to an engagement: up to 2 years;
- client and contract records: for the duration of the relationship and up to 6 years afterwards;
- unsuccessful job applications: up to 12 months, unless you ask us to keep them longer for future roles; and
- website analytics data: up to 26 months.
When data is no longer needed, we securely delete or anonymise it.
10How we protect information
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or alteration. These include encryption in transit and at rest where appropriate, access controls based on least privilege, multi-factor authentication, secure development practices, regular updates and staff confidentiality obligations.
No system is completely secure. If a personal data breach occurs that is likely to put your rights and freedoms at risk, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it and inform you without undue delay where required by the NDPA.
11Your rights
Subject to the NDPA, you have the right to:
- be informed about how your personal data is used;
- access a copy of the personal data we hold about you;
- have inaccurate or incomplete data corrected;
- have your data erased in certain circumstances;
- restrict how we process your data in certain circumstances;
- object to processing, including for direct marketing;
- receive your data in a structured, commonly used format (data portability);
- withdraw consent at any time where we rely on consent; and
- not be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you.
To exercise any of these rights, email privacy@gerlance.com. We may need to verify your identity before responding, and we will reply within the time required by law. If you are not satisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission.
12Cookies
We use cookies and similar technologies as described in our Cookie Policy, which also explains how you can manage your preferences.
13Children
Our website and services are not directed at children under 18, and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, please contact us and we will delete it.
14Third-party websites
Our website may link to websites and services operated by others. We are not responsible for their privacy practices, and we encourage you to read their privacy policies.
15Changes to this policy
We may update this policy from time to time. The latest version will always be available on this page with the date it was last updated. Where changes are significant, we will take reasonable steps to let you know.
16Contact us
For questions about this policy or our data practices, please contact us at privacy@gerlance.com, or write to GERLANCE TECHNOLOGY LTD, Nigeria.