Approved by Tradeflow Africa Limited · Effective 9 October 2026.
1. Purpose and legal framework
Tradeflow Africa Limited is the legal entity responsible for this website. This policy sets out the framework for handling personal information in website enquiries, subscriptions and related trade facilitation activity. It is not a certification of compliance.
This policy is governed by the laws of the Federal Republic of Nigeria, including the Nigeria Data Protection Act 2023. The Nigeria Data Protection Commission is the regulator responsible for overseeing data protection in Nigeria. Applicable regulatory requirements and other mandatory laws must also be considered where relevant. Legal and privacy enquiries may be sent to talktous@tradeflow.africa.
2. Responsible processing principles
Personal information should be used fairly, transparently and for a defined lawful purpose. Collect only what is relevant, take reasonable steps to maintain accuracy, retain information only as needed and protect it against unauthorized access, alteration, loss or disclosure.
New uses should be reviewed before implementation, particularly where the information is sensitive, the recipients change or the activity affects people in another jurisdiction.
3. Collection and sensitive information
The website enquiry form requests a title, name, email address, organization, enquiry type, service of interest and message. The subscription form requests an email address.
Identity documents, bank details and other sensitive records should not be collected through ordinary website messages. If a service later requires such information, its purpose, lawful basis and suitable secure collection method should be agreed separately.
4. Access and confidentiality
Website enquiries are kept in a private inbox restricted to the authorized administrator. Access to personal information should be limited to people who need it for an approved purpose, with appropriate confidentiality duties.
Access permissions should be reviewed when responsibilities change. Credentials should not be shared, and personal records should not be published or copied into public materials.
5. Providers, disclosures and cross-border handling
Hosting and other service providers may process information needed to operate the website, under documented responsibilities, permitted uses and safeguards.
Personal information is handled in Nigeria and is not transferred abroad except where it is stored or hosted with cloud service providers whose infrastructure may be outside Nigeria. Such storage must rely on providers offering adequate protection and appropriate safeguards, consistent with the cross-border transfer requirements of the Nigeria Data Protection Act 2023. Information is shared with commercial partners only for a defined purpose and on a lawful basis.
6. Retention and disposal
Standard retention periods apply: general enquiry records up to two years after the last interaction; newsletter subscriptions until the subscriber unsubscribes; and client engagement, contractual and financial records six years after the engagement ends, unless a longer period is required by law or needed for the establishment, exercise or defence of legal claims.
Records no longer needed are securely deleted or anonymized, including in backups as they cycle out.
7. Individual requests and complaints
Requests for access, correction, deletion, restriction, objections or withdrawal of subscription consent may be sent to talktous@tradeflow.africa. They should be logged and reviewed under the Nigeria Data Protection Act 2023 and other applicable law. Any identity verification should be proportionate and avoid collecting unnecessary information.
Requests must be handled within applicable statutory deadlines, subject to lawful exceptions. Individuals may lodge a complaint with the Nigeria Data Protection Commission if they believe their personal information has been processed unlawfully, without prejudice to other available legal remedies.
8. Incidents and ongoing review
Suspected loss, disclosure or unauthorized use of personal information should be assessed promptly, contained where possible and documented. Any required notice to affected individuals or a regulator should follow the applicable legal criteria and deadlines.
The final organizational framework should assign incident responsibilities and provide for staff awareness, periodic review and evaluation of new data-processing activities.
Contact and related policies
For legal questions or privacy requests, contact Tradeflow Africa Limited at talktous@tradeflow.africa or use the contact form. Please avoid sending identity documents, passwords or sensitive financial details in ordinary email or website messages.