Ozah Digital Limited · RC 9805988 · policy@ozahdigital.com
Privacy notice
Last updated: 2 September 2026
This notice explains how Ozah Digital Limited handles personal data when people worldwide visit our site, request a report, contact us or become customers. Our primary law is the Nigeria Data Protection Act 2023 and its current regulatory guidance. Additional rights and duties can apply based on where a visitor is located, including the GDPR, UK GDPR and applicable United States state privacy laws.
Who controls your data
Ozah Digital Limited is the data controller for the processing described here. We operate from Asaba, Delta State, Nigeria, and make this website available internationally.
Send privacy questions or rights requests to policy@ozahdigital.com. The Privacy Lead handles these requests and records the response.
What we collect
When you visit the public website
Our hosting and security systems process network address, browser and device information, requested page, referral data, request identifiers, security events and approximate location needed to deliver and protect the service. If you allow optional analytics, Google Analytics also processes pseudonymous identifiers and page interactions described in our cookie notice.
When you request a Digital Health Check
You may provide:
- Your name, business name, industry and location
- Your email address and, when supplied, your phone number
- Your website address or confirmation that the business has no website
- Your contact and channel preferences
We inspect public business information needed to prepare the report. Depending on what is available, this can include public website pages and metadata, contact details, DNS and email-domain configuration, HTTPS availability, performance and accessibility signals, technology signals, public social profiles, and Google Business Profile or Places details. We may keep the evidence, source URL and observation time needed to support a finding.
We do not sign in to private areas, bypass access controls, or collect private inbox or payment-card contents for a Health Check. Signals that cannot be verified are marked as not checked. We also record request metadata and a protected network-address fingerprint for security, fraud prevention and rate limiting.
When we discover a public business profile
Our staff can research business information that the business has made public, including its name, category, public telephone number, website, public email address, location, ratings and profile status. We use it to avoid duplicates, assess whether our services are relevant and prepare an evidenced, human-reviewed introduction. A public listing does not remove channel rules or a person's right to object. Suppression and opt-out records are checked before outbound activity.
When you become a customer
We collect the business, contact, delivery, contract, support and billing information needed to provide the service. Payment providers process card or bank details under their own controls. We receive transaction references, status and reconciliation records, not full card numbers.
Why we process it
| Purpose | Lawful basis |
|---|---|
| Measure public-site use through optional Google Analytics | Consent |
| Run a requested Health Check and deliver its report | Consent and steps you ask us to take before a service agreement |
| Send a message through an optional channel you selected | Consent, plus the rules of that channel |
| Research public business information and assess service relevance | Legitimate interests, after necessity and rights checks |
| Prevent abuse, secure accounts and keep an audit trail | Legitimate interests and applicable legal obligations |
| Deliver and bill a paid service | Contract and legal obligations |
How long we keep it
- Private Health Check report links expire after 30 days.
- Prospect and contact records are reviewed under the workspace retention settings and are deleted, anonymised or suppressed when no longer needed.
- Security and rate-limit evidence is retained only for its stated protection period.
- Contracts, invoices, payment evidence and tax records are kept for the period required by Nigerian law and legitimate dispute needs.
A suppression record can be retained after an opt-out so that we do not contact the person again. It is used only for that purpose.
Providers and international transfers
We do not sell or rent personal data. Carefully selected providers may process only the data needed to deliver hosting, communications, analytics, payments and requested digital services. Our processing-partner notice explains these categories. Where data leaves Nigeria, we assess the transfer and use safeguards required by the NDPA and, where applicable, recognised contractual or other safeguards under the GDPR, UK GDPR or local law. You can ask for information about a relevant transfer using the privacy contact above.
Analytics and cookies
Essential site functions can operate without optional consent. Google Analytics remains unloaded until a visitor allows analytics or advertising. The banner offers reject, accept and category choices, honours Global Privacy Control for advertising, and remains available through a Cookie settings button. See the cookie notice for more information.
Sale, sharing and targeted advertising
We do not sell or rent personal data. We do not currently load a separate advertising tag or use public-site data for cross-context behavioural advertising. If that practice changes, we will update this notice and provide any additional opt-out required by applicable law. A browser Global Privacy Control signal is treated as a denial of advertising storage.
Your rights
You can ask us to:
- Confirm whether we hold personal data about you and provide access to it
- Correct inaccurate or incomplete data
- Delete data where no lawful reason requires continued retention
- Restrict or object to processing, including direct marketing
- Withdraw consent without affecting earlier lawful processing
- Provide eligible data in a portable form
We acknowledge and track requests, verify identity proportionately, and aim to complete them within 30 days. A legal or security obligation can require us to retain a limited record. If so, we will explain what is retained and why.
If you are not satisfied, you may complain to the Nigeria Data Protection Commission.
European Economic Area and United Kingdom
Where the GDPR or UK GDPR applies, you can also object to processing based on legitimate interests, ask us to limit processing, and complain to the supervisory authority in your country. If we rely on consent, you can withdraw it at any time. We respond within the legally required period and explain any permitted extension.
California and other United States locations
Where an applicable state law covers our processing, you may have rights to know or access, correct, delete and obtain a portable copy of personal information, and to opt out of sale, sharing or targeted advertising. We will not discriminate against you for exercising a privacy right. We may need to verify your identity and an authorised agent's authority. Because thresholds and exemptions differ, a particular state right applies only when that law covers Ozah Digital Limited and the processing concerned.
Children
Our business services are not directed to children, and we do not knowingly collect personal data from children through the public site. If you believe a child has provided data, contact us so we can investigate and delete it where required.
How we protect data
We use proportionate technical and organisational safeguards, including access controls, encryption where appropriate, activity monitoring and incident-response procedures. No control can eliminate all risk, so safeguards are reviewed as our services and risks change.
Changes to this notice
We review this notice on the schedule shown above and sooner when processing or law changes. The updated date records the latest review. Material changes affecting an existing consent or agreement are communicated where required.