Privacy Policy

1. Introduction

Sycher Consulting Limited (“Sycher”, “we”, “us” or “our”) respects your privacy and is committed to protecting the personal data of individuals who visit our website, contact us, request information about our services or otherwise interact with us through the website at https://sycher.ng.

This Privacy Policy explains how we collect, use, disclose, store and protect personal data obtained through our website, the purposes for which we process it, the legal bases for such processing and the rights available to you under applicable data protection laws.

We process personal data in accordance with the Nigeria Data Protection Act 2023 (“NDPA”), the General Application and Implementation Directive 2025 (“GAID”), and other applicable data protection laws, where relevant.

This Policy applies to personal data processed in connection with the operation and use of our website. It does not automatically govern personal data processed in the course of a separate client engagement, employment relationship or other business activity, which may be subject to additional privacy notices or contractual arrangements.

2. Who We Are

Sycher Consulting Limited operates the Sycher website and acts as the data controller for personal data processed through the website where it determines the purposes and means of processing.

As data controller, Sycher determines why and how personal data within the scope of this Policy is processed and is responsible for ensuring that such processing complies with applicable data protection requirements.

For questions about this Policy or the processing of your personal data, please contact us through the contact channels published on our website’s Contact page.

3. Personal Data We Collect

The personal data we collect depends on how you interact with our website and the information you choose to provide.

3.1 Information You Provide Directly

When you contact us, request information, enquire about our services or seek to arrange a consultation, we may collect:

• Identity information: your name and, where relevant, your professional title.
• Contact information: your email address, telephone number and other contact details you choose to provide.
• Professional information: your organisation, job title, business address and other professional details relevant to your enquiry.
• Enquiry information: the content of your message, the services you are interested in and any other information you voluntarily include in your communication.
• Consultation information: details reasonably necessary to respond to or arrange a consultation, where applicable.
• Communication records: correspondence and relevant records of our interactions with you.

Please provide only information relevant to your enquiry. Do not submit sensitive personal data, confidential client information or other restricted information through general website enquiries unless it is necessary and we have established an appropriate and secure means of receiving it.

3.2 Cookies and Similar Technologies

Sycher does not currently use cookies or similar tracking technologies on its website to track visitors or monitor their browsing activities.

Although we do not actively collect or track visitor activity through the website, limited technical information may be processed by our website hosting infrastructure to deliver, maintain and secure the website.

If we introduce cookies or similar tracking technologies in the future, we will update this Privacy Policy as appropriate and implement any consent controls required by applicable law.

3.3 Website Hosting and Technical Information

Our website is hosted on Vercel, while our domain is managed through GO54.

Our hosting provider may process limited technical information associated with requests made to the website, such as IP addresses, timestamps and browser information, where necessary to deliver website content, maintain service availability and protect against security threats.

Any processing of personal data through these services will be managed in accordance with applicable data protection laws and the relevant providers’ privacy practices and contractual arrangements.

4. Purposes and Lawful Bases of Processing

We process personal data only where an appropriate lawful basis applies under the NDPA or other applicable law.

Depending on the circumstances, our purposes and lawful bases may include the following:

We will not rely on consent where another lawful basis is more appropriate. Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Where we rely on legitimate interests, those interests will be assessed against the rights and freedoms of affected individuals.

If you do not provide information that is necessary to respond to an enquiry or arrange a requested consultation, we may be unable to provide the relevant response or service.

5. How We Use Personal Data

Subject to the purposes and lawful bases described above, we may use personal data to:

• respond to questions, enquiries and requests for information;
• communicate with individuals interested in our services;
• arrange consultations and discuss potential engagements;
• maintain relevant correspondence and business records;
• operate, maintain and secure our website;
• investigate technical issues, suspicious activity and potential misuse;
• meet legal and regulatory obligations; and
• send relevant business updates or promotional communications where permitted by law.

We will not use personal data for a materially different or incompatible purpose without an appropriate lawful basis and any additional notice or consent required by law.

6. Disclosure and Sharing of Personal Data

We do not disclose personal data indiscriminately. Depending on the website services actually deployed and the circumstances of your interaction with us, personal data may be shared with the following categories of recipients:

6.1 Service Providers

We may engage service providers that support website hosting, website maintenance, email and communications, cybersecurity, technical support or other necessary business functions.

Where these providers process personal data on our behalf, we will take appropriate steps to ensure that their processing is governed by suitable contractual and security arrangements, as required by applicable law.

6.2 Professional Advisers

We may disclose relevant personal data to our professional advisers where reasonably necessary for legal, compliance, security or other legitimate business purposes.

6.3 Regulators and Public Authorities

We may disclose personal data where required by law, a valid legal process or a lawful request from a competent regulatory or public authority.

6.4 Business Transactions

Where relevant, personal data may be disclosed in connection with a proposed or actual business restructuring, merger, acquisition or transfer of business, subject to applicable confidentiality and data protection requirements.

We do not treat the provision of personal data as permission to sell it to third parties. Any disclosure must be supported by an appropriate purpose and lawful basis.

The identity of the specific service providers receiving website data depends on the website's actual technical configuration. We will provide further information where required by applicable law.

7. International Transfers of Personal Data

Some service providers may store or access personal data from outside Nigeria. Whether this occurs depends on the providers and technologies used to operate the website.

Where personal data is transferred outside Nigeria, we will assess the transfer against the requirements of the NDPA and other applicable law and implement the appropriate transfer mechanism, safeguards and other measures where required.

Where applicable, relevant information about international transfers and safeguards may be obtained by contacting us through the contact channels published on our website.

8. Retention of Personal Data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, comply with applicable legal and regulatory obligations, resolve disputes and establish, exercise or defend legal claims. Subject to applicable law and the circumstances described below, we apply the following retention periods:

• General enquiries: Personal data relating to enquiries that do not result in an engagement will generally be retained for 12 months after the enquiry is closed or the last substantive communication, whichever is later.
• Consultation requests: Personal data relating to consultation requests that do not result in an engagement will generally be retained for 12 months after the request is closed or the last substantive communication.
• Prospective client records: Where substantive discussions concerning a potential engagement are ongoing, relevant records may be retained for up to 24 months after the last substantive interaction, unless the discussions remain active or a longer period is justified by an applicable legal obligation or legitimate business need.
• Client engagement records: Where website enquiries develop into client engagements, relevant records that form part of the client relationship or engagement file will be retained for six years after the engagement ends, subject to applicable statutory, regulatory, contractual and professional recordkeeping requirements.
• Website Server and Access Logs: Technical and access logs may be processed by our website hosting provider for purposes including website operation, maintenance, troubleshooting and security. These logs will be retained in accordance with the hosting provider’s applicable retention practices and any relevant contractual arrangements. Where Sycher retains logs relating to a suspected or confirmed security incident, they will be kept only for as long as reasonably necessary to investigate and resolve the incident, meet applicable legal or regulatory requirements, or establish, exercise or defend legal claims.
• Privacy requests and complaints: Records relating to data subject requests and privacy complaints will generally be retained for three years after the request or complaint is closed, subject to any longer period required for an ongoing dispute, investigation or legal obligation.
• Marketing records: Where we lawfully send marketing communications, relevant contact and preference records will be retained until consent is withdrawn or an objection is received, where applicable, or until 24 months of inactivity have elapsed, subject to applicable legal requirements. Where necessary, limited suppression records may be retained to ensure that marketing preferences and objections continue to be respected.
• System backups: Routine backups containing personal data will generally be retained for 35 days before being overwritten or securely deleted in accordance with our backup procedures, except where a backup must be preserved for a documented security, legal or regulatory reason.
• Legal holds and regulatory matters: Personal data relevant to an active legal claim, regulatory investigation, audit or other legal hold may be retained until the matter is finally resolved and any applicable statutory or regulatory retention period has expired.

These periods are our standard retention targets and may be adjusted where required by applicable law or where a documented, lawful and proportionate reason justifies a different period.

When personal data is no longer required, we will securely delete it, destroy it or anonymise it, as appropriate. Where data remains in routine backups, it will be handled in accordance with our backup-retention procedures and will not be restored or otherwise used except where necessary for legitimate operational, security or legal purposes.

9. Data Security

We take appropriate technical and organisational measures designed to protect personal data against unauthorised access, unlawful processing, accidental loss, destruction, alteration or disclosure.

Depending on the processing activity and associated risks, these measures may include access restrictions, secure transmission, appropriate authentication, system maintenance, security monitoring, backup controls and procedures for managing security incidents.

Access to personal data should be limited to individuals and service providers who require it for authorised purposes.

Although we take reasonable steps to protect personal data, no website or electronic transmission can be guaranteed to be completely secure.

If a personal data breach occurs, we will assess and manage the incident in accordance with applicable legal requirements, including any applicable notification obligations.

10. Emerging Technologies

Sycher is committed to ensuring that its use of emerging technologies, including Artificial Intelligence (AI), is ethical, lawful, transparent and secure, in accordance with applicable data protection laws.

Where AI is used to support the delivery of our services or improve our website and business operations, we will take reasonable steps to ensure that any personal data processed is limited to what is necessary for the relevant purpose.

Sycher will implement appropriate technical and organisational measures to protect personal data when using AI and other emerging technologies. Where appropriate, these measures may include transparency notices, human oversight, access controls and risk assessments.

Where AI is used to make or support decisions that may significantly affect individuals, Sycher will take appropriate steps to provide relevant information and safeguards in accordance with applicable law. Where individuals have applicable rights to object to, or opt out of, particular processing activities, Sycher will respect those rights.

11. Personal Data Breach

At Sycher, we take the security of personal data seriously and implement appropriate technical and organisational measures to protect personal data against unauthorised access, unlawful processing, accidental loss, destruction, alteration or disclosure.

Despite these measures, personal data breaches may occur. Sycher maintains procedures for identifying, reporting, assessing, managing and documenting personal data breaches, including incidents involving the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

If you become aware of a suspected or actual personal data breach involving personal data provided to Sycher through our website or in connection with our services, or believe that your personal data has been accessed or disclosed without authorisation, please contact us through the contact details provided on our website. This will enable us to investigate the incident and take appropriate steps to protect the affected personal data.

Where a personal data breach occurs, Sycher will assess its nature, scope, likely consequences and potential impact on the rights and freedoms of affected individuals. We will take appropriate measures to contain the breach, mitigate its effects, prevent recurrence and comply with applicable legal and regulatory obligations.

Where notification is required by applicable data protection law, Sycher will notify the NDPC within the required 72 hours and affected individuals in accordance with the applicable requirements and timelines. A notification to affected individuals may include:

• A description of the nature of the personal data breach and, where practicable, the categories of personal data and individuals affected.
• The likely consequences of the breach.
• The measures taken or proposed to address the breach and mitigate its potential adverse effects.
• Any steps affected individuals may take to protect themselves.
• The appropriate contact channel for obtaining further information about the incident.

Where a personal data breach is likely to result in a risk to the rights and freedoms of individuals, Sycher will notify the NDPC within the timeframe prescribed by applicable law. Where the breach is likely to result in a high risk to the rights and freedoms of affected individuals, we will also communicate the breach to those individuals as required by law, subject to any applicable legal exceptions.

Sycher will document personal data breaches, including relevant facts, their effects and the remedial measures taken, and will provide records to the relevant regulatory authority where required.

We encourage individuals who interact with us to exercise reasonable care when sharing personal data, promptly report suspected unauthorised access or disclosure, and avoid sending confidential or sensitive information through unsecured communication channels.

12. Your Data Protection Rights

Subject to the NDPA and any applicable legal limitations, you may have the right to:

• Be informed: receive clear information about how your personal data is processed.
• Access: request confirmation of whether we process your personal data and obtain access to that data, subject to applicable restrictions.
• Rectification: request correction of inaccurate or incomplete personal data.
• Erasure: request deletion of your personal data where the applicable legal conditions are satisfied.
• Restriction: request restriction of processing in circumstances recognised by law.
• Object: object to processing where the applicable legal conditions are met, including processing based on legitimate interests and processing for direct marketing.
• Data portability: receive certain personal data in a structured, commonly used and machine-readable format and, where legally applicable, request its transfer to another controller.
• Withdraw consent: withdraw consent where processing is based on consent.
• Rights relating to automated decision-making: exercise applicable rights where decisions are made solely by automated means and produce legal or similarly significant effects.
• Lodge a complaint: submit a complaint to the Nigeria Data Protection Commission where you believe your personal data has been processed in violation of applicable data protection law.

These rights are not absolute in every circumstance. We may need to verify your identity, consider the rights of other individuals and apply any relevant legal exemptions before responding.

13. How to Exercise Your Rights or Make a Complaint

You may submit a privacy request or complaint through the contact channels published on our website's Contact page.

Please describe your request clearly and provide sufficient information to enable us to identify the relevant interaction or personal data. We may request proportionate additional information to verify your identity where reasonably necessary to protect your information from unauthorised disclosure.

We will handle your request in accordance with the applicable legal requirements and timelines. If we cannot comply with a request, in whole or in part, we will explain the applicable reason where required by law.

You may also lodge a complaint with the Nigeria Data Protection Commission through its official website at https://ndpc.gov.ng.

14. Third-Party Websites and Services

Our website may contain links to external websites or use third-party services. Those websites and services may operate under their own privacy policies and terms.

We are not responsible for the privacy practices of independent third-party websites that we do not control. We encourage you to review their privacy information before providing personal data to them.

Where we integrate a third-party service into our website, we will assess the relevant data processing and provide additional information where required.

15. Children's Personal Data

Our website is intended primarily for individuals seeking information about our professional and business services.

We do not intentionally request children's personal data through general website enquiries unless there is a legitimate reason and an appropriate lawful basis and safeguards for doing so.

Where we become aware that personal data has been collected in circumstances that are inconsistent with applicable legal requirements relating to children, we will assess the situation and take appropriate corrective action.

16. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our website, the personal data we process, our service providers, our business practices or applicable legal requirements.

Where a change materially affects how we process personal data, we will take appropriate steps to communicate the change or provide additional information where required by law.

The latest version of this Policy will be published on our website with its effective date and last-reviewed date.

17. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data protection rights or have concerns about how your personal data is handled, please contact Sycher through the contact channels published on the Contact page of our website.