How we collect, use, share, and protect personal data — across our website, our own products, and the messaging services we build and operate for our clients.
Version 1.0 · Effective 2 September 2026
We keep this document plain and readable on purpose. If anything here is unclear, or you want to exercise a right described below, contact us at hello@nexiumlabs.io.
NexiumLabs Limited (“NexiumLabs”, “we”, “us”, “our”) is a software engineering company incorporated in Nigeria under the Companies and Allied Matters Act 2020 (RC 9416421), with its registered office at 43, Prince Fadina, Olodi Apapa, Lagos State, Nigeria. We design, build, and operate digital products and infrastructure — for our own portfolio and on behalf of client organisations.
For any question about this policy or about how your personal data is handled, contact us at hello@nexiumlabs.io. We aim to acknowledge data-protection enquiries within 2 business days and to resolve them within 30 days.
This policy applies to personal data we process in connection with:
It does not apply to third-party websites or services we link to, which have their own policies.
Data-protection law distinguishes the party that decides why and how personal data is processed (the controller) from the party that processes it on the controller’s instructions (the processor).
If you message a business’s WhatsApp or SMS line that runs on our platform, we process, on that business’s behalf:
We do not knowingly collect special categories of data (such as health, religion, or political opinion) and ask that you do not send them to us.
These points apply specifically to WhatsApp Business and SMS assistants we operate:
| Purpose | Data used |
|---|---|
| Respond to enquiries | Name, email, company, message content, engagement type |
| Prepare proposals and deliver client projects | Contact details, project correspondence, account information you provide |
| Operate a messaging assistant for a client | Phone number, profile name, message content, conversation state |
| Process a purchase and issue a voucher | Phone number, selected plan, payment reference, voucher record |
| Provide customer support and handle disputes | Conversation history, order and voucher records |
| Keep services secure and prevent abuse | Message metadata, delivery and read receipts, technical logs |
| Meet legal, tax, and regulatory obligations | Transaction records, correspondence |
We do not use your personal data for unsolicited marketing, and we do not sell it or share it with third parties for their own marketing purposes.
Under the Nigeria Data Protection Act 2023 (and, where it applies, comparable law such as the GDPR), we rely on the following bases:
Where we act as a processor for a client, the client is responsible for establishing the legal basis for the processing we carry out on its instructions.
Some of our service providers are located outside Nigeria, including in the United States and the European Union. Where personal data is transferred abroad, we rely on a lawful transfer mechanism under the Nigeria Data Protection Act 2023 — an adequacy decision, the provider’s binding contractual commitments (such as standard contractual clauses), or your explicit consent — and we take steps to ensure the data remains protected to the standard described in this policy.
| Data | Retention |
|---|---|
| Website enquiry / contact form | Up to 24 months after last contact, unless it becomes part of a project record |
| Client project records | For the engagement plus 6 years, to meet tax and legal requirements |
| Messaging conversation history | For the period set by the client controller — by default 12 months from the last message |
| Order and voucher records | Up to 6 years, for accounting and dispute resolution |
| Technical and security logs | Up to 12 months |
When a retention period ends, we delete the data or irreversibly anonymise it. A deletion request (below) can shorten these periods except where we are legally required to keep a record.
Subject to the conditions in the Nigeria Data Protection Act 2023, you have the right to:
To exercise a right, email hello@nexiumlabs.io. We may need to verify your identity. We respond within 30 days and will explain any case where a right does not apply. If your request concerns a service we operate for a client, we will act on the client’s instructions and, where appropriate, forward your request to them.
You can ask us to delete the personal data we hold about you at any time. There are two ways:
After we verify the request, we delete the associated conversation history, profile name, conversation state, and contact record, and we instruct our sub-processors to do the same, normally within 30 days. We may retain a minimal record where the law requires it — for example, a transaction record needed for tax or accounting — and we will tell you if that applies. Deletion of your data on WhatsApp itself is governed by WhatsApp’s own controls and policies.
Where the data belongs to a service we run for a client, that client is the controller; we will carry out the deletion on its instruction and confirm to you when it is done.
We use technical and organisational measures appropriate to the risk, including encryption of credentials and sensitive values at rest, encryption in transit (TLS), verification of the authenticity of incoming webhooks, access controls on a need-to-know basis, and reputable infrastructure providers. No method of transmission or storage is completely secure; if a breach affects your rights we will notify you and the Nigeria Data Protection Commission as required by law.
Our website and services are intended for adults and for business use. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact hello@nexiumlabs.io and we will delete it.
We may update this policy to reflect changes in our services, our service providers, or the law. When we do, we revise the version number and effective date at the top and, for a material change, we take reasonable steps to bring it to your attention. The current version always lives at this URL.
NexiumLabs Limited (RC 9416421)
43, Prince Fadina, Olodi Apapa, Lagos State, Nigeria
Email: hello@nexiumlabs.io
Data protection contact: Collins Ezeokeke, Director — collins@nexiumlabs.io
If you are not satisfied with our response, you may complain to the Nigeria Data Protection Commission (NDPC) — ndpc.gov.ng. If another country’s data-protection law applies to you, you may also contact your local supervisory authority.
This Privacy Policy is published by NexiumLabs Limited (RC 9416421). Version 1.0, effective 2 September 2026. This is the first version of the policy.