Privacy Policy

1. Introduction & Scope

This Privacy Policy explains how Barrow Technologies Limited (“we”, “us”, or “our”) collects, uses, stores, and protects personal data when you use our services and visit our website at https://barrow.ng. This policy is issued in compliance with the Nigeria Data Protection Act (NDPA) 2023 and the Nigeria Data Protection Regulation (NDPR). It applies to all personal data processed by Barrow Technologies Limited, whether collected online or offline.

Effective Date: 19 September 2026.

We are committed to protecting your privacy and ensuring that your personal data is handled responsibly and in accordance with applicable data protection legislation.

2. Data We Collect

Barrow Technologies Limited collects the following categories of personal data in the course of providing our services. Data may be collected directly from you (e.g. through forms, account registration, or correspondence) or automatically (e.g. through cookies, server logs, and similar technologies).

We only collect personal data that is adequate, relevant, and limited to what is necessary for the purposes described in this policy, in accordance with the NDPA 2023.

3. Legal Basis for Processing

Barrow Technologies Limited processes personal data under one or more of the following lawful bases as prescribed by the Nigeria Data Protection Act (NDPA) 2023:

• Consent: where you have given clear, informed, and voluntary consent for specific processing activities (NDPA Section 25).
• Contract: where processing is necessary for the performance of a contract to which you are a party, or to take pre-contractual steps at your request (NDPA Section 25).
• Legitimate Interest: where processing is necessary for our legitimate interests (such as fraud prevention and network security), provided those interests are not overridden by your rights and freedoms (NDPA Section 25).
• Public Interest / Research: where processing is necessary for scientific or historical research purposes, or statistical purposes, subject to appropriate safeguards.

We will always inform you of the specific legal basis applicable to each processing activity at the time of data collection.

4. How We Use Your Data

We process the personal data we collect for the following purposes:

• Service Delivery — to provide, maintain, and improve the services you have requested from us.
• Marketing — to send promotional communications where you have opted in to receive them.
• Analytics — to analyse usage patterns and improve user experience.
• Research — to conduct research and development for service improvement.
• Fraud Prevention — to detect, prevent, and respond to fraud, security threats, and abuse.

We will not process your personal data for purposes incompatible with those stated above without providing you with prior notice and, where required by the NDPA, obtaining your consent.

5. Data Sharing & Disclosure

Barrow Technologies Limited does not sell personal data under any circumstances.

We do not currently share your personal data with third-party processors. Should this change, we will update this policy and, where required, obtain your consent before any sharing takes place.

We may also disclose personal data where required by law, regulation, or valid legal process, including requests from Nigerian regulatory and law enforcement authorities.

6. Your Rights as a Data Subject

Under the Nigeria Data Protection Act (NDPA) 2023, you are entitled to the following rights regarding your personal data:

1. Right of Access — You may request confirmation of whether we process your personal data and obtain a copy of that data (NDPA Section 34(1)(a)–(b)).
2. Right to Rectification — You may request correction of inaccurate or incomplete personal data we hold about you (NDPA Section 34(1)(c)).
3. Right to Erasure — You may request deletion of your personal data where there is no compelling legal reason for its continued processing (NDPA Section 34(1)(d), Section 34(2)).
4. Right to Restrict Processing — You may request that we limit the processing of your personal data in certain circumstances (NDPA Section 34(1)(e)).
5. Right to Withdraw Consent — Where processing is based on consent, you may withdraw that consent at any time (NDPA Section 35), without affecting the lawfulness of processing carried out prior to withdrawal.
6. Right to Object — You may object to the processing of your personal data where processing is based on legitimate interest or is carried out for direct marketing purposes (NDPA Section 36).
7. Right Not to Be Subject to Automated Decisions — You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects (NDPA Section 37).
8. Right to Data Portability — You may request to receive your personal data in a structured, commonly used, and machine-readable format (NDPA Section 38).

To exercise any of these rights, please contact us at support@barrow.ng. We will respond to your request within 30 days (extendable in complex cases per NDPC GAID 2025). If you are unsatisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) under NDPA Section 46(1).

7. Data Security Measures

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of personal data in transit (TLS 1.2+) and at rest (AES-256).
• Access controls and least-privilege principles for all systems handling personal data.
• Regular security assessments, penetration testing, and vulnerability scanning.
• Staff training on data protection obligations and information security best practices.
• Incident response procedures aligned with NDPA breach notification requirements (72-hour notification to NDPC).

While we employ industry-standard safeguards, no method of electronic transmission or storage is entirely secure. If you become aware of any security incident affecting your data, please contact us immediately at support@barrow.ng.

8. Contact Information

If you have questions, concerns, or requests regarding this privacy policy or our data protection practices, please contact us:

9. Cross-Border Data Transfers

Where we transfer personal data outside Nigeria, we do so in strict compliance with Sections 43 and 44 of the NDPA 2023. We ensure that any cross-border transfer of personal data is subject to one or more of the following safeguards:

• The receiving country has been assessed by the NDPC as providing an adequate level of data protection.
• We have put in place appropriate contractual safeguards, such as Standard Contractual Clauses approved by the NDPC.
• You have provided explicit consent to the transfer after being informed of the associated risks.
• The transfer is necessary for the performance of a contract between you and us, or for pre-contractual steps taken at your request.
• The NDPC has granted an administrative authorisation for the transfer.

10. Automated Decision-Making & Profiling

In accordance with Section 37 of the NDPA 2023, we inform you of any automated decision-making processes, including profiling, that produce legal effects or similarly significant effects on you.

Where we use automated decision-making:

• We will inform you that automated processing is being used and provide meaningful information about the logic involved.
• You have the right to request human intervention in any automated decision.
• You have the right to express your point of view and contest the decision.
• We will carry out regular reviews of automated decision-making systems to ensure fairness, accuracy, and absence of bias.
• We will not base automated decisions solely on sensitive personal data unless you have given explicit consent or the processing is authorised by Nigerian law.

You may object to automated decision-making at any time by contacting us using the details provided in this policy.

11. Data Retention Schedule

Barrow Technologies Limited retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable Nigerian law. Our retention periods are determined based on the following criteria:

• The nature and sensitivity of the personal data.
• The purposes for which the data is processed.
• Legal, regulatory, and contractual obligations (including NDPA 2023 requirements).
• Legitimate business needs such as maintaining records for audits, dispute resolution, and regulatory examinations.

When personal data is no longer required, it is securely deleted or irreversibly anonymised in accordance with our internal data retention and disposal policy.