Who we are and what this policy covers
Truvenda Cloud Technologies Limited is the data controller for the activities described in this policy. We are incorporated in Nigeria under RC 9710187. Our registered office is 164 Ogui Road, Enugu, Enugu State, Nigeria.
This policy covers visits to the public Truvenda corporate website and correspondence about the company that begins here. It includes company, product, careers, investor and press enquiries. The product-specific privacy section explains where to find information about using a separate Truvenda service.
The Nigeria Data Protection Act 2023 and its applicable implementing rules govern our handling of personal data covered by Nigerian law. Where another law gives you additional mandatory protections, those protections apply to the extent required by that law.
Information we collect and where it comes from
Website visits and requests
When you open a page, our website and its hosting infrastructure receive information needed to deliver the page. This can include your IP address, browser and device information supplied by your browser, the page or file requested, the referring page if your browser sends it, the time of the request, and the HTTP status or error produced. A request log can include some of these details.
A requested web address can contain a path or query string supplied by the browser. Avoid putting contact details, access tokens, order information or other private values in a website URL. A link that contains those values can be copied, forwarded or recorded by the systems that receive the request. You can read the public corporate pages without creating an account, while ordinary network and request information is still processed to deliver those pages.
Contact form and correspondence
When the contact form is available, it asks for your name, email address, enquiry category and message. The company field is optional. The required fields let us route the enquiry and reply. Omitting a required field or failing the security check prevents submission. The form also uses a security token and an empty anti-spam field.
A successful submission is handed to the configured mail transport for delivery to the designated recipient. The form does not create a customer account or save an enquiry in a separate website database. If a submission fails validation or delivery, the site can hold submitted values and error messages briefly in your session so you can correct the form. Email systems, logs and any business records made while handling your request have their own retention considerations.
When you write to a published company address, we receive what you send, the sender and recipient details, the subject, email routing information, the message history included in the thread and any attachments. Career messages may include a CV, portfolio, qualifications or work history. Investor and partnership correspondence can include a role, organisation, proposal or business materials. Provide only the information needed for the purpose.
If you send a document through a published correspondence channel, we may receive information contained within the document or its metadata. This can include the name of the author, tracked edits, comments or other material you did not intend to share. Check and redact documents as appropriate before sending them. If someone else's details are needed, provide the minimum relevant details and make sure you have authority to share them.
Information from other sources
If a representative, referrer or correspondent includes your details, we may receive the name, role, organisation or contact information they provide. In a recruitment, partnership or investment process, relevant information can also come from materials you authorise us to review or from public professional or company sources. We limit our use to the relevant purpose and provide any further notice that the law requires.
How we use information
We use website and correspondence data to deliver pages, troubleshoot errors, protect the form, handle enquiries and route messages to the people responsible for replying. We may keep a record of what was asked, what was decided and what we communicated where it helps us manage a relationship or handle a complaint.
For careers, the relevant people may review your qualifications and materials, arrange an interview or respond about a vacancy. Investor, press and partnership information is used to evaluate and respond to the particular enquiry and manage any follow-up. If a process moves to employment, due diligence, a contract or a product account, any additional collection is governed by the applicable process and notice.
An enquiry or application is not a mailing-list subscription. Where we send promotional messages, we use a lawful basis for that activity and honour a request to stop direct marketing. We use website visitor and enquiry data for the purposes in this policy, without selling it or using it for cross-site advertising profiles.
When an enquiry becomes a different process
A website enquiry sometimes leads to a follow-up with another function. For example, a request about a product may need to go to the product support team, while an investor introduction may move into a separate due-diligence process. We use the information already received to identify the right route and share relevant details where a lawful basis applies. Additional requests for documents or identity information should come through the process responsible for handling that information. That process may have different recipients, security arrangements or retention requirements.
If an individual contacts us for an organisation, we handle their name, business contact details and correspondence as personal data when it identifies them. Information solely about an incorporated organisation is distinct from information that identifies the people who work for or represent it.
Purposes and lawful bases
- General enquiries, press, relationships and routine follow-up. We rely on our legitimate interest in answering correspondence, directing it to the appropriate team and keeping relevant records. Where you ask us to take a specific step towards a contract with you, we process the information needed to take that step.
- Recruitment. We process information to take steps you request towards employment or another engagement, and where applicable for our legitimate interest in administering a fair recruitment process or to comply with an employment-law obligation.
- Investor, supplier and partnership enquiries. We use information to evaluate and respond to requests and manage business relationships under our legitimate interests. When we take steps at your request towards a contract with you, or a legal obligation applies to due diligence, we use the corresponding basis for that activity.
- Website delivery, security and service diagnostics. We rely on our legitimate interests in making the site available, resolving faults and protecting the website and its visitors from misuse. Where a law specifically requires the activity, we rely on the relevant legal obligation.
- Rights requests, regulatory obligations and disputes. We use information necessary to respond to a statutory request, meet a legal requirement or comply with a binding order. Where applicable, we rely on legitimate interests to investigate and resolve complaints or establish, exercise or defend legal claims.
- Activities requiring consent. When we rely on consent for a particular use, we ask for it separately and explain that use. You may withdraw consent for future processing through the channel described below. Withdrawal leaves processing that already lawfully took place intact.
Where we rely on legitimate interests, we consider the purpose, whether the information is necessary and the effect on your rights and reasonable expectations. You may object to that processing.
Who receives information
- Authorised Truvenda personnel. An enquiry may be routed to the person responsible for the issue, such as a contact, recruitment, investor or security function. Relevant managers or advisers may receive information where it is needed to handle the matter.
- Website and security providers. Render hosts the website and can process requests, operational logs and errors. Cloudflare supplies Turnstile when the form is enabled. Resource-delivery providers can receive requests for files served from their infrastructure.
- Mail and communications providers. Providers used for a configured mailbox or mail transport can process message content and routing data as needed to deliver, store and secure correspondence.
- Professional advisers and authorities. Where appropriate, we can share limited information with advisers to obtain advice or handle a dispute, or with courts, regulators or other authorities where legally required or otherwise lawfully justified.
- Corporate transactions. If relevant to a proposed or completed financing, restructuring, sale or succession, information may be shared with authorised counterparties and their advisers under safeguards appropriate to the transaction.
We seek to limit disclosures to the information the recipient needs. A service provider processing personal data for us is subject to the terms applicable to its engagement and the requirements of applicable data protection law.
Providers and third-party recipients
A provider delivering a service on our behalf uses the information needed to perform that service. A regulator, court or other recipient may handle information independently under its own legal authority. An external website you choose to visit can also operate independently. If you want to know which recipients received information in a particular matter, identify that matter when you make your request.
When sharing an enquiry to obtain help or advice, we consider whether a summary, a redacted document or a limited extract is enough. Where the law allows or requires disclosure for an investigation, legal claim or binding order, the scope depends on the request, our legal obligations and the relevance of the information.
How long we keep information
- Website sessions and form feedback. These are temporary and tied to the website session. The normal session setting is 120 minutes of inactivity. A successfully delivered enquiry can then exist separately as email correspondence.
- Website logs and security records. Routine logs follow the hosting or security service’s applicable log-retention settings. Relevant records may be kept separately while investigating an incident, responding to a complaint or preserving evidence required by law.
- General correspondence. Retention depends on when the enquiry closes, whether the correspondence is needed to manage an ongoing relationship and whether there is a legal or dispute-related reason to keep it.
- Recruitment records. Application records are kept for the recruitment process and for any further period needed for a legitimate follow-up, a legal requirement or a dispute. Employment records follow the rules applicable to the resulting relationship.
- Investor, supplier and partnership records. Retention depends on the status of the discussions, the duration of the relationship if one is formed and any recordkeeping or legal obligations that apply.
- Privacy requests and complaints. We keep the correspondence and outcome for as long as needed to respond and maintain an appropriate record of how the request was handled.
Information may be retained beyond the ordinary period where a legal hold, investigation or binding requirement applies. Copies in backup systems can remain until the applicable backup cycle expires. We remove or anonymise records when there is no continuing lawful reason to retain them. You may ask for the retention period or criteria applicable to the records involved in your request.
What happens when retention ends
The way we remove information depends on where it is held. A temporary session can expire. A message or attachment in active correspondence can be removed from the relevant records when there is no continuing basis to keep it. Where we retain information in anonymised form, it should no longer identify an individual. Keeping a limited record of a complaint, decision or legal obligation can be necessary even after related material is removed.
If information must be preserved, we limit further use to the reason for keeping it and the uses allowed by law. The fact that correspondence is closed, an application is withdrawn or a message is deleted from a device does not by itself determine whether all related records can be erased. You can ask which categories we still hold and the reason they remain.
International processing and transfers
Truvenda Cloud Technologies Limited is based in Nigeria. The website is hosted on Render in Frankfurt, Germany. Some providers, including security and email providers, may use infrastructure or personnel in other countries. Which locations apply depends on the provider and the processing involved.
For transfers covered by the Nigeria Data Protection Act, we rely on a basis permitted by the Act, such as adequate protection through an applicable mechanism or another transfer ground available under the Act. Where required, we assess the transfer and use appropriate safeguards. You may request information about the countries, recipients and safeguards that apply to your data.
A transfer can occur when a provider receives data at a location outside Nigeria or when an authorised person in another country can access it. The place where the website is hosted and the locations where other providers operate can differ. In considering an applicable transfer basis, we take account of the data involved, the recipient, the purpose and the protections available in the circumstances. We can also provide information about the safeguards applicable to a specific transfer where the law requires it.
How we protect information
The website uses HTTPS. When available, the contact form uses server-side validation, session-based request protection, rate limits and a Turnstile check. Keep passwords, one-time codes, full payment-card details, government identifiers and confidential records out of general website enquiries. If an enquiry needs sensitive material, ask for the appropriate channel first.
If a personal-data breach occurs, we assess its effect and notify the Nigeria Data Protection Commission and affected individuals where applicable law requires it. You can report a suspected privacy or security issue using the contact information below. Include enough detail to identify the issue without exposing credentials or someone else’s private information.
If you believe your information was exposed
Tell us which site or message was involved, the approximate date and what suggests the information was exposed or sent to the wrong person. A redacted screenshot or short description can help us locate the problem. For evidence that contains another person's information, ask for a secure way to share it. We use the report to assess what happened, contain the issue, determine any notification duties and record the response.
Children and sensitive information
This corporate website is intended for a general business audience. A child or a person who requires a lawful representative should use the correspondence channels with appropriate assistance. Where the law requires a parent’s or guardian’s authorisation for processing, we will seek it before using the information for that purpose, subject to applicable exceptions.
If you believe a child’s information or sensitive information was sent through the site in error, contact us so we can assess the circumstances and take appropriate action.
Your data protection rights
- Information and access. Ask whether we hold your data and request a copy, together with information about the purposes, categories, recipients, sources and retention that apply.
- Correction. Ask us to update information that is inaccurate, incomplete, misleading or out of date.
- Erasure and restriction. Ask us to delete personal data or limit its use when the legal conditions are met, for example while a qualifying correction request or objection is being considered.
- Objection and consent withdrawal. Object to processing, including direct marketing, and withdraw consent for a purpose that relies on it.
- Portability. Ask for the data covered by this right in a structured, commonly used and machine-readable format, or for direct transfer where the applicable requirements are met.
- Automated decisions. Where the right applies, challenge a decision based solely on automated processing that has legal or similarly significant effects and request human intervention.
The request process explains what to send and how we assess requests. See privacy complaints for escalation routes.
How to make a privacy request
What to include
Use the contact details below. State the right you want to exercise and the records or activity involved. For example, a previous enquiry's subject, approximate date and the address used can help us distinguish it from unrelated correspondence. For a correction, identify the inaccurate detail and tell us what it should say. For an objection, identify the processing you want us to reconsider. Include a safe way for us to reply.
What we do with the request
We use the details provided to locate relevant information, identify which Truvenda function or service is responsible and assess the request under applicable law. If we need more information to verify identity, locate the records or confirm a representative's authority, we will ask for what is reasonably needed. Avoid sending a passport, government ID, password or verification code with an initial request. If we need further evidence, we will explain how to provide it appropriately. We respond without unreasonable delay and within the time required by the applicable law.
An access response can require us to protect information about other people. We may separate or redact that information where appropriate. In a deletion request, we consider each relevant category and whether a legal obligation or other lawful basis requires continued retention. Where permitted, we explain any limit on the action we can take and how you can raise a concern about the outcome.
If a request concerns another Truvenda service
Include the product name in your request. A workspace, payment or product account can have its own route for verification and access. When appropriate, we will direct you to the team or organisation responsible for that record. For information held by a business using one of our products, contact that business if it is responsible for deciding how the information is used. Its notice or support channel can help you identify the right contact.
Privacy complaints and escalation
If you want us to investigate a concern, explain what happened, when it happened, which records or processing are involved and the outcome you are seeking. If you have already made a request, include its reference or the date and subject of your earlier correspondence. We use this information to investigate, respond and record the steps taken.
You can lodge a complaint with the Nigeria Data Protection Commission about a privacy violation within its jurisdiction. Include relevant dates and supporting correspondence where appropriate, and limit unnecessary personal data in anything you share. Depending on the applicable law, you may also have access to another competent regulator or judicial remedy.
Product-specific privacy and external sites
Each product can have its own product-specific privacy notice, support process and arrangements for access, deletion and other requests. Use that product’s notice and official support channel for account, transaction, hosting or customer-conversation data. For information about the product from this website, see the TruCom product page or the relevant product page in the site navigation.
An external site receives information according to its own practices when you visit or use it. Review its notice before submitting information. If you need help identifying the appropriate Truvenda entity or product, write to the corporate contact below with the name of the product and a brief description of the issue.
Changes to this policy
We update this policy when the site, processing practices, providers or applicable legal requirements change. The effective date identifies this version. Where a material change requires further notice or consent, we will give that notice or seek consent as required.
Privacy requests and correspondence
For privacy requests, complaints or security reports about this corporate website, write to Truvenda Cloud Technologies Limited, 164 Ogui Road, Enugu, Enugu State, Nigeria. Mark your letter for privacy correspondence. Include a safe way for us to respond, a short description of the issue and any relevant date or reference. You can use this postal address to contact us about your rights.
[email protected]