This Privacy Statement explains how Cufia Consulting ("Cufia", "we", "us" or "our") collects, uses, shares and protects personal data when you visit our website, contact us, book a consultation, subscribe to our insights or apply to join our team or Expert Council.
We respect your privacy and are committed to handling your personal data lawfully, fairly and transparently, in line with the Nigeria Data Protection Act 2023 and other data protection laws that apply to you, wherever you are.
1. Scope
This Privacy Statement applies to personal data we process through our website [www.cufia.com] and related communications, such as emails, consultation calls and event registrations. It does not cover personal data we process when delivering services under a client contract. That processing is governed by the relevant contract and data processing terms.
2. The personal data we collect
2.1 Information you give us
| When you… | We may collect |
|---|---|
| Contact us or submit an enquiry | Name, work email, phone number, organisation, job title, country, organisation type, the services you are interested in, your message and your preferred contact method |
| Book a consultation | Name, email, organisation, preferred date and time, and information you share about your goals |
| Request a training programme or brochure | Name, work email, organisation, programme of interest, audience type, number of participants and preferred format and dates |
| Subscribe to our insights | Email address and your marketing preferences |
| Apply to join our team or Expert Council | Name, contact details, LinkedIn profile, country, areas of expertise, years of experience, certifications, CV and any other information you choose to include |
| Contact us on WhatsApp, by email or by phone | Your phone number or email address, name and the content of your messages |
Please do not send us sensitive personal data (for example, information about health, religion, ethnicity or political opinions) through our website. If you do, we will process it only where the law allows and only for the purpose you shared it for.
2.2 Information we collect automatically
When you visit our website, we and our service providers may automatically collect:
- technical data, such as your IP address, browser type and version, device type, operating system, time zone and approximate location (country or city)
- usage data, such as pages visited, time spent on pages, links clicked, the website that referred you and actions you take on our site
- information collected through cookies and similar technologies, as described in our Cookie Policy
2.3 Information from other sources
We may receive limited information about you from publicly available professional sources (such as your organisation’s website or LinkedIn profile), from people who refer you to us, and from event organisers where you have agreed to share your details.
3. How we use your personal data and our legal bases
We only use your personal data where we have a lawful basis to do so. Depending on where you are, these legal bases come from the NDPA, the GDPR, POPIA or other applicable laws.
| Purpose | Legal basis |
|---|---|
| Responding to your enquiries and requests | Our legitimate interests in responding to people who contact us; or taking steps at your request before entering into a contract |
| Arranging and holding consultations, workshops and training | Taking steps at your request before entering into a contract; performance of a contract |
| Sending our newsletter, insights and event invitations | Your consent, which you can withdraw at any time |
| Assessing applications to join our team or Expert Council | Taking steps at your request before entering into a contract; our legitimate interests in recruiting suitable experts |
| Operating, securing and improving our website, including preventing spam and fraud | Our legitimate interests in running a secure, effective website |
| Analysing website use to improve our content and services (through non-essential cookies) | Your consent, given through our cookie banner |
| Measuring the effectiveness of our marketing (through marketing cookies) | Your consent, given through our cookie banner |
| Complying with legal and regulatory obligations, and establishing or defending legal claims | Legal obligation; our legitimate interests |
Where we rely on legitimate interests, we balance our interests against your rights and freedoms, and we do not use your data in ways you would not reasonably expect. You can ask us for more information about this balancing.
We do not use your personal data to make decisions based solely on automated processing that produce legal or similarly significant effects on you.
4. Marketing communications
We will only send you marketing emails, such as our newsletter or event invitations, if you have opted in. Every marketing email includes an unsubscribe link. You can also opt out at any time by emailing hello@cufia.com. Opting out of marketing will not affect messages we need to send you about an enquiry or service you have requested.
5. Who we share your personal data with
We do not sell your personal data. We share it only when necessary, and only with:
- Service providers who help us run our business and website, such as website hosting, customer relationship management (CRM), email delivery, appointment scheduling, video conferencing, analytics, spam protection and IT support. They may only use your data to provide services to us, under contracts that require them to protect it.
- Members of our Expert Council, consultants and operations team who need the information to respond to your enquiry or deliver work you have requested, under confidentiality obligations.
- Professional advisers, such as lawyers, auditors and insurers, where necessary.
- Regulators, law enforcement agencies, courts and other public authorities, where we are required or permitted by law to do so.
6. International transfers
We are based in Nigeria and serve clients in Africa and around the world. Some of our service providers store or process data in other countries, including the European Union, the United Kingdom and the United States. This means your personal data may be transferred to, and processed in, countries outside your own.
When we transfer personal data across borders, we take steps to protect it, as required by the NDPA and other applicable laws. Depending on the transfer, these include:
- transferring data to countries recognised as providing an adequate level of protection
- using contractual safeguards, such as standard contractual clauses or binding data processing terms
- relying on your consent or on another lawful basis permitted by the law that applies to you, where appropriate
You can contact us for more information about the safeguards that apply to your data.
7. How long we keep your personal data
We keep personal data only for as long as we need it for the purposes described in this Privacy Statement, including to meet legal, accounting or reporting requirements.
| Type of data | Typical retention period |
|---|---|
| Enquiries and consultation requests that do not lead to an engagement | Up to 24 months after our last contact |
| Information relating to clients and engagements | For the duration of the relationship and up to [6 years] afterwards, for legal and tax purposes |
| Newsletter subscriptions | Until you unsubscribe; we then keep your email on a suppression list so we do not contact you again |
| Applications to join our team or Expert Council | Up to 12 months after the application is closed, unless you agree to us keeping it longer |
| Website analytics data | Up to 16 months, depending on our analytics settings |
When we no longer need your data, we securely delete or anonymise it.
8. How we protect your personal data
We use appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse or alteration. These include encryption in transit, access controls, secure service providers and staff confidentiality obligations. No method of transmission over the internet is completely secure, but we work to protect your data and review our safeguards regularly.
If a personal data breach occurs that is likely to put your rights and freedoms at risk, we will notify the relevant regulator, such as the Nigeria Data Protection Commission within 72 hours where required, and inform you where the law requires us to do so.
9. Your rights
Depending on where you live and the laws that apply to you, you may have the right to:
- be informed about how we use your personal data
- access the personal data we hold about you and receive a copy
- correct personal data that is inaccurate or incomplete
- delete your personal data in certain circumstances
- restrict how we use your personal data in certain circumstances
- object to our processing, including processing based on legitimate interests and processing for direct marketing
- data portability: receive your data in a structured, commonly used format, or have it sent to another organisation
- withdraw consent at any time, where we rely on your consent; this does not affect processing that took place before you withdrew it
- not be subject to decisions based solely on automated processing that significantly affect you
- complain to a data protection regulator
To exercise any of these rights, email hello@cufia.com. We may need to confirm your identity before acting on your request. We will respond within the time required by applicable law, normally within one month. We do not charge a fee unless a request is clearly unfounded or excessive.
10. Additional information for specific regions
Nigeria
We process personal data in line with the Nigeria Data Protection Act 2023 and the NDP Act General Application and Implementation Directive 2025. You have the rights described in section 9. You may raise a concern with us directly and, if you are not satisfied, lodge a complaint with the Nigeria Data Protection Commission (NDPC).
European Union, European Economic Area and United Kingdom
Where the GDPR or UK GDPR applies, Cufia is the data controller and our legal bases are as set out in section 3. You may lodge a complaint with the data protection authority in the country where you live or work, or, in the UK, with the Information Commissioner’s Office (ICO).
South Africa
Where POPIA applies, you have the right to access and correct your personal information, to object to processing, and to complain to the Information Regulator (South Africa).
Kenya
Where Kenya’s Data Protection Act 2019 applies, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC).
Ghana and other countries
Where Ghana’s Data Protection Act 2012 or another country’s data protection law applies, you have the rights that law gives you, and you may complain to the relevant national data protection authority. We will help you exercise your rights wherever you are located.
11. Children
Our website and services are intended for businesses, public institutions and professionals. They are not directed at children (persons under 18 in Nigeria, or the age defined by the law that applies to you), and we do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact us and we will delete it.
12. Links to other websites
Our website may link to other websites, such as sources cited in our insights and case studies, or our social media pages. We are not responsible for the privacy practices of those websites. Please read their privacy notices before sharing personal data with them.
13. Changes to this Privacy Statement
We may update this Privacy Statement from time to time. The latest version will always be on this page, with the "Last updated" date at the top. If we make significant changes, we will take reasonable steps to tell you, for example by a notice on our website.
14. Contact us
If you have any questions, requests or concerns about this Privacy Statement or how we handle your personal data, please contact our Data Protection Officer through Email: hello@cufia.com