Effective Date: 17 August 2026
Data Controller: Digital Elixir Ltd (CAC Incorporated: 2017)
Registered Office: Suite A2, Saham Plaza, Alexandria Crescent, Wuse II, Abuja, Nigeria
Contact Email: |
1. Introduction & Regulatory Framework
Digital Elixir Ltd (“Digital Elixir”, “we”, “us”, or “our”) respects your fundamental right to privacy and is committed to protecting your personal data. This Privacy Policy outlines our practices concerning the collection, storage, processing, and transfer of personal information when you visit our website (digitalelixir.com.ng), engage our digital marketing and web engineering services, or communicate with our team.
We process personal data in strict compliance with the Nigeria Data Protection Act 2023 (NDPA), regulations issued by the Nigeria Data Protection Commission (NDPC), and international privacy benchmarks including the General Data Protection Regulation (GDPR) where cross-border data processing occurs.
2. Information We Collect
We collect only the minimum personal data necessary to provide our professional services, respond to inquiries, and maintain high website security:
A. Information You Provide Voluntarily
- Contact & Inquiry Details: When you submit our qualification or consultation form, we collect your full name, business email address, direct phone number, company name, website URL, estimated project budget, and project description.
- Consultation & Booking Information: When you schedule a meeting via our TidyCal integration, we collect your chosen meeting time, timezone, meeting agenda notes, and attendance preferences.
- Client Billing Information: For contracted client engagements, we collect corporate invoicing details, Tax Identification Numbers (TIN), registered business addresses, and authorized signatory contacts. (We do not store raw payment card data on our servers; transactions are processed through authorized payment gateways).
B. Information Collected Automatically
- Technical & Device Data: IP address, browser type and version, operating system, device screen resolution, referring URLs, pages visited, time spent per page, and interaction timestamps.
- Aggregated Analytics: Anonymized browsing patterns collected via privacy-configured Google Analytics 4 (GA4) with IP anonymization enabled.
3. Legal Basis for Processing
Under Section 25 of the NDPA 2023, we process your personal data under the following lawful bases:
- Consent: Where you have granted explicit consent (e.g., submitting an inquiry form, booking a consultation, or subscribing to our email newsletter).
- Contractual Performance: Where processing is necessary to draft, execute, or deliver our agency services under a signed Service Level Agreement (SLA).
- Legal Obligation: Where processing is required to comply with Nigerian corporate laws, tax reporting to the Federal Inland Revenue Service (FIRS), or lawful court orders.
- Legitimate Interests: Where processing is necessary to defend our digital infrastructure against brute-force attacks, malware injection, and fraudulent inquiries, without overriding your fundamental privacy rights.
4. How We Use Your Information
We use personal data strictly for commercial, technical, and communication purposes:
- To evaluate client requirements and prepare customized SEO, advertising, or web development proposals.
- To schedule, confirm, and host virtual or in-person consultation sessions at our Abuja office.
- To design, code, host, audit, and maintain contracted web applications and digital campaigns.
- To issue invoices, process retainer payments, and maintain accounting compliance under Nigerian commercial law.
- To analyze anonymized website traffic, diagnose server errors, and optimize user experience across mobile and desktop devices.
- To protect our digital assets, clients, and visitors against unauthorized access and cyber threats.
5. Third-Party Processors & Data Sharing
We do not sell, rent, or trade your personal data to data brokers or third-party advertisers. We share data only with verified technical sub-processors bound by confidentiality and data processing agreements:
| Service Provider | Role & Purpose | Data Shared | Processing Location |
|---|---|---|---|
| Formspree / Web3Forms | Form Processing & Submission | Name, Email, Phone, Project Notes | USA / EU (Encrypted) |
| TidyCal / AppSumo | Calendar Scheduling | Name, Email, Meeting Time | USA (SOC 2 Compliant) |
| Google LLC (GA4) | Anonymized Traffic Analytics | Anonymized IP, Device Type, Visited URLs | Global / EU / USA |
| Cloudflare / Host Provider | Web Traffic Routing & Security | IP Address, Request Headers | Distributed Global Edge |
6. International Data Transfers
When data is transferred outside the Federal Republic of Nigeria to international cloud service providers, we ensure appropriate safeguards are implemented in accordance with Part VI of the NDPA 2023, such as Standard Contractual Clauses (SCCs), encryption-in-transit, and validation of adequate data protection jurisdictions.
7. Data Retention & Security
- Retention Period: We retain inquiry submissions and consultation notes for twenty-four (24) months to facilitate ongoing business communications. Contracted client records, SLAs, and financial invoices are retained for seven (7) years in accordance with Nigerian statutory accounting and tax retention requirements.
- Security Safeguards: We implement robust administrative, technical, and physical safeguards including TLS/SSL encryption across all endpoints, strict role-based access control, multi-factor authentication (MFA) on all internal systems, and regular server vulnerability audits.
8. Your Data Subject Rights
Under the Nigeria Data Protection Act 2023 and applicable international privacy frameworks, you hold the following rights:
- Right of Access: The right to request a copy of the personal data we hold about you.
- Right to Rectification: The right to request correction of inaccurate, outdated, or incomplete data.
- Right to Erasure (“Right to be Forgotten”): The right to request deletion of your personal data where retention is no longer legally necessary.
- Right to Object / Restrict Processing: The right to object to direct marketing or request restrictions on specific processing activities.
- Right to Data Portability: The right to receive your personal data in a structured, commonly used, and machine-readable format.
- Right to Withdraw Consent: The right to withdraw previously granted consent at any time without affecting the lawfulness of processing prior to withdrawal.
To exercise any of these rights, please email our Data Protection Officer at or write to us at our Abuja address. We respond to all verified requests within thirty (30) calendar days without charge.
9. Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes in our operational practices or legal requirements. The updated version will be indicated by the “Last Updated” timestamp at the top of this page. We encourage you to review this policy periodically.