Data Protection & Privacy Policy

Cedric Masters Limited is a Limited Liability company licensed in Nigeria by the Corporate Affairs Commission in Nigeria (CAC). We provide technology, fashion and educational training services to a wide variety of customers including individuals, small and medium enterprises, large corporates and multinationals, governmental institutions and non-governmental institutions. Our services are provided at our locations, including the Internet.

Customers and potential customers can access our services through these channels, including our website www.cedricmasters.com. By accessing the Cedric Masters Ltd services at our subsidiary locations and/or our tracking application for fraud and/or subscribing to any of our various products, customers provide certain personally identifiable information.

This document details the policies of the Company guiding the collection, use, storage, destruction and disclosure of this personally identifiable information.

This policy document is available on our website at www.cedricmasters.com and our locations. Please read it thoroughly before accessing our service. By engaging in any of Cedric Masters Ltd services, you give consent to the processing of your personal data in accordance with this policy.

Unless otherwise defined in this Privacy Policy, terms used in this Privacy Policy have the same meanings as in our Terms and Conditions on www.cedricmasters.com.

1.1 Glossary

We collect several different types of information for various purposes to provide and improve our services to you.

2.1 Types of Data Collected

While using our services, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you ("Personal Data"). Personally identifiable information may include, but is not limited to:

2.2 Use of Analytics to Collect / Monitor / Analyze Data

We may use third-party Service Providers to monitor and analyze the use of our Service.

2.3 Use of Data

The purpose of collecting personally identifiable information is to enable us to provide you with the company’s services you have subscribed to and ensure that you are able to have access to all our services without hitches.

The usage of data may be extended beyond the above whenever necessary for the purposes of meeting legal, regulatory, contractual obligations, and other legitimate business interests. Specifically, the uses Cedric Masters could put your data into include but are not limited to:

• To provide and maintain our services
• To notify you about changes to our service
• To allow you to participate in interactive features of our Service when you choose to do so
• Providing customer care and support
• To provide analysis or valuable information so that we can improve the Service
• To monitor the usage of the Service
• To detect, prevent and address technical issues
• To facilitate registration processes
• To send you marketing and promotional communications for business purposes
• To deliver targeted advertising to you for our Business Purposes and/or with your consent

The world today is interconnected and so is the provision of our services. For instance, there could be many counterparties involved for a tracking process to be successfully completed. These include the telecom companies, switching companies, processors, acquirers, merchants, banks and automobiles. Certain personal data will traverse these parties in the normal course of carrying out transactions.

Save as related to the provision of our services and meeting legal, regulatory, contractual, and other uses tangential or incidental to these, Cedric Masters Ltd will not share your personal data with a third party. Where it becomes necessary to do so, adequate security measures will be taken to protect the data from access by recipients other than those for which it is intended. All data we collect will reside in Cedric Masters Ltd computer systems in Nigeria. Where cloud services are used, adequate governance measures that apply to such cloud services will be complied with.

Cedric Masters Limited will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy. No transfer of your Personal Data will take place to an organization or a country unless there are adequate controls in place including the security of your data and other personal information.

Transfer of Personal Data to Foreign Country

Where Personal Data is to be transferred to a country outside Nigeria, Cedric Masters shall put adequate measures in place to ensure the security of such Personal Data. Cedric Masters shall, among other things, conduct a detailed assessment of whether the said country is on the National Information Technology Development Agency (NITDA) Whitelist of Countries with adequate data protection laws.

Transfer of Personal Data out of Nigeria would be in accordance with the provisions of the Nigeria Data Protection Regulation, 2019 (NDPR). Cedric Masters will therefore only transfer Personal Data out of Nigeria on one of the following conditions:

1. aThe consent of the Data Subject has been obtained.
2. bThe transfer is necessary for the performance of a contract between Cedric Masters and the Data Subject, or implementation of pre-contractual measures taken at the Data Subject’s request.
3. cThe transfer is necessary to conclude a contract between Cedric Masters and a third party in the interest of the Data Subject.
4. dThe transfer is necessary for reasons of public interest.
5. eThe transfer is for the establishment, exercise or defense of legal claims.
6. fTransfer is necessary in order to protect the vital interests of the Data Subjects or other people, where the Data Subject is physically or legally incapable of giving consent.

Provided, in all circumstances, that the Data Subject has been manifestly made to understand through clear warnings of the specific principle(s) of data protection that are likely to be violated in the event of transfer to a third country; this proviso shall not apply to any instance where the Data Subject is answerable in duly established legal action for any civil or criminal claim in a third country.

Cedric Masters will take all necessary steps to ensure that the Personal Data is transmitted in a safe and secure manner. Details of the protection given to your information when it is transferred outside Nigeria shall be provided upon the Data Subject’s request.

Where the recipient country is not on the Whitelist and none of the conditions stipulated in this Privacy Policy are met, Cedric Masters Ltd will engage with NITDA and the Office of the Honorable Attorney General of the Federation (HAGF) for approval with respect to such transfer.

We only share and disclose your information in the following situations:

The security of your data is important to us. We have implemented appropriate technical and organizational security measures designed to protect the security of any personal information we process. However, please also remember that we cannot guarantee that the internet itself is 100% secure. Although we will do our best to protect your personal information, transmission of personal information to and from our services is at your own risk. You should only access the services within a secure environment.

Cedric Masters Ltd is committed to maintaining the principles in the NDPR regarding the processing of Personal Data. To demonstrate this commitment as well as our aim of creating a positive privacy culture within the company, the company adheres to the following basic principles relating to the processing of Personal Data:

6.1 Lawfulness, Fairness and Transparency

Personal Data must be processed lawfully, fairly and in a transparent manner at all times. This implies that Personal Data collected and processed by or on behalf of Cedric Masters Ltd must be in accordance with the specific, legitimate and lawful purpose consented to by the Data Subject, save where the processing is otherwise allowed by law or within other legal grounds recognized in the NDPR.

6.2 Data Accuracy

Personal Data must be accurate and kept up to date. In this regard, Cedric Masters shall:

• ensure that any data it collects and/or processes is accurate and not misleading in a way that could be harmful to the Data Subject;
• make efforts to keep Personal Data updated where reasonable and applicable; and
• make timely efforts to correct or erase Personal Data when inaccuracies are discovered.

6.3 Purpose Limitation

Cedric Masters collects Personal Data only for the purposes identified in the appropriate company Privacy Notice provided to the Data Subject and for which consent has been obtained. Such Personal Data cannot be reused for another purpose that is incompatible with the original purpose, except a new consent is obtained.

6.4 Data Minimization

• Cedric Masters limits Personal Data collection and usage to data that is relevant, adequate, and absolutely necessary for carrying out the purpose for which the data is processed.
• Cedric Masters will evaluate whether and to what extent the processing of personal data is necessary and where the purpose allows, anonymized data must be used.

6.5 Integrity and Confidentiality

• Cedric Masters shall establish adequate controls in order to protect the integrity and confidentiality of Personal Data, both in digital and physical format, and to prevent personal data from being accidentally or deliberately compromised.
• Personal data of Data Subjects must be protected from unauthorized viewing or access and from unauthorized changes to ensure that it is reliable and correct.
• Any personal data processing undertaken by an employee who has not been authorized to carry out such as part of their legitimate duties is unauthorized.
• Employees may have access to Personal Data only as is appropriate for the type and scope of the task in question and are forbidden to use Personal Data for their own private or commercial purposes or to disclose them to unauthorized persons, or to make them available in any other way.
• Human Resources Department must inform employees at the start of the employment relationship about the obligation to maintain personal data privacy. This obligation shall remain in force even after employment has ended.

6.6 Personal Data Retention

All personal information shall be retained, stored and destroyed by Cedric Masters Ltd in line with legislative and regulatory guidelines. For all Personal Data and records obtained, used and stored within the Company, Cedric Masters shall perform periodical reviews of the data retained to confirm the accuracy, purpose, validity and requirement to retain.

To the extent permitted by applicable laws and without prejudice to the Cedric Masters Ltd Document Retention Policy, the length of storage of Personal Data shall, amongst other things, be determined by:

1. athe contract terms agreed between the Company and the Data Subject or as long as it is needed for the purpose for which it was obtained; or
2. bwhether the transaction or relationship has statutory implication or a required retention period; or
3. cwhether there is an express request for deletion of Personal Data by the Data Subject, provided that such request will only be treated where the Data Subject is not under any investigation which may require the Company to retain such Personal Data or there is no subsisting contractual arrangement with the Data Subject that would require the processing of the Personal Data; or
4. dwhether the Company has another lawful basis for retaining that information beyond the period for which it is necessary to serve the original purpose.

Notwithstanding the foregoing and pursuant to the NDPR, the Company shall be entitled to retain and process Personal Data for archiving, scientific research, historical research or statistical purposes for public interest.

The Company would forthwith delete Personal Data in the Cedric Masters Ltd possession where such Personal Data is no longer required by the Company or in line with the Cedric Masters Ltd Retention Policy, provided no law or regulation being in force requires the Company to retain such Personal Data.

6.7 Accountability

The Company demonstrates accountability in line with the NDPR obligations by monitoring and continuously improving data privacy practices within the Company.

Any individual or employee who breaches this Privacy Policy may be subject to internal disciplinary action (up to and including termination of their employment); and may also face civil or criminal liability if their action violates the law.

When a potential breach has occurred, Cedric Masters will investigate to determine if an actual breach has occurred and the actions required to manage and investigate the breach as follows:

1. aValidate the Personal Data breach.
2. bEnsure proper and impartial investigation (including digital forensics if necessary) is initiated, conducted, documented, and concluded.
3. cIdentify remediation requirements and track resolution.
4. dReport on findings, to top management.
5. eCoordinate with appropriate authorities as needed.
6. fCoordinate internal and external communications.
7. gEnsure that impacted Data Subjects are properly notified, if necessary.

Cedric Masters does not enter into relationships with minors (persons under the age of 18). We do not knowingly collect personally identifiable information from anyone under the age of 18. If you are a parent or guardian and you are aware that your children have provided us with Personal Data, please contact us. If we become aware that we have collected Personal Data from children without verification of parental consent, we will take steps to remove that information from our servers.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Policy, unless a longer retention period is required or permitted by law (such as tax, accounting or other legal requirements). Upon request for account closure, your account will be closed but this closure will not involve deletion of historical records of the account for the reasons already stated. However, except as may be required by law or law enforcement agents and/or regulators, further processing of the personal information related to the account will cease from the time of closure.

In some regions (like the European Economic Area), you have certain rights under applicable data protection laws. These may include the right:

• to request access and obtain a copy of your personal information;
• to request rectification or erasure;
• to restrict the processing of your personal information; and
• if applicable, to data portability.

In certain circumstances as stated in section 2.8 of the Nigeria Data Protection Regulation, you may also object to the processing of your personal information. To make such a request, please use the contact details provided below. We will consider and act upon any request in accordance with applicable data protection laws.

If we are relying on your consent to process your personal information, you have the right to withdraw your consent at any time. Please note however that this will not affect the lawfulness of the processing before its withdrawal.

If you are resident in the European Economic Area and you believe we are unlawfully processing your personal information, you also have the right to complain to your local data protection supervisory authority. You can find their contact details here: edpb.europa.eu/about-edpb/board/members_en

Account Information

If you would at any time like to review or change the information in your account with the company or terminate our services, you can contact us using the contact information provided below.

Cookies and Similar Technologies

Most web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove cookies and to reject cookies. If you choose to remove cookies or reject cookies, this could affect certain features of our services to you. To opt-out of interest-based advertising by advertisers on our services visit aboutads.info/choices.

Opting Out of Email Marketing

You can unsubscribe from our marketing email list at any time by clicking on the unsubscribe link in the emails that we send or by contacting us using the details provided below. You will then be removed from the marketing email list. However, we will still need to send you service-related emails that are necessary for the administration and use of your account. To otherwise opt-out, you may:

• note your preferences when you register or apply for a quote within the site;
• access your account settings and update preferences; or
• contact us using the contact information provided.

We do not use any automated processing systems for coming to specific decisions, including profiling.

The Company shall ensure that employees who collect, access and process Personal Data receive adequate data privacy and protection training in order to develop the necessary knowledge, skills and competence required to effectively manage the compliance framework under this Privacy Policy and the NDPR with regard to the protection of Personal Data. On an annual basis, the Company shall develop a capacity building plan for its employees on data privacy and protection in line with the NDPR.

The Company shall appoint a Data Protection Officer(s) (DPO) responsible for overseeing the Company’s data protection strategy and its implementation to ensure compliance with the NDPR requirements. The DPO shall be a knowledgeable person on data privacy and protection principles and shall be familiar with the provisions of the NDPR. The main tasks of the DPO include:

• Administering data protection policies and practices of Cedric Masters Ltd
• Monitoring compliance with the NDPR and other data protection laws, data protection policies, awareness-raising, training, and audits
• Advising the business, management, employees and third parties who carry on processing activities of their obligations under the NDPR
• Acting as a contact point for Cedric Masters Ltd
• Monitoring and updating the implementation of the data protection policies and practices of Cedric Masters and ensuring compliance amongst all employees of Cedric Masters Ltd
• Ensuring that Cedric Masters undertakes a Data Protection Impact Assessment and curbs potential risk in Cedric Masters data processing operations; and maintains a database of all Cedric Masters personal data collection and processing operations of Cedric Masters

The Company shall conduct an annual data protection audit through a licensed Data Protection Compliance Organization (DPCO) to verify Cedric Masters Ltd compliance with the provisions of the NDPR and other applicable data protection laws. The audit report will be certified and filed by the DPCO to NITDA as required under the NDPR.

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and making it available at our locations.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

If you have any questions or comments about this policy, you may contact our Data Protection Officer (DPO) by email at Compliance@cedricmasters.com or by post to:

If you have any further questions or comments about us or our policies, email us at info@cedricmasters.com or by post to: