Privacy Policy

Effective and last updated: 18 September 2026

This Policy explains how Invicast Group handles personal data in accordance with the Nigeria Data Protection Act 2023 (the “NDPA”), the Nigeria Data Protection Act General Application and Implementation Directive 2025 (the “GAID”), and other applicable Nigerian laws.

1. Who we are and who controls your data

“Invicast Group”, “Invicast”, “we”, “us” or “our” refers to the Invicast member company responsible for the interaction or service concerned:

• Invicast Platforms Limited — platforms, software, cloud infrastructure, digital transformation and systems-integration services.
• Invicast Telecom Limited — telecommunications, intelligent communications, connectivity and satellite-related services.
• Invicast Academy Limited — education, training and professional-development services.

The relevant member company is the data controller for its service. Where you make a general website enquiry, the member company best placed to handle the selected solution controls that enquiry. Contact our data-protection contact at sales@invicast.com with the subject “Data Protection Request”.

2. Scope

This Policy applies when you visit this website, submit an enquiry, communicate with us, obtain or use an Invicast service, attend a programme, use a service portal, or otherwise interact with an Invicast member company. A product, customer contract, employee relationship or partner arrangement may provide an additional privacy notice; that more specific notice applies to the relevant processing.

3. Personal data we collect

We collect only data that is adequate, relevant and reasonably necessary for a stated purpose. Depending on your interaction, this may include:

• Identity and business data: name, employer or organisation, role and authorised-representative information.
• Contact data: business email address and communication preferences. Our public service-request form does not request a telephone number.
• Enquiry and communication data: selected service, requirements, correspondence, support requests and records of agreements or acknowledgements.
• Customer and transaction data: account, KYC/KYB, order, subscription, invoice, payment, usage and service-delivery records where relevant to a contracted service.
• Technical and security data: IP address, session identifiers, timestamps, device/browser information and security events where generated by hosting, access-control or fraud-prevention systems.
• Service data: information processed through a platform, communications or learning service according to the applicable contract and service notice.
• Information from lawful third-party sources: authorised partners, service providers, public registers, payment providers, compliance databases or your organisation.

Please do not place passwords, payment-card details, health information, biometric information, government identifiers or other sensitive personal data in a general enquiry unless we specifically and lawfully request it through an appropriate secure channel.

4. Purposes and lawful bases

Where we rely on consent, it must be freely given, specific, informed and unambiguous. You may withdraw it at any time without affecting processing that was lawful before withdrawal. We will not use consent to avoid relying on a more appropriate lawful basis.

5. Cookies and website sessions

This website uses a strictly necessary session cookie to issue and validate anti-forgery tokens for secure forms. It is not used for advertising. If we introduce non-essential analytics, advertising or similar technologies, we will update this Policy and request consent where required before activating them.

6. When we disclose personal data

We do not sell personal data. We may disclose only what is necessary to:

• the Invicast member company responsible for the selected service;
• hosting, cloud, email, communications, payment, security, identity-verification, analytics and customer-support providers acting under appropriate instructions and safeguards;
• professional advisers, auditors, insurers and finance providers subject to confidentiality duties;
• regulators, courts, law-enforcement bodies or other recipients where required by law or necessary to protect legal rights;
• a successor in a lawful merger, financing, restructuring or transfer, subject to applicable data-protection requirements.

Processors must act only on documented instructions, protect confidentiality and security, assist with data-subject rights and breaches, and delete or return personal data as required by contract and law.

7. International transfers

Some providers, networks or service locations may process data outside Nigeria. Before a restricted transfer, we will assess whether the destination provides an adequate level of protection or use another mechanism permitted by the NDPA and GAID, such as an approved contractual safeguard, binding rule, certification mechanism or a specific statutory exception. We will document the transfer and apply proportionate technical and organisational safeguards.

8. Retention and deletion

We retain personal data only for as long as necessary for the stated purpose, applicable legal requirements, security, audit and the establishment or defence of claims. Ordinarily:

• an enquiry that does not become a customer relationship is retained for up to 12 months after the last meaningful contact;
• customer, contract, billing and transaction records are retained for the relationship and the applicable statutory, tax, accounting and limitation period;
• security and access logs are retained for a limited period proportionate to the risk, unless needed for an investigation;
• consent and policy-acceptance records are retained while needed to demonstrate compliance or enforce an agreement.

At the end of the applicable period, data is securely deleted, anonymised or placed beyond ordinary use unless lawful retention is required.

9. Security and accountability

We apply risk-based technical and organisational measures, which may include access controls, least-privilege administration, encryption in transit, secure configuration, monitoring, backups, vulnerability management, confidentiality obligations, incident response, vendor assessment and staff awareness. No system is completely risk-free, but we review safeguards in light of the nature, scope, context and purposes of processing.

10. Your data-protection rights

Subject to the NDPA, GAID and lawful limitations, you may:

• request information and access to your personal data;
• request correction of inaccurate or incomplete data;
• request erasure where there is no lawful reason to continue processing;
• request restriction of processing in applicable circumstances;
• object to processing based on legitimate interests or for direct marketing;
• request portability of qualifying data in a structured, commonly used, machine-readable format;
• withdraw consent at any time where consent is the basis;
• not be subject to a solely automated decision producing legal or similarly significant effects, except where lawfully permitted with required safeguards;
• lodge a complaint with the Nigeria Data Protection Commission.

Send a request to sales@invicast.com. State the right you wish to exercise and the relevant service. We may ask for proportionate information to verify identity or authority. We will respond within the period required by law and explain any lawful refusal or extension.

11. Personal-data breaches

We maintain an incident-response process to contain, investigate, assess and document personal-data breaches. Where the legal threshold is met, we will notify the Nigeria Data Protection Commission within the applicable period (including the NDPA requirement to notify within 72 hours where a breach is likely to result in a risk to individuals) and notify affected individuals promptly where the breach is likely to result in a high risk to their rights and freedoms.

12. Children and vulnerable individuals

The general corporate website and service-request form are intended for adults acting personally or for an organisation. We do not knowingly use the form to collect data from children. A learning service involving a child will use an appropriate notice, age verification and parent/guardian authorisation or another lawful basis required by Nigerian law.

13. Automated decision-making

The general enquiry process does not make decisions based solely on automated processing that produce legal or similarly significant effects. If a service introduces such processing, we will provide the information and safeguards required by law.

14. Changes to this Policy

We may update this Policy when our services, practices or legal obligations change. The effective date above identifies the current version. Material changes will be communicated through an appropriate channel.

15. Contact and complaints

For questions, complaints or rights requests, email sales@invicast.com with the subject “Data Protection Request”. You also have the right to complain to the Nigeria Data Protection Commission. We ask that you contact us first where appropriate so we can investigate promptly, but this does not limit your right to approach the Commission.