01 Introduction
NexKeys Agency (“NexKeys,” “we,” “us,” or “our”) respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy describes our practices in connection with information collected through our website, booking system, contact forms, and in the course of project engagements.
By using the NexKeys website or engaging our services, you consent to the collection and use of your personal information as described in this Policy. If you do not agree, please discontinue use of our Platform immediately.
This Policy is compliant with the Nigeria Data Protection Regulation 2019 (NDPR) and is aligned with international best practices including the General Data Protection Regulation (GDPR) where applicable to our international clients.
02 Data Controller
For the purposes of applicable data protection law, the Data Controller responsible for your personal information is:
Lagos, Federal Republic of Nigeria
03 Data We Collect
3.1 Information You Provide Directly
We collect personal information that you voluntarily provide to us, including when you:
- Complete a booking form to schedule a discovery call (name, email address, phone number, timezone, project notes).
- Submit a project brief or contact form (name, email, company name, service requirements, project description).
- Enter into a project agreement or contract with NexKeys.
- Communicate with us via email, phone, or social media.
3.2 Information Collected Automatically
When you visit our website, we may automatically collect certain technical information, including:
- Device & Browser Data: Browser type and version, operating system, device type, screen resolution.
- Usage Data: Pages visited, time spent on pages, navigation paths, referring URLs, and click behaviour.
- Technical Identifiers: IP address, approximate geographic location (country/city level), session identifiers.
3.3 Information from Third-Party Sources
We may receive limited information about you from third-party platforms such as LinkedIn or social media if you contact us through those channels. We do not purchase personal data from data brokers.
We do not collect sensitive personal data (such as financial account numbers, government identification numbers, biometric data, or health information) through our website or booking system.
04 How We Use Your Data
NexKeys Agency uses the personal data we collect for the following purposes:
| Purpose | Data Used |
|---|---|
| Processing and confirming discovery call bookings | Name, email, phone, timezone, notes |
| Responding to enquiries and project briefs | Name, email, company, project description |
| Delivering project services and communicating progress | All project-related contact and technical data |
| Sending booking confirmations and reminders | Name, email, booking details |
| Improving our website and services | Anonymised usage and analytics data |
| Complying with legal and regulatory obligations | As required by applicable law |
| Protecting against fraud and security threats | Technical identifiers, IP address |
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.
05 Legal Basis for Processing
Under the NDPR and applicable data protection law, we process your personal data on the following legal grounds:
- Consent: Where you have given clear consent for us to process your data for a specific purpose (e.g., scheduling a discovery call or submitting a brief).
- Contractual Necessity: Where processing is necessary for the performance of a contract with you, or to take steps at your request prior to entering a contract.
- Legitimate Interests: Where processing is necessary for our legitimate business interests (e.g., website analytics, fraud prevention, portfolio display), and these interests are not overridden by your rights.
- Legal Obligation: Where processing is necessary to comply with a legal obligation to which NexKeys is subject.
07 Analytics
NexKeys Agency may use web analytics tools to help us understand how our website is used and to improve user experience. Any analytics data collected is aggregated and anonymised — it is not used to identify individual users.
If we implement Google Analytics or a similar service, we will configure it to anonymise IP addresses and will update this Policy accordingly. You may opt out of analytics tracking by:
- Installing the Google Analytics Opt-out Browser Add-on.
- Enabling “Do Not Track” in your browser settings.
- Using a privacy-focused browser or extension.
08 Third-Party Services
Our website and booking system integrate with the following third-party services. Each operates under its own privacy policy:
| Service | Purpose | Privacy Policy |
|---|---|---|
| Google Firebase / Firestore | Booking data storage and availability management | firebase.google.com/support/privacy |
| EmailJS | Transactional email delivery for booking confirmations | emailjs.com/legal/privacy-policy |
| Google Fonts | Web typography (Bebas Neue, Syne, DM Sans) | policies.google.com/privacy |
| Cloudflare CDN | GSAP and Three.js library delivery | cloudflare.com/privacypolicy |
NexKeys Agency does not sell, rent, or trade your personal information to third parties for marketing purposes.
09 Data Sharing & Disclosure
We may share your personal data only in the following limited circumstances:
- Service Providers: Trusted third-party vendors who assist in delivering our services (such as those listed in Section 8), bound by contractual data protection obligations.
- Legal Requirements: Where we are required by law, court order, or government authority to disclose your information.
- Protection of Rights: Where disclosure is necessary to protect the rights, property, or safety of NexKeys Agency, our clients, or the public.
- Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity, subject to the same privacy protections.
We will never sell your personal data to third parties. We will never share your data with advertisers or use it for purposes unrelated to delivering our services.
10 International Data Transfers
As NexKeys Agency serves clients globally and uses services such as Firebase and EmailJS, your data may be processed on servers located outside Nigeria. Where such transfers occur, we ensure that appropriate safeguards are in place, including:
- Engaging only processors that maintain adequate data protection standards.
- Ensuring compliance with NDPR transfer rules and, where applicable, GDPR Standard Contractual Clauses.
By submitting your information through our website, you acknowledge and consent to such transfers.
11 Security Practices
NexKeys Agency implements reasonable and appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:
- HTTPS encryption for all data transmitted through our website and booking system.
- Access controls and role-based permissions for systems that store personal data.
- Firebase Firestore security rules that restrict read and write access to only authorised operations.
- Regular review and updating of security practices in line with industry standards.
While we take data security seriously, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, and you share personal data at your own risk. In the event of a data breach that is likely to result in risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by law.
12 Data Retention
We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our retention periods are as follows:
| Data Category | Retention Period | Reason |
|---|---|---|
| Booking records | 2 years from booking date | Business records, dispute resolution |
| Project correspondence | 5 years from project completion | Legal and contractual obligations |
| Contact form submissions | 12 months if no engagement follows | Follow-up and service improvement |
| Invoicing and payment records | 7 years | Regulatory and tax compliance |
| Website analytics (anonymised) | 26 months | Performance analysis |
Once data is no longer required, it is securely deleted or anonymised in accordance with our data disposal procedures.
13 Your Rights
Under the Nigeria Data Protection Regulation (NDPR) and applicable international data protection law, you have the following rights regarding your personal data:
- Right of Access: You have the right to request a copy of the personal data we hold about you.
- Right to Rectification: You have the right to request that we correct any inaccurate or incomplete personal data.
- Right to Erasure: You have the right to request deletion of your personal data where there is no lawful basis for continued processing.
- Right to Restriction: You have the right to request that we restrict the processing of your data in certain circumstances.
- Right to Data Portability: Where processing is based on consent or contract, you have the right to receive your data in a structured, commonly used, and machine-readable format.
- Right to Object: You have the right to object to processing based on legitimate interests, including direct marketing.
- Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, please contact us at nexkeysagency@gmail.com with the subject line DATA REQUEST — [Your Name]. We will respond within thirty (30) days. We may need to verify your identity before processing your request.
If you are dissatisfied with our response, you have the right to lodge a complaint with the National Information Technology Development Agency (NITDA), which is the supervisory authority for data protection in Nigeria.
14 Children’s Privacy
NexKeys Agency services are intended for businesses and adult professionals. Our website and services are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently received personal data from a person under 18, we will delete it promptly. If you believe we may have collected data from a minor, please contact us immediately at nexkeysagency@gmail.com.
15 Changes to This Policy
NexKeys Agency may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or service offerings. Material changes will be communicated via a prominent notice on our website prior to the changes taking effect.
The “Last Revised” date at the top of this document reflects the most recent update. We encourage you to review this Policy periodically. Your continued use of our Platform following the effective date of any revision constitutes your acceptance of the updated Policy.
16 Contact
For all privacy-related enquiries, data access requests, or complaints, please contact our team:
Lagos, Nigeria
All data requests must be submitted via email with the subject line DATA REQUEST — [Your Name] for fastest processing.