PRIVACY POLICY

Please read this Privacy Notice before you may become a business or personal user of The Nigerian Exchange Group (“NGX GROUP”) and its Subsidiaries’ Digital Gateway Platform (hereinafter referred to as “the Platform”).

INTRODUCTION

This Privacy Notice sets out how NGX GROUP and/or its Subsidiaries collect, use, store, share and protect any information that you give NGX GROUP/its Subsidiaries when you subscribe to this Platform. It applies to this Platform and all its applications, services, tools and contents regardless of how you access or use them.

NGX GROUP and its Subsidiaries are committed to ensuring that your privacy is protected. Should we ask you to provide certain information by which you can be identified when using this Platform, you can be assured that it will only be used in accordance with this Privacy Notice.

CONSENT

You accept this Privacy Notice when you sign up for access or use the products, services, content, features, technologies or functions offered on this Platform and all related sites, applications, and services.

LEGAL BASIS

You further accept that NGX GROUP and its Subsidiaries may process your Personal Information without explicit consent sought, given or accepted where (i) it is necessary for entering into or performance of a contract;

(ii) it is authorized or required by law (which also provides safeguards for You); or (iii) there are circumstances that may engender direct or indirect propagation of atrocities, hate, child rights violation, criminal acts and anti-social conducts.

COLLECTION OF INFORMATION

Personal Information We Collect Directly from You

NGX GROUP and/or its Subsidiaries collect Personal Information from when you register, create or update a profile, apply for an employment opportunity, join the talent pool, communicate with us or otherwise use X-Hire.. When we do, we may collect the following information from you during the entire recruitment process:

1. Full Name;
2. Email Address;
3. Phone Number;
4. Gender;
5. House Address;
6. Username and password that you

The information required may vary depending on the particular feature or recruitment activity.

Where you apply for a specific position or participate in a recruitment process, we may request additional information reasonably necessary for the relevant recruitment activity. Such information may include, where applicable:

1. employment history and professional experience;
2. educational and professional qualifications;

iii. skills, competencies and areas of expertise;

1. information contained in your curriculum vitae/resumé or application;
2. references or referee information;
3. information provided during interviews, assessments or other recruitment stages; and

vii. other information reasonably necessary to assess your suitability for an employment opportunity.

You should only provide Personal Data that is relevant and reasonably necessary for the relevant recruitment or talent-pool purpose.

Talent Pool

X-Hire may provide applicants and prospective candidates with the opportunity to join the NGX Group Talent Pool.

Where you voluntarily join the Talent Pool, your Personal Data and professional profile may be retained and reviewed for the purpose of identifying and considering you for current or future employment opportunities that may be relevant to your qualifications, experience, skills and professional interests.

Joining the Talent Pool does not guarantee employment, an interview or selection for any position.

Where additional information is requested to facilitate your consideration for a specific opportunity, you will be informed of the relevant processing purpose where required.

You may request to withdraw from the Talent Pool or exercise your applicable Data Subject rights by contacting us using the contact details provided in this Privacy Policy.

Personal Information We Collect Automatically

NGX Group and/or its Subsidiaries may use cookies and other appropriate technologies to collect certain technical information automatically when you access or use X-Hire.

This may include:

1. IP address;
2. device type and identifier;

iii. browser type;

1. operating system;
2. date and time of access;
3. pages, features and content accessed;

vii. session and login information;

viii. network information;

1. referral information;
2. usage and activity logs; and
3. other technical information necessary for the operation, security and administration of the Platform.

We may combine automatically collected information with other Personal Data where reasonably necessary for legitimate and specified purposes.

Personal Information We Collect from Third Parties

We also collect information about you from third-party sources such as identity verification services in accordance with the provisions of a written contract between NGX GROUP/its Subsidiaries and the third party. The categories of information that we collect about you from other sources include:

1. referees and previous employers;
2. educational and professional qualification verification bodies;

• background screening and verification service providers;

1. assessment providers; and
2. other authorised sources relevant to the recruitment process.

Where Personal Data is obtained from a third party, we will take reasonable steps to ensure that the collection and subsequent processing are lawful and consistent with applicable data protection requirements.

Please note that we may be required by law to collect and use certain Personal Information about you. We may need to collect and use Personal Information to enter into or fulfil a contract with you. Failure to provide this information may prevent or delay the fulfilment of our obligations in these circumstances.

How NGX GROUP and its Subsidiaries uses Information it collects

We may process your Personal Data for the following purposes:

1. To create and administer your X-Hire account and candidate profile;
2. To authenticate your identity and facilitate secure access to the Platform;
3. To receive, process and manage employment applications;
4. To assess candidates against the requirements of available employment opportunities;
5. To facilitate recruitment activities, including interviews, assessments, screening and selection;
6. To communicate with you regarding applications, interviews, assessments, recruitment processes and employment opportunities;
7. To maintain and manage the NGX Group Talent Pool;
8. To identify and consider suitable candidates for current or future employment opportunities;
9. To allow candidates to present their skills, experience, qualifications and professional profiles to NGX Group and/or its Subsidiaries;
10. To facilitate communication between candidates and authorised recruitment personnel;
11. To conduct background, employment, reference, identity, qualification or other verification checks where applicable and permitted by law;
12. To improve and streamline recruitment processes and reduce manual and administrative recruitment activities;
13. To generate internal recruitment reports, analytics and management information;
14. To comply with applicable legal, regulatory, governance and reporting obligations;
15. To protect the rights, property, security and legitimate interests of NGX Group, its Subsidiaries, candidates and other persons; and
16. For other purposes that are compatible with the purposes for which the Personal Data was collected or otherwise permitted by applicable law.

NGX GROUP /its Subsidiaries may assign its obligations and rights under this Policy to an Affiliate or a successor entity, and your Personal Information as well as the use and processing of such Personal Information may be among the assets transferred by NGX GROUP/its Subsidiaries. You acknowledge and consent that such transfers may occur and are permitted by this Privacy Policy.

 

AUTOMATED PROCESSING AND PROFILING

NGX Group and/or its Subsidiaries may use automated processing, algorithms or profiling in connection with X-Hire where necessary and permitted by applicable law.

Such processing may include activities designed to assist with:

1. organising candidate information;
2. identifying candidates whose profiles may be relevant to particular vacancies;

iii. improving recruitment processes;

1. analysing recruitment trends and Platform usage; and
2. improving the services and functionality of X-Hire.

Where applicable law requires specific safeguards in relation to automated decision-making or profiling, NGX Group and/or its Subsidiaries will implement such safeguards.

Where a decision is based solely on automated processing and produces legal or similarly significant effects on you, we will comply with applicable legal requirements concerning such processing, including applicable rights to information, review or objection.

Upon request and where required by applicable law, we may provide meaningful information concerning the logic involved in relevant automated processing, the significance of the processing and its envisaged consequences.

SECURITY AND PROTECTION

Personal Information collected will be held securely and will only be kept for as long as is reasonably necessary in the circumstances you are registered or, to use the Platform or as required by law (if applicable) or for as long as you use the service or product that you are subscribed to, unless you have provided us with your consent to use the data for any additional purposes. We take the security of the Platform and the information you provide very seriously, and we will take all appropriate technical, administrative and physical safeguards/measures using recognized security procedures and tools in accordance with good industry practice to protect your Personal Information. We have reasonable security measures in place to protect against the loss, misuse and interception by third parties of the information under our control, but, to the extent allowed by law, NGX GROUP/its Subsidiaries assume no liability for any damages you may suffer as a result of interception, alteration or misuse of information transmitted over the Internet. Whilst we use all reasonable endeavors to protect your security in the manner described above, we consider that it is only appropriate to advise users that data transmission over the Internet and the World Wide Web cannot be guaranteed as 100% secure, and therefore that you use the Platform at your own risk.

What are Your Rights in relation to our Collection and Processing of your Personal Data

Users of our Site are entitled to exercise the following rights in relation to their personal data collected and processed by NGX GROUP:

1. right to withdraw consent in relation to the processing of their personal data;
2. right to be informed regarding their personal data;
3. right to request and access any personal data collected and stored by NGX GROUP;
4. right to request the deletion of their data;
5. right to be informed about appropriate safeguards in place where data is transferred abroad;
6. right to request rectification of personal data which is stored by NGX GROUP;
7. right to request the transmission of data from NGX GROUP to a third party (right to the portability of data);
8. right to object to automated decision making and processing;
9. right to object to direct marketing;
10. right to request the processing of their information; and
11. right to lodge a complaint with the

NGX GROUP/ITS SUBSIDIARIES’ OBLIGATIONS TO RETAIN YOUR PERSONAL INFORMATION AND YOUR ACCESS TO AND CONTROL OF SUCH PERSONAL INFORMATION

NGX GROUP/its Subsidiaries keep your Personal Information in line with set periods calculated using the following applicable criteria:

1. The recruitment process for which the Personal Data was collected;
2. Whether you remain an active candidate or member of the Talent Pool;
3. Whether the Personal Data is required for a current or potential future employment opportunity;
4. The nature of the employment or recruitment relationship;
5. Legal, regulatory, audit, governance or reporting requirements;
6. Applicable limitation periods for legal claims;
7. Any relevant proceedings or investigations;
8. The terms of any consent provided by you; and
9. Legitimate business and operational requirements.

The retention period is to enable NGX GROUP/its Subsidiaries to use the personal data for the necessary purposes identified in full compliance with the legal and regulatory requirements. When NGX GROUP/its Subsidiaries no longer need to use your personal information, we will delete it from our systems and records, and/or take steps to anonymize the said personal information so that you cannot be identified or linked to the said personal information.

 

Access to and Control over Information

In respect of your Personal Information with us, you can do at any time the following by contacting us:

• Change/correct any Personal Information we have about you after providing the required documentation and if it is within your purview to change/correct.
• If allowable, and subject to points 1-9 above, have us delete any Personal Information we have about you.
• Request for contact details of the data protection officer, where
• If allowable, request for the purpose of the processing as well as the legal basis for
• If allowable, request for the categories of personal data collected, stored and
• If allowable, request for recipient(s) or categories of recipients that the data is/will be disclosed
• Request for the duration of data
• Request for details and information of automated decision making, such as profiling, and any meaningful information about the logic involved, as well as the significance and expected consequences of such processing and express any concern about our use of your Personal

INTERNATIONAL AND CROSS-BORDER TRANSFERS OF PERSONAL DATA

In the course of providing our services and carrying out our recruitment, technological and operational activities, we may transfer, store, permit access to or otherwise process your Personal Data outside the Federal Republic of Nigeria. Such transfers may arise, for example, where we engage or interact with technology and cloud infrastructure providers, financial institutions, assessment providers, identity verification providers, professional advisers, and other authorised service providers or recipients located outside Nigeria.

We recognise that the transfer of Personal Data outside Nigeria is subject to specific legal and regulatory requirements. Accordingly, we will only transfer Personal Data outside Nigeria in accordance with the Nigeria Data Protection Act 2023 (“NDP Act”), the Nigeria Data Protection Act – General Application and Implementation Directive 2025 (“GAID”), applicable directives and guidance issued by the Nigeria Data Protection Commission (“NDPC” or the “Commission”), and other applicable laws.

Lawful Basis for Cross-Border Transfers

Before transferring Personal Data outside Nigeria, we will establish and document an appropriate basis for the transfer and take reasonable steps to ensure that the transfer complies with applicable data protection requirements.

In accordance with the NDP Act and GAID, we may undertake a cross-border transfer where one or more of the following applies:

1. Adequacy Decision - The Commission has determined that the country, territory, sector or other relevant jurisdiction to which the Personal Data is to be transferred affords an adequate level of protection in accordance with the NDP Act.
2. Approved Cross-Border Data Transfer Instrument - In the absence of an applicable adequacy decision, the transfer is made pursuant to a Cross-Border Data Transfer Instrument (“CBDTI”) approved by the Commission, where required. Such an instrument may include, as applicable, approved:
3. codes of conduct;
4. certification mechanisms;

• binding corporate rules; or

1. standard contractual clauses,

or such other transfer instruments as may be recognised or approved by the Commission from time to time.

Where approval of a CBDTI by the Commission is required, we will obtain the requisite approval before relying on that instrument as the basis for the relevant transfer.

1. Other Lawful Grounds - Where there is no applicable adequacy decision or approved CBDTI, Personal Data may be transferred outside Nigeria where the transfer is permitted under the NDP Act, GAID or other applicable law, including where:
2. Consent: you have expressly consented to the proposed transfer, have not withdrawn that consent and have been appropriately informed of the possible risks associated with the transfer in the absence of an adequacy decision or approved CBDTI, in a manner that enables you to understand those risks;
3. Contract with the Data Subject: transfer is necessary in connection with a contract to which you are a party or, where applicable, pre-contractual steps or negotiations relating to such a contract, subject to the requirements of applicable law;

• Sole Benefit of the Data Subject: the transfer is for your sole benefit in circumstances recognised under applicable law, and it is not reasonably practicable to obtain your consent, provided that the circumstances reasonably indicate that you would have given such consent;

1. Public Interest: the transfer is necessary for important reasons of public interest recognised under applicable law;
2. Legal Claims: the transfer is necessary for the establishment, exercise or defence of a legal claim;
3. Vital Interests: the transfer is necessary to protect the vital interests of a Data Subject or another person in circumstances where the relevant Data Subject is physically or legally incapable of giving consent; or

• Other Lawful Ground: another jural, fiduciary or lawful ground expressly recognised under the NDP Act, GAID or applicable law applies.

We will not rely on any such ground unless the circumstances and applicable legal requirements for reliance on that ground have been satisfied.

For the avoidance of doubt, a commercial or business interest, including considerations relating solely to profit, convenience or organisational development, will not, by itself, be treated as a compelling legal right or duty justifying a cross-border transfer.

Adequacy and Assessment of Cross-Border Transfers

Where applicable, the adequacy of the protection afforded to Personal Data transferred outside Nigeria will be determined in accordance with the NDP Act and applicable decisions, directives or guidance of the Commission.

Relevant considerations may include:

1. the availability of enforceable rights for Data Subjects;
2. the availability and accessibility of effective administrative or judicial remedies;

• the rule of law in the recipient jurisdiction;

1. the existence and effectiveness of applicable data protection legislation;
2. the existence and functioning of an independent and competent data protection or similar supervisory authority;
3. the circumstances and extent to which public authorities may access Personal Data;

• the existence of appropriate arrangements between the Commission and a competent authority in the recipient jurisdiction;
• relevant international commitments, conventions and membership of regional or multilateral organisations; and

1. any other factors prescribed or considered relevant by the Commission.

Where appropriate, we may conduct and document a transfer risk assessment or other appropriate assessment to identify and address risks associated with a proposed cross-border transfer.

Safeguards for Cross-Border Transfers

Where applicable, we will implement appropriate technical, organisational, contractual and governance safeguards designed to preserve the confidentiality, integrity and availability of Personal Data transferred outside Nigeria and to protect the rights and freedoms of Data Subjects.

Depending on the circumstances, these safeguards may include:

1. appropriate data processing and data transfer agreements;
2. approved CBDTIs;

• confidentiality obligations;

1. encryption, pseudonymisation and other appropriate security measures;
2. appropriate access and authentication controls;
3. data minimisation and purpose limitation measures;

• restrictions on unauthorised onward transfers;
• information security and cybersecurity requirements;

1. audit, monitoring and compliance mechanisms;
2. Personal Data Breach notification and incident-management requirements;
3. mechanisms for the exercise of Data Subject rights; and

• requirements relating to the retention, return, deletion, anonymisation or secure destruction of Personal Data.

These measures are intended to support appropriate monitoring and accountability in relation to cross-border data flows, access to remedies by affected Data Subjects and the protection of data sovereignty.

Transfers to Data Processors and Service Providers

Where Personal Data is transferred to, or made accessible by, a Data Processor or service provider located outside Nigeria, we will undertake appropriate due diligence and take reasonable steps to ensure that the recipient maintains appropriate technical and organisational measures for the protection of Personal Data.

Where required, the recipient will be subject to appropriate contractual obligations governing matters including:

1. the permitted purposes and scope of processing;
2. confidentiality and security;

• compliance with our documented instructions;

1. restrictions on the use and disclosure of Personal Data;
2. engagement of sub-processors;
3. assistance with Data Subject rights;

• Personal Data Breach and incident notification;
• regulatory cooperation;

1. retention, return and deletion of Personal Data; and
2. restrictions applicable to onward transfers.

Onward Transfers

Where a recipient of Personal Data outside Nigeria proposes to transfer or disclose that Personal Data to another recipient or jurisdiction, we will take appropriate steps, including through contractual or other safeguards where applicable, to ensure that the onward transfer remains subject to a level of protection consistent with the NDP Act, GAID and the transfer mechanism applicable to the original transfer.

 

Sensitive Personal Data

Where a proposed cross-border transfer involves Sensitive Personal Data or other categories of Personal Data that may present heightened risks to the rights and freedoms of Data Subjects, we will apply enhanced safeguards appropriate to the nature, context, scope and purposes of the processing and comply with any additional requirements imposed under applicable law or by the Commission.

Documentation and Accountability

We will maintain appropriate records relating to our cross-border transfers of Personal Data in accordance with our accountability obligations under applicable data protection law.

Such records may include, where applicable:

1. the categories of Personal Data transferred;
2. the categories of Data Subjects affected;

• the purpose of the transfer;

1. the recipient or categories of recipients;
2. the country or jurisdiction to which Personal Data is transferred;
3. the legal basis and transfer mechanism relied upon;

• the basis upon which adequate protection has been established, where applicable;
• the applicable CBDTI or other safeguards;

1. relevant technical and organisational measures; and
2. any applicable Data Protection Impact Assessment, transfer risk assessment or other documented assessment.

We will periodically review our cross-border transfer arrangements and the effectiveness of applicable safeguards, particularly where there is a material change in the nature or purpose of the processing, the recipient, destination jurisdiction, technology, applicable law, regulatory guidance or risks associated with the transfer.

Data Subject Rights and Transparency

Where required under applicable law, we will provide Data Subjects with appropriate information concerning cross-border transfers of their Personal Data, including relevant information about the categories of recipients and safeguards applicable to such transfers.

Where consent is relied upon as the lawful basis for a cross-border transfer, you may withdraw your consent in accordance with applicable law. Withdrawal of consent will not affect the lawfulness of any transfer undertaken before such withdrawal.

Your applicable rights under the NDP Act continue to apply in relation to Personal Data transferred outside Nigeria, subject to any limitations permitted by applicable law.

 

Continuing Compliance

We will periodically monitor our international data transfer arrangements and may suspend, modify or terminate a transfer where we determine that the applicable transfer mechanism is no longer valid, appropriate safeguards can no longer be maintained or continuation of the transfer would otherwise be inconsistent with applicable data protection requirements.

We will comply with applicable approval, documentation, assessment, notification and other regulatory requirements prescribed by the Commission in relation to cross-border transfers of Personal Data.

YOUR SECURITY OBLIGATIONS

Your online access to certain of your Personal Information may be protected with a password you select. We will never ask you for your password in any unsolicited communication (such as letters, phone calls or email messages). You have an obligation to keep your user ID, password and Personal Information secure. As part of maintaining this obligation, we recommend that you do the following:

1. Keep your user ID and password confidential;
2. Utilize a unique password and change it frequently;
3. Make sure others are not watching you enter your user ID and/or password on your keyboard when using protected elements of the Digital Services; and
4. Do not leave your computer unattended while logged onto the Platform. After you have finished accessing your information, exit the protected area.

SHARING AND DISCLOSURE OF PERSONAL DATA TO THIRD PARTIES

We recognise that the sharing or disclosure of Personal Data to third parties constitutes processing of Personal Data and must therefore be undertaken lawfully, fairly, transparently and in a manner that protects the rights and interests of Data Subjects.

Accordingly, we will only share, disclose or otherwise make your Personal Data available to a third party where there is an appropriate lawful basis for doing so and where the disclosure is consistent with the purposes for which the Personal Data was collected or is otherwise permitted by applicable law.

All disclosures of Personal Data will be undertaken in accordance with the Nigeria Data Protection Act 2023 (“NDP Act”), the Nigeria Data Protection Act – General Application and Implementation Directive 2025 (“GAID”), applicable directives and guidance issued by the Nigeria Data Protection Commission (“NDPC” or the “Commission”), and other applicable laws and regulatory requirements.

Circumstances in Which We May Share Personal Data

Depending on the nature of your relationship with us, the services you use and the transaction concerned, we may share your Personal Data where the disclosure is necessary and proportionate for a specified and lawful purpose, including:

1. facilitating recruitment and employment processes;
2. assessing candidates and managing applications;

• conducting background, reference, identity or qualification verification;

1. complying with applicable legal, regulatory, judicial or supervisory requirements;
2. establishing, exercising or defending legal claims;
3. protecting the rights, security and legitimate interests of NGX Group, its Subsidiaries, candidates or other persons; and

• fulfilling another purpose permitted under applicable law.
• Before sharing Personal Data with a third party, we will ensure that the disclosure is supported by an applicable lawful basis under the NDPA and other applicable law.

The necessity, desirability or convenience of sharing Personal Data with a third party will not, by itself, constitute a lawful basis for processing. We will identify and rely upon an appropriate lawful basis before making a disclosure.

Categories of Third-Party Recipients

Depending on the relevant processing activity, we may disclose Personal Data to the following categories of recipients:

1. Recruitment Agencies and External Recruitment Consultants – recruitment agencies, executive search firms and other external recruitment consultants engaged to source, screen or assess candidates on behalf of NGX Group;
2. Background Screening and Verification Service Providers – third-party providers engaged to conduct background checks, employment history verification, reference checks, identity verification and other pre-employment screening activities;

• Assessment and Testing Service Providers – providers of psychometric, aptitude, competency, technical and other assessments conducted as part of the recruitment process;

1. Educational and Professional Qualification Verification Bodies – educational institutions, professional bodies and other relevant organisations engaged to verify candidates’ academic, professional or other qualifications;
2. References and Referees – individuals and organisations provided by candidates as referees or previous employers, where necessary for verifying information provided during the recruitment process;
3. Technology and Recruitment Platform Providers – providers of applicant tracking systems, recruitment platforms, online assessment tools, video interview platforms and other technology solutions used to facilitate the recruitment process;

• IT, Cloud and Other Service Providers – third-party service providers that support the storage, hosting, management, security and processing of candidates’ Personal Data in connection with the recruitment process;
• Professional Advisers and Consultants – legal advisers, auditors, consultants and other professional advisers where disclosure is necessary for recruitment-related purposes or to comply with applicable legal or regulatory requirements;

1. Regulatory, Governmental and Law Enforcement Authorities – relevant regulatory bodies, government agencies, courts or law enforcement authorities where disclosure is required or permitted by applicable law; and
2. Other Authorised Third Parties – other third parties where disclosure is necessary for the recruitment process, to protect the rights and interests of NGX Group or candidates, or where otherwise permitted by applicable data protection laws.

We will take reasonable steps to ensure that Personal Data disclosed to a third party is limited to what is adequate, relevant and reasonably necessary for the particular purpose for which the disclosure is made.

Lawful Basis for Disclosure

Before sharing Personal Data with a third party, we will ensure that the disclosure is supported by an applicable lawful basis under the NDP Act. Depending on the circumstances, we may rely on:

1. your consent;
2. performance of a contract to which you are a party or steps taken at your request before entering into a contract;

• compliance with a legal obligation;

1. protection of your vital interests or those of another person;
2. performance of a task carried out in the public interest or in the exercise of official authority; or
3. the legitimate interests pursued by NGX GROUP or a third party, subject to the rights, freedoms and legitimate interests of the affected Data Subject.

Where we rely on legitimate interests, we will consider the nature and purpose of the processing and the potential impact on affected Data Subjects and will implement appropriate safeguards where necessary.

Where consent is relied upon, consent will be obtained in accordance with applicable law and may be withdrawn by you at any time. Withdrawal of consent will not affect the lawfulness of processing undertaken before the withdrawal.

Third-Party Data Processors

Where we appoint a third party to process Personal Data on our behalf, we will take appropriate steps to assess the processor's ability to process Personal Data securely and in accordance with applicable data protection requirements.

We will require Data Processors acting on our behalf to process Personal Data only for authorised purposes and in accordance with our documented instructions, except where otherwise required by applicable law.

Our engagement of a Data Processor will be governed by a written contract or other legally binding arrangement, as required by applicable law, which will address, as appropriate:

1. the subject matter, nature, purpose and duration of the processing;
2. the categories of Personal Data and Data Subjects concerned;

• the rights and obligations of the parties;

1. compliance with our documented processing instructions;
2. confidentiality obligations;
3. appropriate technical and organisational security measures;

• assistance in facilitating the exercise of Data Subject rights;
• Personal Data Breach detection, management and notification;

1. applicable retention, return, deletion or secure destruction requirements;
2. audit, monitoring and compliance obligations;
3. engagement of other processors or sub-processors;

• assistance with Data Protection Impact Assessments where appropriate; and
• applicable requirements relating to cross-border transfers of Personal Data.

Due Diligence and Oversight of Data Processors

Before appointing a material Data Processor, we will undertake appropriate due diligence having regard to the nature, scope, context and risks associated with the processing.

Depending on the circumstances, such due diligence may include consideration of:

1. the processor's technical and organisational security measures;
2. its experience, competence and reliability in processing Personal Data;

• its data protection and information-security policies and procedures;

1. its applicable registration or compliance status with the NDPC, where required;
2. relevant certifications, standards or independent assurance reports;
3. the locations in which Personal Data will be stored or processed;

• its use of sub-processors;
• its Personal Data Breach and incident-response procedures; and

1. any other matter reasonably necessary to assess its ability to comply with applicable data protection requirements.

We may periodically review or monitor material Data Processors, taking into account the nature and risks of the processing and any material changes to the relevant processing arrangement.

Sub-Processors

Where a Data Processor engaged by us proposes to engage another processor or sub-processor in connection with Personal Data processed on our behalf, such engagement will be subject to applicable legal and contractual requirements.

Where appropriate, we will require the original Data Processor to ensure that authorised sub-processors are subject to data protection, confidentiality and security obligations that provide an appropriate level of protection for the Personal Data concerned.

The engagement of a sub-processor will not relieve the original Data Processor of its applicable responsibilities in respect of Personal Data processed on our behalf.

Disclosures to Independent Data Controllers

Not every third party that receives Personal Data from us acts as our Data Processor. Certain recipients may process Personal Data as independent Data Controllers because they independently determine the purposes and means of their processing in accordance with their legal, regulatory, contractual or operational responsibilities.

Depending on the circumstances, such recipients may include prospective employers or relevant hiring entities within NGX Group and its Subsidiaries, professional and qualification verification bodies, regulatory and governmental authorities, law enforcement agencies, courts and tribunals; and other organisations that independently determine the purposes and means of processing in accordance with applicable law.

Where we disclose Personal Data to an independent Data Controller, we will remain responsible for ensuring that our disclosure of the Personal Data is lawful, fair, transparent, necessary and proportionate and is supported by an appropriate lawful basis.

Following a lawful disclosure, the independent Data Controller will be responsible for complying with its own obligations under applicable data protection law in relation to its subsequent processing of the Personal Data.

 

Regulatory and Legally Required Disclosures

We may disclose Personal Data where the disclosure is required or permitted by applicable law, regulation, court order, regulatory directive or other lawful process. This may include disclosures reasonably necessary to:

1. comply with applicable securities, capital market, financial services, anti-money laundering, counter-terrorism financing, taxation, data protection or other legal and regulatory requirements;
2. respond to lawful requests from regulatory, supervisory, judicial, law-enforcement or governmental authorities;

• investigate, prevent or respond to fraud, financial crime, cybersecurity incidents or other unlawful activity;

1. establish, exercise or defend legal claims; or
2. protect the rights, property, security or legitimate interests of NGX GROUP, Data Subjects or other persons where permitted by law.

Where legally permissible and practicable, we will limit such disclosures to Personal Data that is adequate, relevant and reasonably necessary for the particular legal or regulatory purpose.

Sensitive Personal Data

Where the sharing or disclosure of Personal Data involves Sensitive Personal Data, we will ensure that the processing is permitted under section 30 of the NDP Act or any other applicable condition prescribed by the Commission, and that any applicable safeguards are implemented.

Where appropriate, we will apply enhanced technical and organisational measures having regard to the nature and sensitivity of the Personal Data, the purposes and circumstances of the disclosure and the risks that the processing may present to the rights and freedoms of affected Data Subjects.

We will not share or disclose Sensitive Personal Data unless the applicable requirements governing the processing of such Personal Data have been satisfied.

Purpose Limitation and Data Minimisation

We will take reasonable steps to ensure that Personal Data disclosed to a third party is adequate, relevant and limited to what is reasonably necessary for the identified purpose.

Data Processors acting on our behalf will not be authorised to use Personal Data for purposes incompatible with our documented instructions or the purposes for which the Personal Data was provided, except where processing is required by applicable law.

Where the purpose for which a third party processes Personal Data materially changes, we will assess whether the proposed processing is compatible with the original purpose and whether an additional or different lawful basis, notice or other safeguard is required.

Security and Confidentiality

We will require Data Processors acting on our behalf to implement appropriate technical and organisational measures designed to preserve the confidentiality, integrity and availability of Personal Data and to protect it against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, access or other unlawful processing.

The nature of the safeguards applied will be proportionate to the risks associated with the processing and may include, where appropriate, encryption, pseudonymisation, access controls, authentication mechanisms, confidentiality obligations, security monitoring, vulnerability management, business continuity measures and incident-response procedures.

Third-Party Direct Marketing

We will not disclose your Personal Data to third parties for their independent direct marketing purposes unless there is an appropriate lawful basis for doing so and any consent required under applicable law has been obtained.

Where consent is relied upon for direct marketing, you may withdraw your consent at any time. You may also exercise your applicable right to object to the processing of your Personal Data for direct marketing purposes.

International Disclosures

Where the disclosure of Personal Data to a third party involves the transfer, storage, access or other processing of Personal Data outside the Federal Republic of Nigeria, the disclosure will additionally be subject to the requirements applicable to cross-border transfers under the NDP Act and GAID and the International and Cross-Border Transfers of Personal Data section of this Privacy Policy.

A lawful basis for sharing Personal Data with a third party does not, by itself, satisfy the requirements applicable to a cross-border transfer. Where applicable, we will separately establish and document an appropriate cross-border transfer basis or mechanism.

 

Data Protection Impact Assessments

Where the proposed engagement of a third party, introduction of a new technology or other processing arrangement is likely to result in a high risk to the rights and freedoms of Data Subjects, we will consider the relevant third-party processing as part of a Data Protection Impact Assessment in accordance with applicable law.

Where appropriate, relevant Data Processors may be required to provide information or assistance necessary for the conduct, review or implementation of measures arising from a Data Protection Impact Assessment.

Accountability and Records

We will maintain appropriate records relating to material third-party processing arrangements as part of our accountability and data governance framework.

Depending on the nature and risk of the processing, such records may include information concerning:

1. the third party and its role as Data Processor or independent Data Controller;
2. the categories of Personal Data and Data Subjects concerned;

• the purposes of the disclosure or processing;

1. the applicable lawful basis;
2. relevant contractual arrangements;
3. due diligence and risk assessments;

• technical and organisational security measures;
• use of sub-processors;

1. international transfer arrangements, where applicable; and
2. applicable retention and deletion requirements.

Your Rights and Information About Recipients

Subject to applicable law, you may request information regarding the recipients or categories of recipients to whom your Personal Data has been or may be disclosed and exercise your applicable Data Subject rights in relation to such Personal Data.

Requests relating to the disclosure of your Personal Data or the exercise of your rights may be submitted using the contact details provided in this Privacy Policy.

 

DO WE USE COOKIES?

Yes. A cookie is a small file which asks permission to be placed on your computer’s hard drive. Once you agree, the file is added, and the cookie helps analyze web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences. Cookies are features included in your browser and will store small amounts of data on your computer about your visit to the Platform, in particular when you complete any form on the Platform. However, a cookie does not provide us with any Personal Information. Therefore, if you have not supplied us with any Personal Information, you can still browse our site anonymously. You do not need to have cookies turned on to visit most of the Platform. Cookies on the Platform are not used to capture or store personal data from browsers to the site, other than to log your IP address and session information such as the duration of the visit to our site and the nature of the browser used. This information is used only for administration of the platform’s system and in the compilation of statistics used by NGX GROUP/its Subsidiaries. Cookies may be required to allow you to access and participate in certain areas of the Platform. Once you have closed your browser, this type of cookie is deactivated. The majority of browsers will allow you to alter the settings used for cookies and to disable and enable them as you require. If you do not want cookies and for further general information on cookies you may wish to visit https://www.allaboutcookies.org/.

CONTROLLING YOUR PERSONAL INFORMATION

We will not sell, distribute or lease your Personal Information to third parties unless we have your permission or are required by law to do so.

REMEDIES FOR VIOLATION OF THIS PRIVACY POLICY

Any person subject to this Privacy Policy who is found to be in breach of this Privacy Policy by:

1. failure to implement safeguards required by the Nigeria Data Protection Act (NDPA) 2023 and the General Application and Implementation Directive (GAID) 2025 or any of the security measures provided in this Policy;
2. failure to mitigate the damage once it has occurred; or
3. failure to timely notify the affected individuals

shall be liable, in addition to any other civil liabilities, to the penalties provided in the Nigerian Data Protection Act and the General Application and Implementation Directive (GAID) 2025.

CONTACTING NGX GROUP/ITS SUBSIDIARIES

Our customer service contact is contactcenter@ngxgroup.com and +234 700 225 5673. We shall endeavour to respond to enquiries/issues sent to/made to these service contacts within 48 hours.

GOVERNING LANGUAGE

This Privacy Notice, and the contents of this Platform are available in English

GOVERNING LAW AND JURISDICTION

By accessing the services on this Platform, you agree to be governed by the laws of the Federal Republic of Nigeria, the Nigeria Data Protection Act (NDPA) 2023 and the General Application and Implementation Directive (GAID) 2025. The laws of the Federal Republic of Nigeria will govern all matters relating to this Privacy Notice and the use, or inability to use, the Platform, and shall apply without regard to the principles of conflict of laws.

You agree to submit to the exclusive jurisdiction and venue of the Courts in the Federal Republic of Nigeria.

Notwithstanding the foregoing, NGX GROUP/its Subsidiaries may seek recourse in any jurisdiction worldwide to restrain the unlawful use of the Platform or any material contained on the Platform.

Terms & Conditions

Our responsibilities to you are clearly defined in our terms & conditions