Privacy Policy

Effective date: 2 March 2023

This Privacy Policy explains how Bright Webs ("we", "us" or "our") collects, uses, discloses and protects personal information when you visit our website, contact us, request a project or preview, purchase a digital product, make a referral or sign a client agreement.

1. Responsibility and Contact

Bright Webs is responsible for personal information processed for its own enquiries, client relationships, orders and website administration. You may contact us about privacy through our contact form or at team@brightwebs.com.ng. Please identify your request as a privacy matter.

Where we handle personal information on a client's instructions as part of a commissioned project, the respective responsibilities, permitted processing and any additional safeguards must be addressed in that engagement. This policy does not replace a client's own privacy notice.

2. Information We Collect

• Contact and enquiry information: your name, email address, phone or WhatsApp number, messages and correspondence.

• Project information: requested services, website details, business requirements, budget range, timeline, instructions and materials you choose to provide.

• Order and payment records: customer contact details, products selected, order references, amounts, payment status and confirmation information. Card details entered on Paystack's checkout are processed by Paystack; our checkout does not collect your full card number or card security code.

• Agreement and referral records: signer name, acceptance time, the agreement and policy text accepted, referral details and related commission enquiries.

• Website activity and technical information: pages viewed, interactions such as enquiries, cart activity and link clicks, session identifiers, traffic source and campaign information. Our analytics service derives a hashed visitor identifier from an IP address or session identifier. Hosting and verification providers may also process IP addresses, device or browser information and security logs.

• Administration information: authorized administrator account and authentication information needed to manage the website.

Please provide only information relevant to your request. Do not send passwords, payment card details, government identifiers, health information or other unnecessary sensitive information through public forms. If you provide another person's information, ensure you have an appropriate basis to do so.

3. Purposes and Lawful Grounds

We process information to respond to enquiries, prepare proposals, deliver and support projects, communicate about orders, verify payments, provide downloads, record agreements, administer referrals, maintain records, understand website use, prevent abuse and protect our services.

Depending on the activity, the applicable lawful ground may be taking steps at your request before entering a contract, performing a contract, complying with a legal obligation, pursuing a legitimate interest balanced against your rights, or consent where required. Legitimate interests may include proportionate website analytics, service administration, security and handling enquiries. Providing an email address for an enquiry is not, by itself, consent to unrelated promotional messages.

Where consent is required, we will seek it separately and you may withdraw it through the contact details above. Withdrawal does not invalidate processing that was lawful before withdrawal. Acknowledging this policy does not amount to blanket consent to every form of processing.

4. Browser Storage and Analytics

Our website uses local storage to remember the e-book cart and whether a project enquiry prompt has been shown, dismissed or submitted. Session storage holds an analytics session identifier, traffic-source or campaign information and prompt-display state. Authentication and verification services may use their own cookies or similar technologies.

The analytics implementation records page paths and selected interactions; it does not send the text of enquiry fields as analytics events. Hashed identifiers are used to help distinguish visits, but hashing does not necessarily make information anonymous. Service providers may maintain additional technical logs.

You can manage cookies and site storage through your browser settings. Clearing or blocking storage may reset your cart or preferences and may affect sign-in or verification. Where prior consent is required for a storage or analytics activity, it must be obtained before that activity takes place; this policy is not a substitute for that consent.

5. Service Providers and Other Disclosures

We use service providers where necessary to operate the website and deliver services. The current implementation uses Supabase for database storage, authentication and file storage; Vercel for website and server hosting; Cloudflare for Turnstile verification and, where configured, file storage; Resend for transactional email; and Paystack for payment processing. Enquiry notifications and replies may also pass through the email or messaging providers used by Bright Webs and the recipient.

These providers receive the information needed for their respective functions. Payment processors and other providers may also process information for their own legal, security or operational purposes under their own notices. If you choose to use WhatsApp, social media or an external website, the relevant provider's privacy terms also apply.

Information may also be disclosed to authorized personnel, contractors or professional advisers who need it for the engagement, or where required by law or reasonably necessary to establish or defend a legal claim. We do not sell personal information. Client information is not made public merely because someone referred the client to us.

For website care offers and update quotations, we process your contact details, requested work and payment link to communicate the offer and administer the service. Paystack processes subscription payment information and recurring billing under its own privacy arrangements. Analytics may include an approximate country derived from the visitor IP address by our hosting provider. We compile monthly aggregate website reports and send them to our designated business reporting recipient using Resend.

6. International Processing

Some providers may store or process information outside Nigeria. Such processing must have an appropriate legal basis and any safeguards required by applicable data protection law, including contractual safeguards or another permitted transfer mechanism where relevant. Contact us to ask about the providers or safeguards applicable to your information. Use of the website alone is not consent to an otherwise unlawful international transfer.

7. Retention

Retention depends on why the information was collected: enquiry records are needed for follow-up and related service enquiries; project records for delivery, support and contractual matters; and order, payment and agreement records for transaction verification, accounting, legal obligations and possible claims. Technical records may be retained by the providers operating the relevant services.

Information should not be retained longer than reasonably necessary for its purpose or an applicable legal requirement. We assess deletion, anonymization or restriction when information is no longer needed. You may request information about the retention period applicable to a particular record or ask us to review its continued retention; a request does not require deletion of records we must lawfully keep.

8. Security

We use measures appropriate to the information and services involved, including access controls, administrator authentication, server-side request validation and verification checks. Access should be limited to people and providers with an authorized need. No online system can guarantee absolute security; protect your own devices, accounts, order references and confidential links, and report suspected misuse promptly.

Where a personal data breach occurs, we will assess it and make any notifications required by applicable law.

9. Your Rights and Choices

Subject to applicable law and relevant exceptions, you may request access to your personal information, correction of inaccuracies, deletion, restriction of processing or portability where applicable. You may object to processing based on legitimate interests, object to direct marketing and withdraw consent where processing relies on consent.

Send your request through our Contact Form or email address above. We may request proportionate information to verify your identity and identify the relevant records; please do not send identity documents unless we explain why they are needed and agree a secure method. We will respond within the period required by applicable law and explain any lawful restriction on a request.

You may also raise a concern with the Nigeria Data Protection Commission or another competent supervisory authority. Contacting us first does not remove that right.

10. Children and Third-Party Content

Our services are directed at business clients and purchasers able to enter the relevant agreement, rather than children. If you believe a child has provided information without appropriate authorization, contact us so that we can assess and address it. Links and third-party websites are governed by their own privacy practices.

11. Changes to This Policy

We may revise this policy to reflect our services, processing arrangements or legal requirements. Material changes will be communicated where required. A change to this notice does not remove your existing rights or authorize processing that requires a separate lawful basis or consent.