Privacy notice

NDPA Compass is operated by [to be set by the platform administrator]. For the account and security data described below, the operator is the data controller.

For data that an organisation puts into its own workspace (assessments, DPIAs, breach records, rights requests and documents), that organisation is the data controller and NDPA Compass processes it only on the organisation's instructions, as a data processor. Contact the organisation directly about that data.

Privacy contact: [to be set by the platform administrator].

Ask the Act enquiries are not stored. Your questions and the answers are processed only to produce the answer, are never written to our database or logs, and disappear when you refresh or leave the page.

We do not use analytics, advertising cookies, profiling or automated decision-making about you, and we do not sell personal data. We use your email address for marketing, and share it with partners, only if you opt in, as explained in section 3.

If you agree, we use your name and email address for marketing, and may share them with other organisations so they can send you their own marketing. These are two separate choices, and both are optional:

• Marketing from us: “Email me news, product updates, offers and invitations to webinars, trainings and events from NDPA Compass and Mehira Consulting Services.”
• Sharing with partners: “Share my email address with Mehira Consulting Services’ affiliated companies, business partners that offer data protection, cybersecurity or compliance products and services, and co-hosts of webinars, trainings and events, so they can email me their own offers.”

The boxes are never ticked for you, and you can create and use an account without ticking either (sections 26(2), 26(3) and 26(7)). You can make or change these choices when you register or at any time on your account page.

Who may receive your email address if you agree to sharing:

• companies affiliated with Mehira Consulting Services;
• business partners that offer data protection, cybersecurity or compliance products and services;
• sponsors and co-hosts of webinars, trainings and events.

Each recipient becomes responsible for its own use of your details, and its own privacy notice then applies. We share your details only under a written agreement that limits their use to sending you marketing and requires the recipient to stop when you withdraw. Some recipients may be outside Nigeria; where they are, we transfer the data only on a basis allowed by sections 41 to 43 of the Act.

Withdrawing and objecting. You can withdraw either consent at any time, as easily as you gave it: untick the box on your account page, use the unsubscribe link in any marketing email, or write to [to be set by the platform administrator]. You also have an absolute right to object to direct marketing (section 36(3) and (4)). Withdrawing stops marketing and further sharing straight away, and we pass your withdrawal on to partners who already received your details. It does not affect anything lawfully done before you withdrew (section 26(5)). Service emails about your account, such as password reset links, are not marketing and continue.

Proof of consent. For every choice we record the date and time, the wording shown, the notice version (currently 2026-09-26) and where it was made, so we can show what you agreed to (section 26(1)).

Our hosting providers act as processors: Vercel Inc. (application hosting) and Neon (database). Resend, Inc. sends our emails, such as password reset links, as a processor. Their servers may be located outside Nigeria, so personal data may be transferred abroad. We rely on their contractual data protection terms as the safeguard for these transfers under sections 41 to 43 of the Act.

If you opted in to sharing, the partners described in section 3 receive your name and email address.

Within an organisation, its owner and administrators can see the organisation's users and activity. The platform administrator can see only organisation owners and administrators, security events, and the name and email of people who opted in to marketing, and has no access to organisation workspace data.

• Account data: while the account exists. Removing a user or deleting an organisation deletes the related accounts and workspace data.
• Activity and security logs: 12 months, then deleted automatically.
• Session cookie: 10 minutes after your last activity, and 12 hours at most.
• Marketing use and sharing: until you withdraw consent or your account is deleted.
• Records of your marketing choices: up to 3 years after you withdraw or your account is deleted, so we can prove what you agreed to and keep honouring your opt-out; then deleted automatically.
• Workspace requests: while under review. Declined and withdrawn requests are deleted after 90 days, and requests left unanswered after 180 days. The password you choose is stored only as a one-way hash and removed as soon as the request is approved, declined or withdrawn.
• Password reset links: valid for 30 minutes and usable once; the record is deleted after 1 day.
• Ask the Act enquiries: not kept at all.

Passwords are hashed with bcrypt. Connections are encrypted (HTTPS, and TLS to the database). Each organisation's data is separated and access is checked on every request. Accounts lock after repeated failed sign-ins, and sessions end after 10 minutes of inactivity. Password reset links are random, single-use, expire after 30 minutes and are stored only as a one-way hash. If a personal data breach is likely to put you at risk, we will notify the Commission within 72 hours and tell you where required (section 40).

Under sections 34 to 38 of the Act you can ask for access to and a copy of your data, correction, erasure, restriction, portability, object to processing based on legitimate interests, object to direct marketing at any time, and withdraw any consent you have given. To use a right, contact [to be set by the platform administrator]. For data in an organisation's workspace, contact that organisation, or use its rights portal. You can see a summary of your rights on the Your rights page.

You can complain to the Nigeria Data Protection Commission if you are unhappy with how your data is handled (section 46).

We will update this page when our processing changes and show the date of the latest version at the top. If we change what you agreed to for marketing or sharing, we will ask for your consent again rather than rely on an earlier choice.