Data Protection Policy

Introduction

M-VTU LTD is committed to protecting the privacy and personal data of our customers, users, and partners. This Data Protection Policy outlines how we collect, use, store, and protect personal information in compliance with the Nigerian Data Protection Regulation (NDPR) and other applicable data protection laws.

We recognize the importance of your personal data and are dedicated to ensuring its security, integrity, and lawful processing.

Legal Framework

Our data protection practices are governed by:

• Nigerian Data Protection Regulation (NDPR) 2019
• Nigerian Data Protection Act (when enacted)
• International data protection standards and best practices
• Telecommunications and financial services regulations

As a data controller and processor, M-VTU LTD is responsible for ensuring compliance with these regulations in all our operations.

Data Protection Principles

We adhere to the following data protection principles:

Lawfulness, Fairness, and Transparency

• Personal data is processed lawfully and fairly
• Data subjects are informed about processing activities
• Privacy notices are clear and accessible

Purpose Limitation

• Data is collected for specified, legitimate purposes
• Further processing is compatible with original purposes
• Purpose limitations are respected

Data Minimization

• Only necessary personal data is collected and processed
• Data collection is adequate and relevant
• Excessive data collection is avoided

Accuracy

• Personal data is kept accurate and up-to-date
• Reasonable steps are taken to correct inaccuracies
• Outdated data is deleted or rectified

Storage Limitation

• Data is retained only as long as necessary
• Retention periods are defined and enforced
• Data is securely deleted when no longer needed

Integrity and Confidentiality

• Data is protected against unauthorized access
• Appropriate security measures are implemented
• Data breaches are prevented and responded to

Accountability

• We are responsible for compliance with data protection principles
• Data protection impact assessments are conducted
• Records of processing activities are maintained

Data Subject Rights

Under the NDPR, you have the following rights regarding your personal data:

Right to Information

• Receive clear information about data processing
• Understand purposes and legal basis for processing
• Know about data sharing and retention periods

Right of Access

• Request confirmation of data processing
• Obtain copies of your personal data
• Access information about processing activities

Right to Rectification

• Request correction of inaccurate data
• Complete incomplete personal data
• Update outdated information

Right to Erasure

• Request deletion of personal data
• Right to be forgotten in certain circumstances
• Data deletion when no longer necessary

Right to Restriction

• Limit processing of personal data
• Object to processing in certain situations
• Restrict data sharing or further processing

Right to Data Portability

• Receive data in a structured format
• Transmit data to another controller
• Obtain copies of data for reuse

Right to Object

• Object to processing based on legitimate interests
• Object to direct marketing communications
• Withdraw consent for processing

Automated Decision Making

• Not subject to automated decision making without consent
• Right to human intervention in automated processes
• Right to express views on automated decisions

Data Security Measures

We implement comprehensive security measures to protect personal data:

Technical Measures

• Encryption of data in transit and at rest
• Multi-factor authentication for system access
• Regular security updates and patches
• Firewall and intrusion detection systems
• Secure backup and disaster recovery systems

Organizational Measures

• Staff training on data protection
• Access controls and role-based permissions
• Regular security audits and assessments
• Data protection impact assessments
• Incident response and breach notification procedures

Physical Measures

• Secure data center facilities
• Controlled access to physical premises
• Secure document storage and disposal
• 24/7 monitoring and surveillance

Data Breach Procedures

In the event of a data breach, we follow these procedures:

Breach Detection and Assessment

• Immediate identification of security incidents
• Risk assessment of potential harm to individuals
• Determination of breach scope and impact

Breach Containment

• Immediate actions to contain the breach
• Isolation of affected systems
• Prevention of further data exposure

Notification Requirements

• Notification to NITDA within 72 hours
• Communication to affected data subjects
• Provision of breach details and mitigation steps

Post-Breach Actions

• Investigation and root cause analysis
• Implementation of corrective measures
• Review and update of security procedures

International Data Transfers

When transferring data outside Nigeria, we ensure:

• Adequate protection in recipient countries
• Standard contractual clauses or adequacy decisions
• Compliance with NDPR transfer requirements
• Additional safeguards for sensitive data

Data Protection Officer

M-VTU LTD has appointed a Data Protection Officer (DPO) responsible for:

• Monitoring compliance with data protection regulations
• Acting as point of contact for data subjects and regulators
• Conducting data protection impact assessments
• Providing advice on data protection matters
• Coordinating data breach responses

Third-Party Processors

When engaging third-party processors, we ensure:

• Written contracts with data protection clauses
• Processor compliance with data protection requirements
• Regular audits of processor activities
• Right to terminate non-compliant processors

Complaints and Enforcement

If you believe your data protection rights have been violated:

• Contact our Data Protection Officer
• Lodge a complaint with NITDA
• Seek redress through appropriate legal channels
• Access to data protection complaint procedures

Contact Information

For data protection inquiries or to exercise your rights:

• Data Protection Officer: dpo@deakaliproducts.online
• General Support: support@deakaliproducts.online
• Phone: +234 800 MVTU HELP
• Address: Lagos, Nigeria

Response time: We aim to respond to all data protection requests within 30 days.

Last updated: November 12, 2025