Privacy Policy — Meraki Group Limited

1. Who We Are

Meraki Group Limited is a technology and software development company incorporated in Nigeria (CAC RC 9717854). Our registered address and primary place of business is Nigeria. For data protection enquiries, contact our Data Protection Officer at hello@merakigroupltd.com.

2. Information We Collect

We collect the following categories of personal data:

Identity data: Full name, email address, phone number.
Contact data: Company name, postal address (where provided).
Usage data: IP address, browser type, pages visited, referral URL, timestamps — collected automatically via our visit-tracking system.
Account data: Login credentials (passwords are stored as salted bcrypt hashes — never in plain text), session tokens.
Communication data: Messages, notes, and correspondence submitted through contact and quote forms.
Transaction data: Payment amounts, Paystack transaction references (we do not store card numbers or CVVs — Paystack handles card data under PCI-DSS).
Marketing preferences: Newsletter subscription status and opt-in source.

3. Legal Basis for Processing

We process your data under the following lawful bases (NDPR Article 2.2):

Consent: Where you have explicitly opted in (e.g. newsletter subscription, contact form submission).
Contract: Where processing is necessary to perform a contract with you (e.g. delivering project work, managing your client portal).
Legitimate interests: Fraud prevention, site security, and improving our services — where these interests are not overridden by your rights.
Legal obligation: Where required by Nigerian law (e.g. tax records).

4. How We Use Your Data

To provide and manage your client portal account and project delivery.
To process payments and issue invoices.
To respond to enquiries, quotes, and support requests.
To send transactional emails (project updates, password resets, invoice notifications).
To send marketing newsletters — only where you have subscribed and can unsubscribe at any time.
To analyse website traffic to improve performance and user experience.
To comply with legal and regulatory obligations.

5. Data Retention

We retain personal data for as long as necessary for the purpose it was collected:

Account data: For the duration of your account plus 12 months after closure.
Project and transaction records: 7 years (Nigerian tax and company law requirements).
Password reset tokens: Auto-deleted within 1 hour of creation or use.
Session tokens: Expire per your account's configured TTL (default 7 days).
Marketing data: Until you unsubscribe or request deletion.
Usage/analytics logs: 90 days.

6. Data Sharing

We do not sell your personal data. We share data only with:

Paystack: For payment processing. Paystack is PCI-DSS compliant. See paystack.com/privacy.
Email service providers: For transactional and marketing emails (e.g. SMTP relay). Only your name and email address are shared.
Cloud infrastructure providers: Servers where our application and database are hosted (e.g. AWS, Vercel). These providers process data on our behalf under data processing agreements.
Professional advisers: Lawyers and accountants, where legally required.

All third-party processors are bound by data processing agreements and prohibited from using your data for their own purposes.

7. Cookies & Tracking

Our website uses minimal first-party tracking. We record page visits (URL, referrer, browser, IP address) for analytics and fraud prevention. We do not use third-party advertising cookies or behavioural tracking. You may block cookies in your browser settings without affecting core site functionality.

8. Your Rights Under NDPR

As a data subject you have the right to:

Access: Request a copy of the personal data we hold about you.
Rectification: Request correction of inaccurate data.
Erasure: Request deletion of your data where there is no lawful reason to continue processing.
Restriction: Ask us to halt processing while a dispute is resolved.
Objection: Object to processing based on legitimate interests.
Data portability: Receive your data in a structured, machine-readable format.
Withdraw consent: At any time, where processing is consent-based (this does not affect prior processing).

To exercise any right, email us at hello@merakigroupltd.com. We will respond within 30 days. If you are unsatisfied, you may lodge a complaint with NITDA (the Nigerian data protection authority) at nitda.gov.ng.

9. Security

We implement appropriate technical and organisational measures including: bcrypt password hashing, AES-256 encryption of sensitive fields at rest, TLS 1.2+ in transit, JWT authentication with short-lived access tokens, and session invalidation on password change. No system is perfectly secure; if you suspect a breach, contact us immediately.

10. Children's Privacy

Our services are not directed at children under 18. We do not knowingly collect data from minors. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

11. Changes to This Policy

We may update this policy to reflect changes in our practices or legal requirements. Material changes will be notified by email (for registered users) and by updating the "effective date" above. Continued use of our services after changes constitutes acceptance of the updated policy.

12. Contact

For privacy enquiries or to exercise your rights:
Meraki Group Limited
CAC RC 9717854
Email: hello@merakigroupltd.com