Statutory Privacy Policy & Data Governance

1. Identity of the Data Controller

This Privacy Policy governs data processing activities conducted by Harmony Digital Consults Ltd ("Harmony", "we", "us", or "our"), a company duly incorporated under the laws of the Federal Republic of Nigeria with Corporate Affairs Commission Registration Number RC 8949899 (Incorporated October 25, 2025).

Registered Office Address: 13, Stadium Road, Ekwulobia, Aguata LGA, Anambra State, Nigeria.
Operating Hubs: Anambra State & Lagos State, Nigeria.
Official Website: harmonydigitalconsults.com.ng

2. Statutory Basis & Applicable Laws

Our data processing operations are governed strictly by the provisions of the Nigeria Data Protection Act (NDPA) 2023, the Nigeria Data Protection Regulation (NDPR), the Cybercrimes (Prohibition, Prevention, etc.) Act, and circulars issued by the Nigeria Data Protection Commission (NDPC).

Under Section 24 of the NDPA 2023, personal data shall be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes; collected adequately, relevantly, and limited to what is necessary; and stored for no longer than is necessary.

3. Categories of Personal Data We Process

We process personal data in the following distinct contexts:

• Institutional Inquiries & Consultations: When headteachers, school proprietors, or administrators submit consultation or device order forms, we collect: Full Name, Official Email Address, Phone/WhatsApp Number, Institution/School Name, and Project Specifications.
• Educator Tools & Diagnostics: When using the Broadsheet Validator, Lesson Note Generator, or JAPA Score tool, inputs (candidate marks, class schedules, exam scores) remain client-side in session storage or temporary browser memory.
• Technical & Telemetry Data (Consented): When analytical cookies are explicitly accepted, anonymous metrics (browser version, screen resolution, referrers, and page interaction times) are collected without linking to your individual identity.

4. Child & Student Data Safeguards (Section 31 NDPA)

We recognize that educational records frequently involve minors. In accordance with Section 31 of the Nigeria Data Protection Act 2023 regarding the processing of personal data of a child:

• We do not store, profile, track, or commercialize pupil personal identifiable information (PII).
• Client-side utilities (Broadsheet Validator, Report Card Comment Generator) execute locally in your computer's browser memory. When you close or refresh your browser tab, student assessment data is purged.
• HavonTrack institutional implementations are deployed under strict Data Processing Agreements (DPAs) directly with the licensed educational institution acting as the Primary Data Controller.

5. Purposes and Lawful Grounds for Processing

We process your data strictly under the following lawful bases recognized under Section 25 of the NDPA:

1. Consent: When you provide clear, affirmative consent (e.g. submitting an inquiry form with our NDPA checkmark or accepting optional analytics cookies).
2. Contractual Performance: When processing is necessary to provide school ERP architecture, deliver hardware procurement, or conduct an authorized NDPA compliance audit.
3. Legal Obligation: When required by Nigerian statutory authorities, tax regulations, or lawful directives of the NDPC.

6. Technical & Organizational Security Measures

To prevent unauthorized access, data breach, disclosure, or accidental destruction, Harmony Digital Consults enforces defense-in-depth security standards:

• Transport Encryption: All website traffic is encrypted using TLS 1.3 / HTTPS with Strict-Transport-Security (HSTS) headers and DNSSEC verification.
• Application Hardening: Implementation of strict Content Security Policies (CSP), Cross-Origin Isolation (COOP), anti-sniffing headers, and automated sliding-window rate limiting.
• Zero Ingestion of Sensitive Biometrics: Biometric templates from third-party attendance clocks are never stored on public web servers.
• Access Controls: Institutional administrative consoles require mandatory Multi-Factor Authentication (2FA) and Role-Based Access Controls (RBAC).

7. Data Retention & Automatic Erasure

We retain personal data only for as long as necessary to fulfill the specific purpose for which it was gathered:

• Contact & Proposal Inquiries: Retained for 180 days post-resolution, after which records are archived or securely scrubbed.
• Client Audit Documents: Stored securely during the contract engagement and for statutory audit periods required by Nigerian commercial law.
• Cookie Consent Preferences: Recorded for 365 days, after which re-consent is requested automatically.

8. Your Statutory Rights as a Data Subject

Under Part VI (Sections 34–39) of the Nigeria Data Protection Act 2023, you enjoy statutory rights regarding your personal data:

• Right of Access: You may request confirmation of whether we process your data and receive a readable copy.
• Right to Rectification: You may demand correction of inaccurate or incomplete records without undue delay.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal data where retention is no longer necessary.
• Right to Restrict or Object to Processing: You may object to data processing based on legitimate interests or direct communications.
• Right to Withdraw Consent: Where processing is predicated on consent, you can withdraw consent at any time without affecting previous lawful operations.

9. Third-Party Sub-processors & Hosting

We engage vetted cloud and communications providers adhering to international security standards (ISO 27001, SOC 2 Type II):

• Hosting & Compute: Google Cloud Platform (Europe/West Region) and Vercel Inc.
• Form Processing & Productivity: Google Workspace with enterprise security and 2FA authentication.
• Direct Messaging: Meta Platforms Ireland Ltd / WhatsApp Business API for direct user-initiated inquiries.
• Website Analytics: Google Analytics 4 (with Consent Mode v2) and Vercel Web Analytics. Analytics only runs after you accept non-essential cookies in the consent banner. If you decline, no analytics cookies or identifiers are stored; Google may still receive anonymous, cookieless measurement pings that cannot identify you. When you accept, we measure aggregate events such as pages viewed, clicks on our WhatsApp and Selar links, form submissions, and file downloads. We do not collect names, email addresses, phone numbers, or the contents of anything you type into forms through analytics. IP addresses are anonymized and advertising personalization is disabled. You can withdraw consent at any time via the Cookie Settings link in the footer. See our Cookie Policy and Google's Privacy Policy for details.

10. Data Protection Officer (DPO) & Contact Inquiries

To exercise any of your data rights, report a privacy concern, or request an institutional Data Processing Agreement (DPA), please reach our Data Governance Desk:

Document Revision: 2026.4 • Last Statutory Review: October 2026 • Formally ratified for NDPA 2023 compliance.