Nigeria Data Protection (NDP) Policy

Effective Date: [16/10/2026]

1. Purpose and Legal Framework

GTSmartAI seeks to handle personal data responsibly and in accordance with applicable Nigerian data-protection requirements, including the Nigeria Data Protection Act 2023 and the Nigeria Data Protection Act General Application and Implementation Directive 2025, where applicable. This governance Policy complements our user-facing Privacy Policy; it does not replace individual privacy notices or any contractually required data-processing agreement.

2. Coverage and Roles

This Policy covers personal data processed through GTSmartAI’s website, account registration, AI tools, prompts and uploads, subscriptions, support channels, analytics, team workspaces, AI agents, and website chatbots. Depending on the service and relationship, GTSmartAI may act as a data controller for its own account and business operations or as a data processor for a business customer’s data. Responsibilities will be allocated through applicable contracts and law.

3. Data Protection Principles

We aim to process personal data lawfully, fairly, and transparently; collect data for specific, legitimate purposes; minimize unnecessary collection; maintain appropriate accuracy; retain information no longer than necessary; and apply reasonable integrity, confidentiality, and accountability safeguards. Personal data will not be used for an unrelated purpose without an appropriate legal basis.

4. Lawful Bases and Consent

Processing may be necessary to perform a contract, comply with a legal obligation, pursue a legitimate interest where permitted, protect vital interests, perform a relevant public-interest task, or rely on freely given and valid consent, as appropriate to the activity. Where consent is required, we will provide a meaningful choice and a method of withdrawal. Consent withdrawal does not invalidate earlier lawful processing.

5. AI Inputs, Outputs, and Sensitive Data

Prompts, documents, images, audio, chatbot conversations, and generated outputs may contain personal data. Customers should not upload sensitive personal information or another person’s confidential data unless they are authorized to do so and a proper lawful basis and safeguards exist. We will limit access and sharing to what is needed to provide the selected service, maintain security, meet contractual obligations, or comply with law.

6. Third-Party Processors and Subprocessors

GTSmartAI may engage hosting, cloud infrastructure, analytics, customer-support, payment, and AI-model providers. Before transferring personal data to a service provider, we aim to evaluate appropriate privacy and security safeguards and, where required, maintain contractual data-processing protections. An AI provider’s retention or model-improvement practices may depend on the provider and configured service; these must be accurately disclosed in relevant notices.

7. Cross-Border Transfers

Some technology providers may process information outside Nigeria. Where Nigerian data-protection rules apply, international transfers will be assessed under the applicable legal transfer conditions and safeguards. We will not represent that all information remains in Nigeria unless our technical operations support that claim.

8. Individual Rights and Requests

Subject to applicable conditions and exceptions, individuals may request information about processing; access to their personal data; correction of inaccurate records; erasure; portability; withdrawal of consent; objection to certain processing; and safeguards in relation to qualifying solely automated decisions. Requests may be sent to [email protected]. We may verify identity before fulfilling a request and will respond in accordance with applicable legal timelines.

9. Data Security and Incident Management

We aim to apply safeguards proportionate to the risks involved, including access restrictions, authentication, secure transmission and storage where supported, administrative controls, and incident escalation. Suspected personal-data breaches will be evaluated, contained, documented, and reported to the Nigeria Data Protection Commission and affected persons where the law requires notification. No online system can be guaranteed completely secure.

10. Retention, Deletion, and Records

Personal data will be retained in accordance with documented business needs, user settings, contractual requirements, legal obligations, and dispute-resolution needs. GTSmartAI should maintain an internal retention schedule for account records, content, backups, security logs, support tickets, and billing records. We will securely delete, de-identify, or restrict information when retention is no longer justified, subject to lawful exceptions.

11. Governance and Accountability

GTSmartAI will assess its obligations concerning data-protection registration, a designated Data Protection Officer, records of processing, privacy impact assessments, staff training, processor oversight, and audit or compliance returns based on the nature, scale, and classification of processing. Required duties will be fulfilled when applicable; this Policy does not claim a registration or certification that has not been verified.

12. Complaints and Policy Updates

Individuals may raise complaints with [email protected] and, where appropriate, the Nigeria Data Protection Commission. We may revise this Policy as services or legal obligations change, with appropriate notice of material changes.