Privacy Policy

2. What data we collect

We collect the following categories of personal data when you use our website or engage our services:

• Contact data — name, email address, phone number, WhatsApp number
• Project data — your business description, project requirements, budget range, and timeline preferences submitted via our quote form
• Communication data — messages you send via our contact form or email
• Usage data — pages visited, time on site, device type, approximate location (city/country), and referral source, collected via analytics cookies
• Newsletter data — email address and content preferences if you subscribe to our newsletter

3. How we use your data

We use your data only for the purposes described at the time of collection:

• To respond to your project enquiry and prepare a quote
• To send you transactional emails related to your project or account
• To send our newsletter (only if you explicitly subscribed)
• To improve our website and services using aggregated, anonymised analytics
• To comply with our legal obligations under the Nigeria Data Protection Act 2023 (NDPA)

We do not sell your personal data to third parties. We do not use your data for automated decision-making or profiling.

4. Legal basis for processing

Under the NDPA 2023, we process your data on the following lawful bases:

• Contract — processing necessary to fulfil a service agreement with you
• Consent — newsletter subscriptions and non-essential analytics cookies (you may withdraw consent at any time)
• Legitimate interests — responding to project enquiries, improving our services

5. Data storage and security

Your data is stored in Supabase (PostgreSQL) infrastructure hosted within a region compliant with NDPA data residency guidance. All data is encrypted at rest (AES-256) and in transit (TLS 1.3). Access is restricted to authorised team members only, protected by role-based access controls and two-factor authentication.

We retain your enquiry and project data for three years from the end of our engagement, after which it is deleted. Newsletter subscriber data is retained until you unsubscribe. Analytics data is aggregated and anonymised within 26 months.

6. Third-party service providers

We share data with the following processors under data processing agreements:

• Supabase — database and authentication
• Resend — transactional email delivery
• Paystack — payment processing (for template purchases)
• Vercel — website hosting and edge functions
• PostHog — product analytics (self-hostable, GDPR/NDPA compliant)

7. Your rights

Under the NDPA 2023, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request erasure of your data ("right to be forgotten")
• Withdraw consent at any time (for consent-based processing)
• Object to processing based on legitimate interests
• Lodge a complaint with NITDA (Nigeria's data protection authority)

To exercise any of these rights, email us at privacy@techagency.africa. We will respond within 30 days.

8. Changes to this policy

We may update this policy from time to time. We will notify subscribers by email of material changes at least 14 days before they take effect. The "last updated" date at the top of this page always reflects the current version.

9. Contact

Data Controller: TechAgency Africa ·hello@techagency.africa ·Lagos, Nigeria
Data Protection Officer: privacy@techagency.africa