1. Introduction

Baulxz Consultancy Limited ("Baulxz," "we," "our," or "us") respects your privacy and is committed to protecting the personal information of our clients, prospective clients, candidates, partners, website visitors, and other individuals who interact with us. This Privacy Policy explains how we collect, use, disclose, store, and safeguard personal data in connection with our services and our website.

This Policy is issued in accordance with the Nigeria Data Protection Act, 2023 ("NDPA"), regulations issued by the Nigeria Data Protection Commission ("NDPC"), and, where applicable, the EU General Data Protection Regulation ("GDPR") and other relevant data protection laws.

By using our website or engaging our services, you confirm that you have read and understood this Policy.

2. Scope of Services

This Policy covers personal data we process while providing the following services:

• Mobile application development

• Web application development

• Cybersecurity solutions

• ICT infrastructure installations

• Market penetration and business development

• Human resource recruitment and training

3. Information We Collect

We may collect the following categories of personal data:

• Identification and contact data: full name, job title, employer, email address, phone number, postal address, and government-issued identification where required.

• Professional data: curriculum vitae, qualifications, employment history, references, salary expectations, and related information (particularly in connection with our recruitment and training services).

• Project and service data: project requirements, technical specifications, business plans, market intelligence, and other information you share with us during an engagement.

• Technical and usage data: IP address, browser type, device information, operating system, pages visited, referring URLs, and similar information collected through cookies and analytics on our website.

• Security and infrastructure data: network architecture, system logs, vulnerability assessment results, and similar information collected (with permission) while delivering cybersecurity or ICT installation services.

• Communications data: records of emails, messages and meeting notes.

We do not generally collect sensitive personal data unless it is necessary, lawful, and we have obtained your explicit consent.

4. How We Collect Information

We collect personal data:

• Directly from you, when you submit enquiry or application forms, sign contracts, send emails, or otherwise interact with us;

• Automatically, through cookies and similar technologies when you visit our website; and

• From third parties, including referees you provide, your employer or colleagues, recruitment partners, and publicly available sources such as professional networking platforms.

5. How We Use Your Information

We use personal data for the following purposes:

• Delivering the services you or your organization have engaged us to provide.

• Communicating with you regarding proposals, contracts, projects, and updates.

• Evaluating candidates and supporting recruitment, screening, and training activities.

• Conducting market research and producing business development insights.

• Operating, securing, and improving our website and internal systems.

• Issuing invoices, processing payments, and managing financial records.

• Complying with legal, regulatory, and contractual obligations.

• Protecting our rights, property, and the safety of our staff and clients.

We rely on various legal bases to process personal data, including performance of a contract, legitimate interests, consent, and compliance with legal obligations. We will inform you of the specific legal basis for processing your data where required.

6. Legal Basis for Processing

We rely on one or more of the following lawful bases when processing your personal data:

• Your consent, which you may withdraw at any time.

• Performance of a contract with you, or steps taken at your request before entering into a contract.

• Compliance with a legal or regulatory obligation.

• Our legitimate interests, where these are not overridden by your rights.

• Protection of vital interests.

• Performance of a task carried out in the public interest, where applicable.

7. Sharing and Disclosure of Information

We do not sell your personal data. We may share personal data with:

• Members of our team who require access to perform their roles.

• Trusted service providers (such as cloud hosting, email, payment processing, and analytics providers) acting on our instructions and bound by confidentiality.

• Clients or prospective employers, in the context of our recruitment and training services, with appropriate consent.

• Professional advisors, such as auditors, accountants, and lawyers.

• Regulatory or law enforcement authorities where required by law.

• Parties to a corporate transaction such as a merger, acquisition, or reorganization, subject to appropriate confidentiality protections.

8. International Data Transfers

Some of the service providers we work with may be located outside Nigeria. Where personal data is transferred internationally, we ensure appropriate safeguards are in place in accordance with the NDPA, including standard contractual clauses, adequacy assessments, or your explicit consent.

9. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes set out in this Policy, including any legal, accounting, or reporting requirements. Retention periods are determined by reference to the nature and sensitivity of the data, the purposes for which we process it, applicable legal requirements, and our legitimate operational needs. When personal data is no longer required, it is securely deleted or anonymized.

10. Data Security

We implement appropriate technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, or destruction. These measures include access controls, encryption where appropriate, secure storage, staff confidentiality obligations, and regular security reviews. While we strive to protect personal data, no method of transmission over the internet or electronic storage is completely secure.

11. Your Rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you.

• Request correction of inaccurate or incomplete data.

• Request deletion of your personal data ("right to be forgotten").

• Restrict or object to certain processing activities.

• Request data portability, where applicable.

• Withdraw any consent previously given, without affecting prior lawful processing.

• Lodge a complaint with the Nigeria Data Protection Commission (NDPC) or another competent supervisory authority.

To exercise any of these rights, please contact us using the details in Section 15. We may need to verify your identity before responding.

12. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to ensure proper functionality, analyze traffic, and improve your experience. You can manage cookie preferences through your browser settings. Disabling certain cookies may limit some website features.

13. Children's Privacy

Our services are not directed at children under 18 years of age, and we do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without verifiable parental consent, we will delete it promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Updates will be posted on this page with a revised "Last Updated" date. Material changes will be brought to your attention through reasonable means.

15. Contact Us

If you have questions about this Privacy Policy or how we handle your personal data, please contact us via the contact us form or through any of the mediums listed on our platform.