| Document Ref. | HB-PN-01 |
| Version | 1.0 |
| Effective Date | 1 December 2025 |
| Review Cycle | Annual or on material change |
| Prepared By | Data Protection Officer |
| Applicable To | All Heckerbella platform users |
| Primary Law | Nigeria Data Protection Act 2023 (NDPA) |
| Contact | business@heckerbella.com | +234 706 7358 926 |
Summary
Heckerbella builds and runs software. We collect personal data in two situations: when you contact us or use our website, and when a client asks us to process data on their behalf. We do not sell personal data, and we do not use it for anything we have not told you about here.
You have rights over your data under the Nigeria Data Protection Act 2023 to see it, correct it, delete it, restrict or object to its use, take it elsewhere, and complain. To use any of them, email our Data Protection Officer at dpo@heckerbella.com. We will acknowledge within 72 hours and respond within 30 days, free of charge.
1. Who We Are
Heckerbella is an information technology company incorporated in Nigeria (RC-935428) that designs, builds, hosts, and maintains software for its clients and sells its own software products. We deliver these services through a web and mobile portal, client-specific portal, and our website at www.heckerbella.com (together, the “Platform”). In this Notice, “Heckerbella”, “we”, “our” and “us” mean Heckerbella.
This Notice explains what personal data we handle, why, on what lawful basis, who we share it with, how long we keep it and what you can require of us, according to the Nigeria Data Protection Act 2023 (“NDPA”) and the Nigeria Data Protection Commission's General Application and Implementation Directive 2025 (“GAID”).
2. Our Two Roles: Controller and Processor
Nigerian law distinguishes between an organization that decides why and how personal data is used (the data controller) and one that only handles data on someone else's written instructions (the data processor). Heckerbella does both, and which role we play changes what you can ask of us.
| Activity | Our role | What this means for you |
|---|---|---|
| Our website, contact form, social media accounts and marketing | Controller | We decide the purpose. This Notice governs, and you can exercise all your rights directly with us. |
| Our client relationships: onboarding, service delivery, support and billing | Controller | We decide the purpose. This Notice governs. |
| Building, hosting, maintaining or supporting a system for a client, and processing the data inside it | Processor | The client decides the purpose and the lawful basis. Their privacy notice governs, not ours. See section 8. |
3. Who and What This Notice Covers
This Notice applies to personal data we process when you:
- visit www.heckerbella.com or any specific portal we operate in our own name;
- complete our contact form or otherwise write, call or message us;
- interact with our official accounts on LinkedIn, Facebook, X (formerly Twitter) or Instagram;
- are a client, or work for a client, and use our support channels;
- attend an event we host or exhibit at, or subscribe to our updates; or
- visit our Lagos office, where CCTV and a visitor register may operate.
It also explains, in section 8, how we handle personal data transmitted to us by a client acting as data controller.
This Notice does not cover: the websites of other organizations that we link to, such as the social media platforms, which separate controllers of your account data from them; or systems we operate for a client, where the client's own privacy notice applies.
This Notice should be read together with our Consumer Code of Practice and our Cookie Notice, where it exists. Where those documents conflict with this Notice on a data protection question, this Notice prevails.
4. The Personal Data We Collect
We collect only what we need for the purposes set out in section 7. The table below shows each category, what it contains and where it comes from.
| Category | What it includes | Source |
|---|---|---|
| Identity and contact data | First and last name, organization name, job title, office address, email address, telephone number, and anything else you choose to write in a message to us | Provided by you through our contact form, by email, by phone or in person |
| Social media data | Your username or handle, and the content of any public post, comment or direct message you send us | Provided by you when you interact with our accounts |
| Client service data | Contact details of the client's representatives, onboarding and due-diligence information required to open the account, support tickets and correspondence, service usage records | Provided by the client, or generated as we deliver the service |
| Payment and billing data | Bank account number, account holder name, invoice and payment records. We do not store full payment card numbers | Provided by the client, or generated by our billing process |
| Technical and security data | Access logs generated by our security monitoring | Collected automatically when you use the Platform |
| Marketing data | Your subscription status and preferences | Provided by you when you subscribe; generated when you interact with our messages |
| Client-instructed data | Whatever categories the client specifies in the data processing agreement. We do not choose them | Transmitted to us by the client as data processor |
Where we obtain your personal data from a source other than you, for example from your employer, a business directory or a public register we will tell you the source when we first contact you, as the NDPA requires.
4.1 Sensitive personal data
Sensitive personal data means data revealing ethnic origin, religious or similar beliefs, health status, sex life, political opinions, trade union membership, criminal records, genetic and biometric data, and any other category the Commission designates. In Nigeria, processing sensitive personal data is consent-centric under the NDPA.
When we process such data, we follow the requirements of the NDPA and implement safeguards commensurate with the sensitivity of this data.
5. The Lawful Basis for Each Activity
We process personal data only where the NDPA permits it. Where we rely on our legitimate interests, we first carry out and document a Legitimate Interest Assessment in the form set out by law, and we make it available to the Commission on request.
| Processing activity | Lawful basis (NDPA) | Why it applies |
|---|---|---|
| Replying to enquiries from our website, email or social media | s.25(1)(a) consent; or s.25(1)(b)(i) steps taken at your request before entering into a contract; or s.25(1)(b)(v) legitimate interest | You asked us to get in touch. Answering you is what you expect and involves no more data than you gave us. |
| Onboarding clients and delivering our services | s.25(1)(b)(i) performance of a contract | We cannot provide the service without processing the data of the people who use and administer it. |
| Invoicing and taking payment | s.25(1)(b)(i) performance of a contract | Payment is a contractual term. |
| Keeping accounting, tax and transaction records | s.25(1)(b)(ii) compliance with a legal obligation | Nigerian company and tax legislation requires us to retain accounting records for a fixed period, whether or not you would prefer otherwise. |
| Security logging, access monitoring, fraud and abuse prevention, and system integrity | s.25(1)(b)(v) legitimate interest | Protecting the Platform protects everyone whose data is on it. |
| Marketing emails, newsletters and event invitations | s.25(1)(a) consent | Requested separately from anything else, never bundled into our terms, and withdrawable in one click. |
| Responding to a lawful request from a court, regulator or law enforcement agency | s.25(1)(b)(ii) legal obligation; or s.25(1)(b)(iii) vital interests where life or safety is at risk | We comply with valid legal processes, and only with valid legal processes. |
| Processing carried out on a client's written instructions | Determined by the client as data controller | We do not select the basis. Our obligation is to act only on documented instructions. |
| Any sensitive personal data we process | s.30 NDPA explicit consent, or another ground permitted by s.30 | Held to a higher standard, with consent recorded and withdrawable. |
6. Consent, and How to Withdraw It
Where we rely on your consent, we ask for it clearly and separately, in plain language, for a specific purpose. We do not treat silence, inactivity, or a pre-ticked box as consent, and we do not make access to our services conditional on consent you do not need to give.
You can withdraw consent at any time, and it is easy to do so. Use the unsubscribe link in any marketing email or write to our Data Protection Officer. Withdrawal takes effect going forward; it does not make our earlier processing unlawful, and it does not affect processing that rests on a different basis, such as records we must keep by law.
7. What We Use Your Data For
We use personal data only for the purposes below. If we ever want to use it for something materially different, we will tell you first and, where the law requires it, ask for your consent.
| Category | Purpose |
|---|---|
| Identity and contact data | Answering your enquiry, arranging meetings, and maintaining a record of our correspondence with you |
| Social media data | Responding to public posts and messages directed at our accounts |
| Client service data | Onboarding, providing and supporting services, managing relationships, and resolving disputes |
| Payment and billing data | Issuing invoices, taking and reconciling payment, and meeting accounting and tax obligations |
| Technical and security data | Keeping the Platform available and secure, investigating incidents, preventing fraud and abuse, and diagnosing faults |
| Marketing data | Sending you the updates you asked for, and honoring your preferences |
| Client-instructed data | Carrying out the processing the client has instructed. |
8. When We Act as a Data Processor
A large part of what we do is run systems for clients. When we do, the client is the data controller: they decide why the data is collected, what happens to it and on what lawful basis. We are the data processor, and we act only on their documented written instructions.
In that role, we commit to the following, and every client contract records them under a data processing agreement:
- We process personal data only as instructed, and we tell the client if we believe an instruction breaches the NDPA;
- we apply the security measures in section 12 and impose equivalent obligations on any sub-processor;
- We engage a sub-processor only with the client's prior written authorization, and we remain responsible for its performance;
- we assist the client in responding to data subject requests, breaches, DPIAs and enquiries from the Commission;
- we notify the client of any personal data breach without undue delay; and
- At the end of the engagement we return or delete the data as the client directs, except where the law requires us to keep it.
If you contact us about data we hold only as a processor, we will not act on the request we are not permitted to. We will forward it to the controller responsible within 2 working days and confirm to you that we have done so. In appropriate cases, we will give you their contact details so you can follow up directly.
9. How Long We Keep Personal Data
We keep personal data only as long as we need it for the purpose we collected it for, or as long as the law requires. Our retention schedule is below.
| Category | Retention period | Rationale |
|---|---|---|
| Identity and contact data (enquiries) | 12 months since our last substantive contact with you | Long enough to pick up a conversation that resumes; not a permanent record of people who once wrote to us |
| Social media data | As long as the post or message remains on the platform; our own copies for 12 months | We do not control the platforms' own retention |
| Client service data | Duration of the contract, plus 6 years | Contractual limitation periods and dispute resolution |
| Payment, billing and accounting records | 7 years from the end of the financial year to which they relate | Retention of accounting records under Nigerian company and tax legislation. |
| Technical and security logs | 12 months, or longer where an incident is under investigation | Security monitoring and incident forensics. |
| Marketing data | Until you unsubscribe, plus a permanent suppression record of your email address | A suppression list is how we make sure we do not contact you again. |
| Client-instructed data | As specified in the data processing agreement, then returned or deleted on the client's instruction | The client decides; we execute. |
At the end of the retention period, data is securely deleted or irreversibly anonymized.
11. Transfers of Personal Data Outside Nigeria
Presently, we do transfer personal data outside Nigeria. However, if the need arises, we shall comply with the NDPA requirements for cross-border transfers.
12. How We Protect Personal Data
We maintain technical and organizational measures proportionate to the sensitivity of the data we hold under our Information Security Management System. Our measures currently include:
- strong encryption of personal data at rest and in transit, using current industry-standard algorithms and protocols;
- role-based access control on a need-to-know basis, with multi-factor authentication on all privileged systems;
- just-in-time privileged access, with immutable audit logging of what was accessed and by whom;
- continuous security monitoring and alerting;
- regular independent penetration testing and a risk-based vulnerability management process with defined remediation timelines;
- routine encrypted backups with tested restoration; and
- data protection and security training for every member of staff, refreshed annually.
These measures change as technology and threats change. No system can be made completely secure, and we do not claim otherwise — which is why section 13 sets out exactly what we do when something goes wrong.
13. Personal Data Breaches
A personal data breach is a security failure that leads to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data. We record every incident in an internal breach register, whether or not it is notifiable, and we investigate each one.
- To the Commission. Where a breach is likely to result in a risk to the rights and freedoms of individuals, we notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, as the NDPA requires, giving the description, categories and approximate numbers affected, likely consequences and the measures we are taking.
- To you. Where the breach is likely to result in a high risk to you, we contact you directly and without undue delay. We describe in plain language what happened, what data was involved, what we are doing about it and what you can do to protect yourself, and we give you the DPO's contact details.
- To our clients. Where we act as processors, we notify the client who is the data controller without undue delay, so they can meet their own obligations, and we support their investigation.
14. Automated Decision-Making and Profiling
We do not make decisions about you based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. Any decision of that kind is taken by a person.
16. Marketing Communications
We send marketing only to people who have asked for it. Every message carries a one-click unsubscribe, and we act on it immediately. You have a right to object to direct marketing, and we simply stop.
17. Children
A child, in Nigerian law, is anyone under 18. The Heckerbella Platform is a business service and is neither directed at nor intended for children, and we do not collect their personal data.
If you are a parent or guardian and believe we hold data about a child, write to our DPO at dpo@heckerbella.com. We will investigate, and where we confirm it, we will delete the data immediately and confirm to you that we have done so.
18. Your Rights
The NDPA gives you the following rights over your personal data.
| Right | Basis | What it means |
|---|---|---|
| To be informed | s.27 | To know who we are, what we do with your data and why — that is what this Notice is for. Where we did not get your data from you, you can ask us where it came from. |
| Of access | s.34(1)(a) | To confirm whether we hold data about you, and to receive a copy of it along with the purposes, categories, recipients and retention period. |
| To rectification | s.34(1)(c) | To have inaccurate data corrected and incomplete data completed. We never charge you to fix an error that is ours. |
| To erasure | s.34(1)(d) | To have your data deleted. Some data we must keep by law — accounting records, for example — and we will tell you when that applies and why. |
| To restriction | s.34(1)(e) | To have us pause processing while we check a challenge to accuracy, while an objection is being decided, or while a legal claim is being established or defended. |
| To withdraw consent | s.35 | Where we rely on consent, to withdraw it at any time, as easily as you gave it, without affecting the lawfulness of what came before. |
| To object | s.36 | To object to processing based on legitimate interests or public interests. We must stop unless we can show overriding legitimate grounds. For direct marketing your objection is absolute and we stop immediately. |
| Regarding automated decisions | s.37 | Not to be subject to a decision based solely on automated processing with legal or similarly significant effects, and to request human review, express your view and contest the outcome. |
| To data portability | s.38 | To receive the data you provided to us, where we process it by automated means on the basis of consent or contract, in a structured, commonly used, machine-readable format such as CSV or JSON and to have it sent directly to another organization where technically feasible. |
| To complain | s.46(1) | To lodge a complaint with the Nigeria Data Protection Commission, and to seek a remedy in court. |
19. How to Exercise Your Rights
Write to our Data Protection Officer at dpo@heckerbella.com or at the postal address in section 24 and tell us which right you want to exercise and what data it concerns.
- Identity. We may ask for enough information to be confident we are dealing with you and not someone else — no more than we need, and we delete verification material afterwards.
- Timing. The NDPA requires us to act without constraints or unreasonable delay. In practice: we acknowledge within 72 hours and respond substantively within 30 calendar days. If a request is genuinely complex and we need more time, we will tell you before the 30 days expire, explain why, and give you a date.
- Cost. There is no charge. We will never charge you to correct an error we made.
- Limits. We may decline a request that is manifestly unfounded or excessive, or where answering would disclose someone else's personal data or breach a legal obligation. If we decline, in whole or in part, we will tell you which parts, why, and how to escalate. We keep a record of every request and every refusal.
20. Complaints and Redress
If you are unhappy with how we have handled your personal data or your request, you have several routes, and you do not have to use them in order.
- Come to us first, if you are willing. Write to dpo@heckerbella.com. We will acknowledge within 72 hours and aim to resolve the matter within 30 days.
- Standard Notice to Address Grievance (SNAG). Under Article 40 of GAID, you may serve us SNAG where you reasonably believe we have violated your right to privacy, requiring us to address it formally. Serving a SNAG is not a precondition for anything else you may want to do.
- The Commission. You may lodge a complaint with the Nigeria Data Protection Commission at ndpc.gov.ng. You do not need our permission or our involvement.
- The courts. You may approach the Federal High Court or a State High Court, including under the Fundamental Rights (Enforcement Procedure) Rules, and you may seek compensation for injury, loss or harm caused by a violation.
21. Accessibility and Vulnerable Data Subjects
Article 27 of the GAID requires that this information actually reach the people it concerns. The summary at the beginning of this Notice is written to be read in a minute. If you need this Notice in a different format — large print, a simplified summary, or read aloud over the phone — ask our Data Protection Officer, and we will provide it at no cost. Where we collect personal data in a setting where a written notice cannot practically be read, such as at an event or over the phone, we explain the key points verbally and tell you where to find the full Notice.
22. Governing Law
This Notice is governed by the laws of the Federal Republic of Nigeria. The Nigeria Data Protection Act 2023 takes priority over any other instrument on the protection of personal data, as section 63 of the Act provides. Nothing in this Notice limits any right you have under the NDPA or the Constitution.
23. Changes to This Notice
We review this Notice at least annually and whenever our practices, technology or legal obligations change materially. The current version is always published on our website, with its version number and effective date at the top. Where a change materially affects you, we will tell you by email or through a notice on the Platform before it takes effect. Continuing to use the Platform after that date means the updated Notice applies to you.
24. Contact Us
| Contact | Details |
|---|---|
| Data Protection Officer | dpo@heckerbella.com |
| Customer support | support@Heckerbella.com |
| General and business enquiries | business@Heckerbella.com |
| Postal address | 9th Floor Ibukun House, 14 Adetokunbo Ademola Street, Victoria Island Lagos, Nigeria. |
| Supervisory authority | Nigeria Data Protection Commission (NDPC), ndpc.gov.ng |
We take every privacy query seriously and will respond within 30 calendar days of receipt.
Approved by Tega Sylvester Adajero, Director of Operations, on 1 December 2025.
Heckerbella Limited (RC 935428) · 9th Floor Ibukun House, 14 Adetokunbo Ademola Street, Victoria Island, Lagos · +234 (0)706 735 8926 · www.heckerbella.com