ACCI Data Policy
PREAMBLE
Abuja Chamber of Commerce and Industry [hereafter referred to as “Data Controller” or ACCI].
Our contact information is provided under ARTICLE 12 of this Data Privacy Policy.
This privacy policy is in furtherance of section 37 of the Constitution of the Federal Republic of Nigeria (CFRN) 1999 (as amended), the Nigeria Data Protection Act (NDPA) 2023, and all other legal instruments designed to protect the privacy rights of natural persons.
At ACCI, we are aware of the privacy rights of all natural persons who are part of ACCI or interact with us on our various data processing mediums and platforms. These classes of people are our “Data Subjects”. As a responsible establishment, we are committed to safeguarding the privacy rights of our data subjects through this strict privacy policy. It shall complement the existing legal and regulatory framework as an internal standard of the duty of care we owe to our “Data Subjects”.
ARTICLE 1: OUR GUIDING PRINCIPLES ON DATA PROTECTION
In processing your data, we adhere strictly to the principles of data processing as set out under S. 24 of the NDPA. Our obligation in terms of the principle is to ensure that personal data is:
- processed in a fair, lawful, and transparent manner;
- collected for specified, explicit, and legitimate purposes, and not to be further processed in a way incompatible with these purposes;
- adequate, relevant, and limited to the minimum necessary for the purposes for which the personal data was collected or further processed;
- retained for not longer than is necessary to achieve the lawful bases for which the personal data was collected or further processed;
- accurate, complete, not misleading, and, where necessary, kept up to date having regard to the purposes for which the personal data is collected or is further processed; and
- processed in a manner that ensures appropriate security of personal data, including protection against unauthorized or unlawful processing, access, loss, destruction, damage, or any form of data breach.
Furthermore, we are committed to ensuring accountability, demonstrating a duty of care to you, and also upholding data Confidentiality, Integrity, and availability.
ARTICLE 2: CONSENT OF DATA SUBJECTS
Except as otherwise required by operation of law or principles of law, your consent as the data subject is paramount in our considerations. You have the right to give, withhold, or otherwise withdraw your consent to data processing.
ARTICLE 3: OUR SCOPE OF DATA COLLECTION
In varying degrees, vis-à-vis the services we provide for you or your level of engagement with us, we do process your data. Below is a table containing the major types of personal data, the purpose, and the lawful bases for processing them:
S/N | PURPOSE OF COLLECTION | TYPE OF DATA | LAWFUL BASIS |
1 | REGULATORY ACTIONS | Name, Phone, Email Address, Contact Address, Sex, Date of Birth, passport, and educational record. | LEGAL OBLIGATION. Some instances may involve public interest. |
2 | NOTIFICATIONS | Name, Phone, Email Address, Contact Address, Sex, and Date of Birth. | LEGAL OBLIGATION. Some may require consent as prescribed by the NDPA. |
3 | DATA ANALYTICS | Name, Phone, Email Address, Contact Address, Sex, and Date of Birth. | CONSENT. (To ensure that our services suit the purpose of data subjects and to measure our performance). Some may involve legitimate interest or legal obligation where analytics are tailored towards crime prevention. |
4 | SECURITY | Name, Phone, Email Address, Contact Address, Sex, Date of Birth, and passport. | LEGAL OBLIGATION. For safety and security of lives and property. Some may involve legitimate interest or public interest where analytics are tailored towards crime prevention. |
5 | EMPLOYMENT | Name, Phone, Email Address, Contact Address, Sex, Date of Birth, passport, medical record, educational record. | CONTRACT. This is the major lawful basis. Some instances may involve other lawful basis such as consent, vital interest or legal obligation. |
6 | CONTRACT | Name, Phone, Email Address, Contact Address, and Sex/td> | CONTRACT. Some instances may involve legitimate interest or public interest – particularly in carrying out due diligence. |
Please note that the categories of data and the lawful basis provided are not exhaustive. We are governed by the Data processing laws and regulations, and we process data without prejudice to your rights as a data subject.
ARTICLE 4: RIGHTS OF DATA SUBJECTS
We hold your privacy rights very dear to our operations. Apart from the right to give, withhold, or withdraw consent, you have the right to all relevant information that may guide you in making informed decisions about your data. For example, you have the right to be notified of anyone or any place to which we may transfer your data. Your rights under the NDPA include but are not limited to the following:
- Right to be Informed
- Right of Access
- Right to Rectification
- Right to Object to Processing
- Right to Data Portability
- Right in Relation to Automated Decision Making (which essentially entitles you to human intervention)
Note that you also have a right to complain to ACCI.
ARTICLE 5: WITHHOLDING RELEVANT DATA
There are types of personal data that are mandatory for us to process to carry out your instructions or perform our legal mandate for your benefit. If you withhold such information, it may be impracticable to carry out our mandate in relation to you. If you seek more clarification on our data processing, contact our designated Data Protection Officer as provided under ARTICLE 12 below.
ARTICLE 6: TRANSFER OF DATA TO A THIRD PARTY
As a public establishment, third parties may wish to provide essential services to you (through our platforms) while relying on the relevant lawful bases for processing your data in this regard. The type of data usually processed for this may be your contact details. Where such services depend on consent, you have the right to decline and further restrict the processing of your data. You can simply unsubscribe from the notices sent for such services.
ARTICLE 7: TECHNICAL INFORMATION AND COOKIES
Customarily, websites are designed to collect certain information from the visitor. Our website is also designed to collect your IP address and other information that your web browser typically shares with the websites that you visit. The purpose of this is to know you better and to automatically and dynamically engage with you through your actions on our website.
“Cookies”, in computer parlance, are text files that are downloaded to your browsing devices, such as phones or computers, when you browse pages of websites. They contain small amounts of data and their essential function is to intelligently memorize your preferences and therefore present them to you as choices when you are browsing, even at different times. Note that various websites use cookies for different purposes, some of which may undermine your privacy rights. We have taken measures to ensure that all methods adopted by us to engage automatically with you do not violate your privacy rights under the NDPA. In the case of cookies, we ensure that they have security protocols and are not vulnerable to abuse by anyone.
ARTICLE 8: PERSONAL DATA SECURITY AND INTEGRITY
We use cutting-edge technologies and foolproof protocols to provide you with comprehensive layers of security in the area of personal data. Thus, we are constantly vigilant in preventing cyber-attacks, fraudulent intrusion, unauthorized access, loss, or corruption of personal data. We are equally cognizant of the obligations imposed on us by law in terms of data protection. Accordingly, we conduct reviews of process and privacy impact assessment, carry out training, and obtain strict warranties where applicable.
ARTICLE 9: PURPOSE AND STORAGE LIMITATION
The purpose of data processing usually determines the length of time within which your data is stored with us and the residual data actually stored for this purpose. We collect and store personal data that is reasonably required by law or best practice to serve you or respond to a legitimate enquiry about our transaction with you. We take this responsibility very seriously in view of the need for you to enjoy your privacy as guaranteed under the 1999 Constitution of the Federal Republic of Nigeria and international human rights law.
ARTICLE 10: CAVEAT ON WEBSITE LINKS
Our website may contain links to other websites. Save and except as otherwise expressly stated by us, any link to another website is not covered by our privacy policy. We strongly advise that you should satisfy yourself with the details of any privacy policy provided on other websites or links.
ARTICLE 11: TRANSFER TO THIRD PARTIES AND COUNTRIES
In carrying out our mandate effectively, we may require the services of third parties who may be within or outside the NDPA jurisdiction (Nigeria). Examples of such services include but are not limited to the following:
- a) Internet connectivity,
- b) Cloud storage,
- c) Data analytics,
- d) Data security, and
- e) Software development.
In transferring your data to third parties, we shall be guided by the NDPA. See PART VIII of the NDPA.
ARTICLE 12: ACCI DATA PROTECTION UNIT
We have provided a data protection officer (DPO) to respond promptly and satisfactorily to all your requests, suggestions and complaints. The data protection unit will be responsible for prompt action on your data privacy concerns. Contact the unit via this email: ithub@accinigeria.com. Data protection regulations compliance and breach services amongst others;
- Data protection and privacy advisory services
- Data protection capacity building
- Data Regulations Contracts drafting and advisory
- Data protection and privacy breach remediation planning and support services
- Information privacy audit
- Data privacy breach impact assessment
- Data Protection and Privacy Due Diligence Investigation
- Data Protection Officer
ARTICLE 13: ALTERATION OF PRIVACY POLICY
- ACCI reserves the right to alter the foregoing policy for the purposes of advancing data privacy rights, public interest or complying with lawful directives of the Federal Government – in line with the safeguards under the NDP Act and the 1999 Constitution of the Federal Republic of Nigeria.