Data Protection & Privacy Policy

1. Purpose

This Data Protection & Privacy Policy sets out how Optimum IT Systems collects, uses, stores, shares, retains and disposes of personal data. It ensures compliance with the Nigeria Data Protection Act (NDPA) 2023, the Nigeria Data Protection Regulation (NDPR) and, where relevant to international engagements, the EU General Data Protection Regulation (GDPR).

2. Scope

This policy applies to all personal data processed by Optimum IT Systems in any format, whether the company acts as a data controller (e.g., HR, customer contacts) or as a data processor on behalf of a client (e.g., CCTV footage, access-control logs, managed IT services).

3. Definitions

• Personal Data: Any information relating to an identified or identifiable natural person (data subject).
• Sensitive Personal Data: Data revealing racial or ethnic origin, religious beliefs, health, biometric or genetic data, or similar categories under the NDPA.
• Processing: Any operation performed on personal data (collection, storage, use, disclosure, deletion).
• Data Controller: Entity that determines the purpose and means of processing.
• Data Processor: Entity that processes personal data on behalf of a controller.
• Data Subject: The identified or identifiable person to whom personal data relates.

4. Data Protection Principles

Optimum IT Systems processes personal data in accordance with the following principles:

1. Lawfulness, fairness and transparency — a lawful basis is identified before processing, and data subjects are informed.
2. Purpose limitation — data is collected for specified, explicit and legitimate purposes only.
3. Data minimisation — only the personal data required for the stated purpose is collected.
4. Accuracy — personal data is kept accurate and up to date; inaccurate data is corrected or erased.
5. Storage limitation — personal data is retained no longer than necessary.
6. Integrity and confidentiality — appropriate technical and organisational measures protect personal data.
7. Accountability — Optimum IT Systems can demonstrate compliance with these principles.

5. Categories of Personal Data Processed

6. Lawful Basis for Processing

Personal data is processed only where at least one of the following lawful bases applies:

• Consent of the data subject.
• Performance of a contract with the data subject.
• Compliance with a legal obligation.
• Protection of vital interests of the data subject.
• Performance of a task in the public interest.
• Legitimate interests of Optimum IT Systems or a third party, balanced against the rights of the data subject.

7. Data Subject Rights

Data subjects have the following rights, which Optimum IT Systems will honour within statutory timelines (typically 30 days):

• Right to be informed about processing.
• Right of access to their personal data.
• Right to rectification of inaccurate data.
• Right to erasure ("right to be forgotten") where applicable.
• Right to restrict processing.
• Right to data portability.
• Right to object to processing, including for direct marketing.
• Right not to be subject to solely automated decision-making with significant effect.

Requests should be sent to optimum.systems.ng@gmail.com. Identity is verified before a request is actioned.

8. Consent Management

• Where consent is the lawful basis, it is obtained through a clear, affirmative action and recorded.
• Data subjects may withdraw consent at any time, as easily as it was given.
• Consent is not bundled with unrelated terms.

9. Data Security Measures

Optimum IT Systems applies proportionate technical and organisational measures to protect personal data, including:

• Encryption of personal data at rest and in transit (AES-256, TLS 1.2+).
• Role-based access control with least-privilege and MFA for systems holding personal data.
• Segregation of client data on managed platforms.
• Secure configuration of CCTV, NVR/DVR and access-control systems, including changing default credentials and disabling insecure protocols.
• Logging and monitoring of access to personal data.
• Secure backups with tested restoration.
• Physical security of offices, warehouses and equipment holding personal data.
• Mandatory data-protection training for all staff and engineers.

10. CCTV, Access Control and Surveillance Data

When Optimum IT Systems designs, installs or maintains CCTV or access-control systems, the client remains the data controller for the resulting personal data. Optimum IT Systems, as processor:

• Advises clients on lawful placement of cameras, signage requirements and retention limits.
• Applies secure configuration baselines to NVRs, cameras and controllers.
• Does not access, copy, transfer or retain client footage except as necessary for maintenance and only under written client instruction.
• Ensures engineers accessing customer footage are trained, authorised, uniquely identified and logged.
• Recommends retention periods that satisfy legitimate need without excess (typically 30 days for standard CCTV footage unless otherwise required).

11. Third Parties and International Transfers

• Personal data is shared with third parties only where a lawful basis exists and a written agreement (Data Processing Agreement) is in place.
• Suppliers, OEMs, cloud providers and sub-processors are assessed for data-protection compliance.
• Cross-border transfers of personal data outside Nigeria are performed only where the destination provides an adequate level of protection or appropriate safeguards (e.g., standard contractual clauses, explicit consent).
• A register of sub-processors is maintained and made available to clients on request.

12. Data Retention and Disposal

• Personal data is retained only for as long as necessary to fulfil the purpose for which it was collected, or as required by law or contract.
• A Data Retention Schedule is maintained by the CISO / Data Protection Officer.
• At end of life, personal data is securely deleted; storage media is sanitised or destroyed following recognised standards (e.g., NIST SP 800-88), with a certificate of destruction retained.

13. Personal Data Breach Management

• Any suspected personal-data breach must be reported to the Data Protection Officer within 24 hours of discovery.
• Breaches are assessed for risk to data subjects. Where a breach is likely to result in a risk to the rights and freedoms of natural persons, the Nigeria Data Protection Commission (NDPC) is notified within 72 hours.
• Affected data subjects are notified where the breach is likely to result in high risk to them.
• Where Optimum IT Systems is a processor, the affected client is notified without undue delay and supported throughout containment, investigation and regulatory reporting.
• A register of all personal-data breaches is maintained.

14. Data Protection Impact Assessments (DPIA)

A DPIA is conducted before initiating processing that is likely to result in a high risk to data subjects — for example, deployment of biometric access control, large-scale CCTV, or new managed-services platforms handling significant volumes of personal data. DPIAs are documented and reviewed by the Data Protection Officer.

15. Roles and Responsibilities

16. Training and Awareness

All staff receive data-protection training at induction and at least annually. Engineers assigned to customer sites receive additional briefings on handling surveillance, biometric and access-control data.

17. Compliance, Monitoring and Review

• Compliance with this policy is monitored through internal audits, control testing and periodic management review.
• Non-compliance may result in disciplinary action, contract termination and, where applicable, referral to regulatory authorities.
• This policy is reviewed at least annually and updated to reflect changes in regulation, technology or the business.

18. Contact

Attention: Data Protection Officer — Optimum IT Systems