CarnelianPearls Tech
Contact

Legal

Privacy Policy

Effective date: 17 July 2026 · Last updated: 17 July 2026

1. Who we are

CarnelianPearls Technologies Limited ("CarnelianPearls", "we", "us", or "our") is a company incorporated in Nigeria under the Companies and Allied Matters Act 2020, with registration number RC 8736251 and registered office in Lagos, Nigeria.

CarnelianPearls is a technology and professional services company. Our current activities include strategic consulting, enterprise software implementation, and skills and digital transformation programmes. We also build and incubate early-stage ventures and facilitate strategic partnerships. Where we describe planned services, such as a marketplace for business and investment opportunities, we identify them as future offerings.

For the purpose of the Nigeria Data Protection Act 2023, CarnelianPearls is a data controller in respect of personal data collected through this website and in the ordinary course of our business.

2. Scope of this policy

This policy explains how we collect, use, store, share, and protect personal data when you:

  • visit or interact with our website at https://carnelianandpearls.com;
  • contact us or submit an enquiry;
  • engage us for consulting or professional services;
  • participate in a partnership, referral, or deal discussion; or
  • interact with any product, pilot, or platform operated by CarnelianPearls or its venture studio.

Where a specific CarnelianPearls product (for example, a venture studio product) has its own privacy notice, that notice governs data processed through that product and supplements this policy.

3. Legal framework

We process personal data in line with:

  • the Nigeria Data Protection Act 2023 (NDPA);
  • the General Application and Implementation Directive 2025 (GAID) issued by the Nigeria Data Protection Commission (NDPC);
  • the Constitution of the Federal Republic of Nigeria 1999 (as amended); and
  • any other applicable Nigerian law and sector-specific regulation.

The NDPA and GAID together form the governing data protection framework in Nigeria and supersede the Nigeria Data Protection Regulation 2019.

4. Personal data we collect

We collect only the data we need for the purposes set out in this policy. Depending on how you interact with us, this may include:

Identity and contact data

Name, job title, company or organisation, email address, telephone number, and postal or business address.

Engagement and enquiry data

The content of your messages, enquiries, proposals, or requests; records of our correspondence; and details relevant to a consulting engagement, partnership, or deal discussion.

Commercial and professional data

Information you share in the course of a business relationship, including your role, area of interest, sector, and any documents you choose to provide.

Technical data

This website does not run analytics and sets no tracking cookies, so we do not build a record of your visit or a profile of your browsing. However, as with any website, delivering a page to you requires a network request: our hosting provider and the third-party font provider described in Section 13 necessarily receive your IP address and basic request information in order to serve the page. We do not use that information to identify you.

Marketing data

Your preferences for receiving updates from us, and whether you have opted in or out.

We do not seek to collect sensitive personal data (as defined under the NDPA) through this website. Where sensitive personal data is required for a specific engagement, we will process it only with your explicit consent or another lawful basis, and with appropriate safeguards.

5. How we collect personal data

We collect personal data:

  • directly from you, when you send us an email, use the contact page, request a proposal, or engage our services;
  • from third parties or public sources, such as business directories, referrals, professional networks, or partners, where relevant to a potential engagement and permitted by law.

The contact page does not submit anything to a server. It composes a message in your own email application, which you then choose to send. We receive only what you decide to include.

6. Lawful basis for processing

Under the NDPA, we process personal data only where we have a lawful basis. The bases we rely on are:

  • Consent — where you have given clear, informed, and freely given consent, for example to receive marketing updates.
  • Contract — where processing is necessary to enter into or perform a contract with you, such as a consulting engagement or partnership agreement.
  • Legal obligation — where we must process data to comply with Nigerian law, including tax, corporate, and regulatory requirements.
  • Legitimate interest — where processing is necessary for our legitimate business interests (such as responding to enquiries, managing relationships, securing our systems, and developing our services), provided your rights do not override those interests.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

7. How we use personal data

We use personal data to:

  • respond to your enquiries and provide the information you request;
  • deliver consulting and professional services and manage engagements;
  • assess, structure, and facilitate partnerships, referrals, and deal opportunities;
  • develop, test, and improve products within our venture studio;
  • operate, maintain, secure, and improve our website;
  • send updates, insights, or opportunities where you have opted in;
  • meet our legal, regulatory, and contractual obligations; and
  • establish, exercise, or defend legal claims.

We do not use personal data for automated decision-making that produces legal or similarly significant effects without a lawful basis and appropriate safeguards.

8. Sharing and disclosure

We do not sell personal data. We share it only where necessary and with appropriate protections in place, including with:

  • service providers and processors who support our operations (for example, hosting, email, and IT security providers), acting on our instructions under a data processing agreement;
  • professional advisers, such as lawyers, accountants, auditors, and consultants, where required;
  • partners and counterparties in a deal or partnership, but only with your knowledge and, where required, your consent;
  • regulators, courts, or authorities, where we are required or permitted to disclose by law; and
  • a successor entity, in the event of a merger, acquisition, restructuring, or sale of assets.

We require all third parties to respect the security of personal data and to process it in line with the NDPA.

9. Cross-border transfers

Some of our service providers may store or process data outside Nigeria. Where we transfer personal data outside Nigeria, we do so in line with the cross-border transfer provisions of the NDPA and GAID. We transfer data only where:

  • the destination country provides an adequate level of protection as recognised under the NDPA;
  • appropriate safeguards (such as contractual protections) are in place; or
  • another lawful condition for transfer applies, including your consent.

You may contact us for information about the specific safeguards applied to any transfer of your data.

10. Data retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to meet legal, accounting, tax, or reporting obligations. When data is no longer required, we securely delete or anonymise it. Retention periods vary by data type and the nature of the relationship; we can provide details on request.

11. Data security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. These include access controls, encryption where appropriate, secure hosting, and staff confidentiality obligations. No system is completely secure, so we cannot guarantee absolute security, but we act promptly to investigate and respond to any suspected breach, including notifying the NDPC and affected data subjects where the NDPA requires.

12. Cookies

This website is a static site. It sets no cookies of its own, and we do not use analytics, advertising, or tracking technologies. Because we place no non-essential cookies, there is no cookie banner on this site and no cookie consent is required from you.

If we later add analytics or any other technology that places non-essential cookies, we will update this section and obtain your consent before those cookies are placed, as the GAID requires.

13. Third parties

This site loads its typeface from Google Fonts. To deliver the font, Google receives your IP address and basic request information. This site also links out to external services, including Taska and LinkedIn.

These third parties are governed by their own privacy notices, not this policy. We do not control them and we do not accept responsibility for their practices. We encourage you to review their privacy notices.

14. Children's data

Our website and services are directed at businesses and professionals, not children. We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us with personal data, contact us and we will delete it.

15. Your rights

Under the NDPA, subject to conditions and exemptions, you have the right to:

  • be informed about how your data is processed;
  • access the personal data we hold about you;
  • rectify inaccurate or incomplete data;
  • request erasure of your data ("right to be forgotten");
  • restrict processing in certain circumstances;
  • object to processing based on legitimate interest or for direct marketing;
  • request portability of data you have provided, in a structured, commonly used format;
  • withdraw consent where processing is based on consent; and
  • lodge a complaint with the Nigeria Data Protection Commission.

To exercise any right, contact us using the details in Section 17. We will respond within the timeframe required under the NDPA. We may need to verify your identity before acting on a request.

16. Changes to this policy

We may update this policy from time to time to reflect changes in our practices, technology, or the law. We will post the updated version on this page with a revised "Last updated" date. Where changes are significant, we will take reasonable steps to notify you.

17. Contact us and complaints

For any question about this policy, or to exercise your rights, contact:

CarnelianPearls Technologies Limited
Attention: Data Protection Contact
Email: info@carnelianandpearls.com
Address: Lagos, Nigeria

If you are not satisfied with our response, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng or through its published complaint channels.