Privacy Policy

Version 2.1  |  Effective Date: January 1, 2026  |  Governing Legislation: Nigeria Data Protection Act (NDPA 2023) & Nigeria Data Protection Regulation (NDPR)

At ACE ICT Consult ("we", "us", "our", or the "Company"), we recognize that confidentiality, integrity, and data privacy are foundational to professional technology advisory. As an organization advising tier-one enterprises, financial institutions, and government bodies on IT Audit, Cybersecurity, and Governance, Risk & Compliance (GRC), we uphold the highest standard of personal data stewardship.

This Privacy Policy explains how we collect, process, protect, retain, and dispose of personal information collected through our website (https://aceictconsult.com), during client onboarding, training program registrations, and business consultations.

1. Data Controller Identity and Scope

For the purposes of the Nigeria Data Protection Act 2023 (NDPA), the Data Controller responsible for your personal information is:

This policy applies to all visitors to our website, corporate representatives requesting technology assessments or advisory services, candidates registering for professional training courses, and third-party vendors or partners engaging with ACE ICT Consult.

2. Principles of Data Processing

In accordance with Section 24 of the NDPA 2023, all personal data processed by ACE ICT Consult is governed by the following core principles:

• Lawfulness, Fairness and Transparency: Processed lawfully, equitably, and with clear disclosure to data subjects.
• Purpose Limitation: Collected for explicit, specified, and legitimate technology consulting purposes and not processed in ways incompatible with those purposes.
• Data Minimization: Adequate, relevant, and limited strictly to what is necessary in relation to the stated purposes.
• Accuracy: Kept accurate and, where necessary, updated without undue delay.
• Storage Limitation: Kept in an identifiable form for no longer than is necessary for the purposes for which it is processed or as mandated by Nigerian statutes.
• Integrity and Confidentiality: Processed in a manner that ensures appropriate security against unauthorized processing, accidental loss, destruction, or damage.

3. Categories of Personal Data We Collect

We collect personal information directly from you when you interact with our website or engage our consulting team, as well as automatically through secure web protocols:

A. Information You Provide to Us Directly

• Business Contact Information: Full name, business email address, telephone number, corporate designation/title, and employer or organization name.
• Inquiry & Advisory Details: Specific details of your IT audit requirements, cybersecurity posture, infrastructure challenges, or consulting inquiries entered via our contact and booking forms.
• Training & Certification Enrollment: Professional credentials, employer sponsorship data, course attendance records, and examination scores for participants attending ACE ICT Consult training academies.
• Billing & Commercial Records: Corporate tax identification numbers, corporate bank details, billing contacts, and transaction references for contract fulfillment.

B. Information Collected Automatically via Digital Protocols

• Technical Identifiers: Internet Protocol (IP) address, browser type and version, language settings, operating system, and hardware platform.
• Usage & Interaction Telemetry: Uniform Resource Locators (URLs) clicked to, through, and from our website, page response times, download errors, duration of page visits, and reading interactions with our whitepapers and insight articles.
• Cookies and Local Storage Tokens: Identifiers stored on your browser to maintain session security, CSRF protection, and cookie preference memory (see our Cookies Policy).

4. Lawful Bases for Processing

Under Section 25 of the NDPA 2023, ACE ICT Consult relies on one or more of the following lawful bases to process your personal data:

5. Purposes for Which We Process Your Data

We process your personal information strictly for clear, legitimate operational goals:

• To evaluate technology environments and formulate customized IT Audit, Cybersecurity, and Infrastructure proposals.
• To execute contracted technical assessments, vulnerability analyses, and governance reviews.
• To register candidates, coordinate logistics, and issue verified completion certificates for our training programs.
• To communicate essential administrative, project, and scheduling notices.
• To investigate, prevent, and remediate cybersecurity threats, system vulnerabilities, and fraudulent access to our web services.
• To fulfill regulatory reporting requirements with Nigerian supervisory authorities including the Nigeria Data Protection Commission (NDPC).

6. Sharing and Third-Party Disclosures

ACE ICT Consult does not sell, lease, or monetize personal data under any circumstances. We share data only with authorized recipients under strict contractual confidentiality and data protection covenants:

• Authorized Service Providers: Cloud infrastructure, data hosting, enterprise email gateways, and IT monitoring providers acting as Data Processors bound by robust Data Processing Agreements (DPAs) in compliance with the NDPA.
• Professional Advisers: External legal counsel, statutory financial auditors, and risk underwriters where strictly necessary for legal defense or regulatory assurance.
• Regulatory and Law Enforcement Authorities: The Nigeria Data Protection Commission (NDPC), Central Bank of Nigeria (CBN), Economic and Financial Crimes Commission (EFCC), or courts of competent jurisdiction, strictly where required by enforceable legal process, subpoena, or statutory enactment.

7. Cross-Border Data Transfers

Where your data is processed by or transferred to secure cloud infrastructure located outside the Federal Republic of Nigeria (e.g., enterprise cloud backup platforms in tier-one global data centers), ACE ICT Consult adheres strictly to Chapter V of the NDPA 2023. We ensure:

• The recipient jurisdiction offers an adequate level of data protection recognized by the NDPC; or
• The transfer is governed by enforceable Standard Contractual Clauses (SCCs), technical encryption controls, and verifiable audit rights ensuring protection equivalent to Nigerian law.

8. Technical & Organizational Security Controls

In our capacity as cybersecurity and technology assurance professionals, we apply state-of-the-art defenses to protect personal data against accidental loss, unauthorized access, destruction, or alteration:

• Cryptographic Protection: Mandatory TLS 1.3 encryption for all data in transit across public networks, along with AES-256 encryption for data at rest.
• Role-Based Access Control (RBAC): Strict least-privilege enforcement, multi-factor authentication (MFA) on all administrative endpoints, and automated session timeouts.
• Continuous Vulnerability Management: Regular external attack surface reviews, static/dynamic security testing, and active log monitoring.
• Organizational Safeguards: Mandatory staff training on NDPA compliance, background verification for sensitive roles, and binding non-disclosure agreements (NDAs).
• Incident Response Playbooks: Documented procedures to identify, contain, and report data breaches to the NDPC within the statutory 72-hour window where required by law.

9. Data Retention and Secure Disposal

Personal data is retained only for as long as is necessary to satisfy the purpose for which it was gathered, or to comply with statutory, tax, and accounting limitation periods under Nigerian law:

• General Web Inquiries: Retained for twelve (12) months following resolution of the query unless a commercial engagement ensues.
• Client Project Working Papers: Retained for seven (7) years following completion of the audit or consulting project in line with statutory professional liability standards.
• Training & Certification Records: Retained for ten (10) years to facilitate certificate authenticity verification for alumni and employers.

Upon the expiration of the retention schedule, records are permanently sanitized using cryptographic deletion protocols or certified physical cross-cut shredding.

10. Your Rights as a Data Subject under NDPA 2023

Under the Nigeria Data Protection Act 2023, you are entitled to exercise the following enforceable rights regarding your personal information:

• Right to Information: You have the right to be informed about how your personal data is collected and processed.
• Right of Access: You can request confirmation of whether we hold your personal data and obtain a free copy of such records within thirty (30) days.
• Right to Rectification: You may request immediate correction of inaccurate or incomplete personal records.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal data where there is no overriding legal ground for continued retention.
• Right to Restrict Processing: You can request that we suspend active processing of your data while an accuracy or legality inquiry is pending.
• Right to Data Portability: You may obtain your provided data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing based on legitimate interests or to direct marketing at any time.
• Right to Withdraw Consent: Where processing relies on your consent, you may withdraw it at any time without affecting prior lawful processing.
• Right to Lodge a Complaint: You have the right to lodge a complaint directly with the Nigeria Data Protection Commission (NDPC) via their official portal at ndpc.gov.ng.

11. Cookies, Telemetry & Browser Storage

We use cookies and local storage tokens to deliver a secure, responsive browsing experience. For comprehensive details regarding cookie categories, lifetimes, third-party edge services, and instructions on how to manage or revoke your consent, please review our comprehensive Cookies Policy.

12. Protection of Children’s Privacy

Our website and services are targeted exclusively at corporate entities, adult business professionals, and technology practitioners. We do not knowingly solicit or collect personal information from individuals under eighteen (18) years of age. Any inadvertently collected minor information will be purged immediately upon notice.

13. Amendments to this Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our operational procedures, technological advancements, or legislative updates under the NDPA. Material revisions will be prominently announced on this page with an updated effective date. We encourage you to review this policy periodically.

14. Data Protection Officer (DPO) & Contact Desk

To exercise any of your data protection rights, request a Subject Access Request (SAR), or seek clarification on our privacy practices, please contact our designated Data Protection Officer: