1. Introduction
Novnine Solutions Global Limited ("Novnine ESG," "we," "us," "our"), a company duly incorporated in Nigeria under registration number RC 8907860, operates the Novnine ESG Solutions platform (the "Platform"). This Privacy Policy explains how we collect, use, disclose, and protect personal data and organisational data when you use our website (novnineesg.com) and Platform.
Novnine ESG is registered with the Nigeria Data Protection Commission (NDPC) as a Data Controller in accordance with the Nigeria Data Protection Act 2023 ("NDPA 2023").
2. Data We Collect
2.1 Account and Contact Information
- Full name, work email address, phone number, job title
- Organisation name, industry classification, and regulatory profile
- Login credentials (encrypted; we do not store plain-text passwords)
2.2 Environmental, Social, and Governance Data
Operational data you or your organisation enters into the Platform, including but not limited to energy consumption, water usage, waste metrics, workforce demographics, board composition, and compliance status. This data belongs to your organisation; Novnine ESG processes it solely to provide the Platform's services.
2.3 Technical and Usage Data
- IP address, browser type, device information
- Log data including access times and pages viewed
- Cookies and similar tracking technologies (see Section 12)
3. How We Use Your Data
- To provide, maintain, and improve the Platform
- To generate sustainability reports and compliance documentation on your behalf
- To communicate with you regarding your account, support requests, and service updates
- To send regulatory deadline reminders relevant to your organisation's profile
- To comply with legal and regulatory obligations
- To detect, prevent, and address technical issues or security incidents
4. Legal Basis for Processing
Under NDPA 2023, we process personal data on the following legal bases:
- Contractual necessity — to provide the Platform services you have subscribed to
- Legitimate interest — to improve our services and ensure Platform security
- Legal obligation — to comply with applicable Nigerian law, including FRCN reporting requirements where relevant
- Consent — for marketing communications, which you may withdraw at any time
5. Data Sharing and Disclosure
We do not sell personal data. We share data only in the following circumstances:
- Service providers: Cloud hosting (Amazon Web Services), PDF generation, and email delivery providers who process data solely on our instructions under contractual confidentiality obligations
- Legal requirements: Where disclosure is required by Nigerian law, court order, or regulatory authority
- Business transfers: In connection with a merger, acquisition, or sale of assets, subject to equivalent privacy protections
- With your consent: Where you have explicitly authorised disclosure to a third party (e.g., your external auditor)
Data Isolation: Your organisation's ESG data is never accessible to other Platform clients. Data isolation is enforced at database level, not merely through interface permissions.
6. Data Retention
We retain data according to your subscription plan, aligned with Nigerian regulatory audit requirements:
- Starter plan: 90-day audit trail retention
- Professional plan: 2-year audit trail retention
- Enterprise plan: retention period as specified in the applicable Enterprise proposal or agreement, subject to legal and regulatory requirements
Upon account cancellation, your complete data is exported and provided to you before deletion, unless a longer retention period is required by law or your selected plan.
7. Data Security
- Encryption in transit (TLS) and at rest (AES-256)
- Hosting on Amazon Web Services enterprise infrastructure, SOC 2 Type II certified
- Role-based access control across 7 permission levels, ensuring users access only data relevant to their function
- Timestamped audit logging of all data access and modification events
While we implement robust technical and organisational measures, no system is completely immune to security risks. We commit to notifying affected parties in accordance with Section 9 in the event of a breach.
8. Your Rights Under NDPA 2023
As a data subject, you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate or incomplete data
- Request deletion of your personal data, subject to legal retention requirements
- Object to or restrict certain processing activities
- Request data portability in a structured, commonly used format
- Withdraw consent at any time where processing is based on consent
- Lodge a complaint with the Nigeria Data Protection Commission
To exercise any of these rights, contact our Data Protection Officer using the details in Section 11.
9. Data Breach Notification
In the event of a personal data breach likely to result in risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of the breach, in accordance with NDPA 2023. Where the breach poses a high risk to affected individuals, we will notify you directly without undue delay.
10. Cross-Border Data Transfer
Some of our service providers (including cloud infrastructure providers) may process data outside Nigeria. Where this occurs, we ensure appropriate safeguards are in place consistent with NDPA 2023 cross-border transfer requirements, including contractual data protection obligations equivalent to Nigerian standards.
11. Cookies
Our website uses essential cookies necessary for functionality and, where you consent, analytics cookies to understand site usage. You may disable non-essential cookies through your browser settings without affecting core website functionality.
12. Changes to This Policy
We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. Material changes will be communicated via email or Platform notification. Continued use of the Platform after changes take effect constitutes acceptance of the revised Policy.