Privacy policy
This policy explains how Vyncelle Creative Limited collects, uses, shares and protects personal data, and the rights you have over it. Please read it together with any notice we give you when you use a particular form, assessment or other resource.
1. About this policy
This policy explains how Vyncelle collects, uses, shares and protects personal data, and the rights you have over it. It applies when you:
- visit vyncelleco.com or any other website we operate that links to this policy (the “Website”);
- contact us, send an enquiry or book a conversation with us;
- use an assessment, scorecard, quiz, calculator, checklist, template, guide, download, webinar, event or any other tool or content we offer, whether free or paid (each a “Resource”);
- receive marketing communications from us;
- deal with us as a client, supplier or partner, or as a contact at one of them; or
- apply to work with us.
We process personal data in line with the Nigeria Data Protection Act 2023 (the “NDPA”), the regulations and guidance issued under it by the Nigeria Data Protection Commission (the “Commission”), and any other law that applies to us.
Where a form or Resource uses personal data in a way this policy does not describe, we will tell you at the point of collection. That notice forms part of this policy.
This policy does not cover personal data we process on behalf of our clients when delivering services to them. In those cases our client decides how the data is used, and our agreement with that client governs how we handle it.
2. Who we are
Vyncelle Creative Limited (“Vyncelle”, “we”, “us” or “our”) is the data controller for the personal data described in this policy. This means we decide why and how it is processed.
You can contact us about this policy or your personal data by email at hello@vyncelleco.com, or by post to Vyncelle Creative Limited, Lagos, Nigeria.
3. Key terms
In this policy:
- Personal data
- means any information relating to an identified or identifiable individual.
- Processing
- means any operation performed on personal data, including collecting, recording, storing, using, sharing and deleting it.
- Resource
- has the meaning given in clause 1.1.
- You
- means any individual whose personal data we process under this policy.
4. Personal data we collect
- Identity and contact details: your name, email address, phone number, company name and job title or role.
- Enquiry details: what you need help with, your timescales and anything you write in a message.
- Resource responses: your answers to a Resource, including information about your business such as its industry, revenue range, marketing spend, and how it attracts, converts and retains customers.
- Event details: registrations, attendance and questions you submit.
- Communications: emails and messages you send us, and notes of calls and meetings with you.
- Marketing preferences: your consent to receive marketing and any change to it.
- Application details: if you apply to work with us, your CV, work history, portfolio, references and anything else in your application.
- our hosting provider records technical information in server logs, such as your IP address, browser and device type, the pages you request, the page that referred you, and the date and time;
- if you arrive through a link containing campaign tags (for example “utm_source”), we record those tags with any form or Resource you submit, so we can see which channels bring people to us; and
- some Resources save your progress in your browser’s local storage, as explained in clause 6.3 and section 11.
If you choose not to give us information we ask for, we may be unable to respond to you, deliver a Resource or provide our services.
5. How we use personal data and our lawful bases
We process personal data only where we have a lawful basis under the NDPA. Our purposes, and the lawful bases we rely on, are:
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and arranging conversations you request | Consent; steps taken at your request before entering into a contract |
| Delivering a Resource, including scoring your responses and sending your results or report | Consent; steps taken at your request |
| Following up about a Resource you used or an enquiry you made, including offering a conversation or relevant services | Consent; our legitimate interest in responding to people who have shown interest in our services |
| Sending newsletters, invitations, updates and other marketing | Consent |
| Running events and webinars you register for | Consent; performance of a contract where the event is paid for |
| Providing services to clients and managing our relationships with clients, suppliers and partners | Performance of a contract; our legitimate interests |
| Improving the Website, our Resources and our services, including analysing responses in aggregated or anonymised form | Our legitimate interests |
| Keeping the Website and our systems secure, and preventing spam, fraud and abuse | Our legitimate interests |
| Assessing applications to work with us | Steps taken at your request before entering into a contract; our legitimate interests |
| Keeping records, complying with the law, and establishing, exercising or defending legal claims | Legal obligation; our legitimate interests |
Where we rely on legitimate interests, we have assessed that those interests are not overridden by your rights and freedoms, and we use your personal data only in ways you would reasonably expect. You can object at any time, as set out in section 13.
Where we rely on consent, you can withdraw it at any time by contacting us or, for marketing, by using the unsubscribe link in our emails. Withdrawal does not affect the lawfulness of processing carried out before you withdrew.
We will use personal data for a new purpose only if it is compatible with the purpose for which we collected it, or if we have a separate lawful basis and have told you first.
6. Assessments and other Resources
Each Resource explains what it asks for and what you will receive. For example, our Growth Scorecard asks for your contact details and answers to fifteen questions about your business, then emails you a scored report.
7. Marketing communications
We send newsletters and other marketing only to people who have opted in to receive them, or where the law otherwise allows it.
Messages that deliver a Resource you requested, or that follow up about it or about an enquiry you made, are not marketing newsletters. You can still ask us to stop them at any time.
You can unsubscribe from marketing at any time by using the link in our emails or by contacting us. We keep a minimal record of your request so that we do not contact you again.
We do not sell personal data, and we do not share it with third parties for their own marketing.
9. International transfers
Some of our service providers, including Google, process personal data outside Nigeria. We transfer personal data outside Nigeria only where the NDPA permits it, for example where the recipient country provides an adequate level of protection, where appropriate safeguards are in place, such as contractual commitments on confidentiality and security, or where another lawful ground under the NDPA applies.
You can contact us for more information about the safeguards we rely on.
10. How long we keep personal data
We keep personal data only for as long as necessary for the purposes in this policy, and then delete or anonymise it. Our standard retention periods are:
| Personal data | Retention period |
|---|---|
| Enquiries and related correspondence | 24 months after our last contact with you, unless you become a client |
| Resource submissions, results and reports | 24 months after our last contact with you, unless you become a client |
| Marketing preferences | Until you unsubscribe, after which we keep a minimal suppression record |
| Client, supplier and partner records | For the duration of the relationship and six years after it ends, to meet legal, tax and accounting obligations |
| Job applications | 12 months after the recruitment process ends, unless you agree to a longer period or you join us |
| Server logs | In line with our hosting provider’s retention practices |
| Progress saved on your device | Until you submit the Resource or clear your browser’s site data |
We may keep personal data for longer where the law requires it, or where it is needed to establish, exercise or defend legal claims.
12. Security
We use appropriate technical and organisational measures to protect personal data against accidental or unlawful loss, misuse, and unauthorised access, disclosure, alteration or destruction. These include encrypted connections (HTTPS), access controls that limit personal data to the people who need it, and secured accounts for the tools that hold it.
No method of transmission or storage is completely secure. If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Commission within 72 hours of becoming aware of it. If the breach is likely to result in a high risk to you, we will also tell you promptly, in clear and plain language.
13. Your rights
Under the NDPA, you have the right to:
- be informed about how we use your personal data;
- access your personal data and receive a copy of it;
- have inaccurate or incomplete personal data corrected;
- have your personal data deleted where there is no lawful reason for us to keep it;
- restrict how we process your personal data in certain circumstances;
- object to processing based on our legitimate interests, and object at any time to processing for direct marketing;
- receive your personal data in a structured, commonly used and machine-readable format, and have it sent to another controller where technically feasible;
- withdraw your consent at any time; and
- not be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you.
To exercise any of these rights, email hello@vyncelleco.com. We may need to verify your identity before acting on your request. We do not charge a fee unless a request is clearly unfounded or excessive, and we aim to respond within 30 days.
If you are unhappy with how we have handled your personal data, please contact us first so that we can try to resolve your concern. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (ndpc.gov.ng).
14. Children
The Website, our Resources and our services are intended for businesses and adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, please contact us and we will delete it.
15. Other websites and social media
The Website may link to other websites, including those of our clients and partners. We are not responsible for their privacy practices, so please read their privacy policies.
If you interact with us on a social media platform, such as LinkedIn, Instagram or X, that platform’s privacy policy governs your use of it. We may see information you make public or share with us there, and we handle it in line with this policy.
16. Changes to this policy
We may update this policy to reflect changes to our practices, the Resources we offer or the law. The “Last updated” date at the top of this page shows when it last changed. If we make significant changes, we will highlight them on the Website and, where appropriate, notify you directly.
17. Contact us
For any question about this policy or your personal data, or to exercise your rights, contact us by email at hello@vyncelleco.com, or by post to Vyncelle Creative Limited, Lagos, Nigeria.