Legal
Privacy Notice
How Blaecwood Systems Limited collects, uses, shares, transfers and retains personal data through this website, the booking flow on it and the NDPA classification tool, and what you can require of us under the Nigeria Data Protection Act 2023.
Last updated 1 September 2026.
1. Who we are and how to reach us
Blaecwood Systems Limited is the data controller for the personal data described in this notice. We are a company incorporated in Nigeria, licensed by the Nigeria Data Protection Commission as a Data Protection Compliance Organisation.
- Controller: Blaecwood Systems Limited
- Registration number: RC 9229729
- DPCO licence reference: NDPC/DPCO/17469
- Registered office: Lagos, Nigeria
- Data protection enquiries: privacy@blaecwood.com
Data protection enquiries are handled through the role-based address above rather than by a named individual, so that a request reaches us whoever is on duty. Please use it for any request under this notice.
2. What this notice covers
This notice covers personal data we process as a controller through blaecwood.ng, the booking flow reachable from it, and the NDPA classification tool at ndpa.blaecwood.ng.
It does not cover personal data we process on a client's behalf during an engagement. In that work we normally act as a processor, and the client's own privacy notice governs it. Our contract with that client sets out how we handle it.
3. The personal data we collect
3.1 Through the website
When you load a page, our hosting infrastructure receives technical data needed to deliver it and to keep it secure. That includes your IP address, the date and time of the request, the pages requested, the referring page where one is sent, and your browser and device type.
Each page also requests the Inter typeface from Google Fonts. That request is made by your browser directly to Google and discloses your IP address and browser details to Google. If you would rather not make that request, blocking third-party font requests in your browser will not prevent the site from working.
On the NDPA CAR filing campaign page, Meta Pixel is available for campaign measurement but is not requested unless you accept analytics and advertising cookies. After acceptance, Meta receives technical request data and the campaign events described in our Cookie Notice, including page views, video engagement and booking activity. We do not send the contents of the Cal.com booking form, your name or your email address from this page to Meta.
3.2 Through the booking flow
Nothing is requested from our booking provider while you are simply reading the site. The booking calendar loads only when you select a booking control, and until you do, no request is made to it and it stores nothing on your device.
Once you open the calendar and make a booking, you provide your name, email address, time zone, your chosen date and time, and anything you enter in the booking form, such as the reason for the call. We receive the booking and the calendar entry that follows from it.
3.3 Through the NDPA classification tool
The tool at ndpa.blaecwood.ng is a short self-classification check. It takes the answers you give about your organisation, which are organisational rather than personal in nature, together with the contact details you provide in order to receive your result. We do not ask for, and you should not enter, personal data about any other individual in the tool.
3.4 Direct correspondence
If you email us, or reply to a message from us, we hold that correspondence and whatever you choose to include in it.
4. Purpose and lawful basis
We rely on the lawful bases set out in section 25 of the Nigeria Data Protection Act 2023. The table below sets out each purpose, the data involved and the basis we rely on.
| Purpose | Personal data | Lawful basis |
|---|---|---|
| Serving the website and keeping it available and secure | Server log data, IP address, request and device data | Legitimate interests in operating and securing our own website, section 25(1)(f) |
| Rendering the site in its intended typeface | IP address and browser data disclosed to Google when the font is requested | Legitimate interests in consistent, legible presentation, section 25(1)(f) |
| Measuring and improving the NDPA CAR filing advertising campaign | Page URL, referrer, browser and device data, IP-derived connection data, Meta identifiers where present, and campaign interaction events | Your consent, section 25(1)(a), which you may withdraw at any time |
| Loading the booking calendar when you ask for it | Connection data your browser sends to the booking provider when you open the calendar | Steps taken at your request prior to entering a contract, section 25(1)(b) |
| Scheduling, confirming, rescheduling and holding the call you book | Name, email address, time zone, chosen date and time, anything entered in the booking form | Steps taken at your request prior to entering a contract, section 25(1)(b) |
| Returning your NDPA classification result and answering any question about it | Contact details you submit to receive the result, and your answers | Your consent, section 25(1)(a), which you may withdraw at any time |
| Replying to enquiries and correspondence | Your message and contact details | Legitimate interests in responding to people who contact us, section 25(1)(f) |
| Agreeing and performing an engagement | Contact and business details of the people we deal with | Performance of a contract, section 25(1)(b) |
| Meeting our own obligations as a licensed DPCO and keeping the records that go with them | Engagement and correspondence records | Compliance with a legal obligation, section 25(1)(c) |
| Establishing, exercising or defending legal claims | Whichever of the above records is relevant to the claim | Legal obligation under section 25(1)(c), and legitimate interests in protecting our position, section 25(1)(f) |
Where we rely on legitimate interests, we have weighed that interest against your rights and freedoms and have recorded that assessment. You can object to that processing, and we explain how in section 9.
Meta Pixel measurement on the campaign page is optional. Rejecting or withdrawing consent does not prevent you from viewing the page, playing the video or completing a booking. See the Cookie Notice for the event list and how to revise your choice.
5. Who receives your personal data
We do not sell personal data. If you accept campaign measurement, Meta Platforms receives the technical and interaction data described above for advertising measurement under Meta's own terms and privacy information.
Personal data described in this notice is disclosed to the following categories of service provider, each engaged as our processor:
- Cloud hosting and content delivery, which serve this website and receive the server log data described in section 3.1.
- Business email and calendar, which hold our correspondence with you and any calendar entry arising from a booking.
- Scheduling, which operates the booking calendar and receives the booking details you enter.
- The infrastructure supporting the NDPA classification tool, which holds the submissions described in section 3.3.
Meta is an additional recipient only when you accept the optional campaign measurement. It is not included in the processor list above, and we do not represent that Meta acts only on our instructions.
Each of these providers is engaged under contractual terms requiring appropriate security and confidentiality, permitting them to process personal data only on our documented instructions, and requiring them to assist us in meeting our obligations under the Act.
We also disclose personal data to our professional advisers where we need advice on a matter it concerns, and to a regulator, court or law enforcement authority where we are required to do so by law or in order to establish or defend a legal claim.
6. How long we keep personal data
We retain personal data only for as long as necessary for the purpose it was collected, and thereafter for any period required by applicable law, professional obligation or the defence of legal claims.
Enquiry and booking records are retained while the relationship is active and for a reasonable period afterwards. Engagement records are retained in line with contractual and regulatory requirements.
When personal data is no longer needed for any of those purposes, it is deleted or anonymised.
7. Transfers of personal data outside Nigeria
Some of the providers described in section 5 operate outside Nigeria, so personal data covered by this notice may be transferred and processed outside the country.
Transfers are made where necessary for the performance of our services and are subject to contractual safeguards requiring an adequate level of protection, consistent with the transfer provisions of the Nigeria Data Protection Act 2023.
You may ask us for further detail about the safeguards applying to a particular transfer using the contact address in section 1.
8. How we protect personal data
We apply technical and organisational measures appropriate to the risk to the personal data we hold. These include access control, encryption of data in transit and at rest with our providers, restriction of access to those who need it for their role, logging and review of administrative activity, and assessment of the security practices of the providers we engage.
No system is perfectly secure, and we do not claim otherwise. Where a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and will inform you directly where the Act requires it.
9. Your rights under the NDPA
As a data subject you hold the following rights in respect of the personal data we hold about you:
- Access. You can ask whether we hold personal data about you, and if we do, obtain a copy of it together with information about the purposes, the recipients and the source.
- Rectification. You can ask us to correct personal data that is inaccurate, and to complete data that is incomplete.
- Erasure. You can ask us to delete personal data where it is no longer necessary for the purpose we collected it, where you withdraw the consent we relied on, or where you object and we have no overriding ground to continue.
- Restriction. You can ask us to pause processing while an accuracy dispute or an objection is being resolved.
- Objection. You can object at any time to processing based on our legitimate interests. We will stop unless we can show a compelling legitimate ground that overrides your rights.
- Portability. Where processing is based on your consent or on a contract and is carried out by automated means, you can ask for the personal data you provided in a structured, commonly used, machine-readable format, and ask us to transmit it to another controller where that is technically feasible.
- Withdrawal of consent. Where we rely on your consent, you can withdraw it at any time, and withdrawing it is as easy as giving it. Withdrawal does not affect the lawfulness of processing carried out before you withdrew.
- Automated decisions. We do not make decisions about you that produce legal or similarly significant effects on the basis of automated processing alone.
10. How to exercise your rights, and when we will respond
Send your request to privacy@blaecwood.com. Tell us which right you are exercising and what you want, and give us enough detail to identify your records and understand the request.
We will ask for enough information to satisfy ourselves that the request comes from you or from someone properly authorised to act for you. We ask for the minimum needed to do that, and we do not use identity evidence for anything else.
Our response time. We acknowledge requests promptly and respond substantively within 30 days of receiving a request we have been able to verify. Where a request is complex, or where you have made several, we may need longer. Where that happens we will tell you within the initial 30 day period, explain why, and give you a date. Where a shorter period applies under the Act or directions issued by the Commission, we apply the shorter period.
Exercising these rights is free. We may charge a reasonable administrative fee, or decline to act, only where a request is manifestly unfounded or excessive, and if we do, we will explain our reasoning and tell you how to challenge it.
11. Complaints to the Nigeria Data Protection Commission
We would rather hear from you first, because most issues are resolved fastest that way. But you are entitled to go straight to the regulator, and doing so does not affect any other remedy available to you.
You can lodge a complaint with the Nigeria Data Protection Commission at ndpc.gov.ng.
12. Changes to this notice
We review this notice at least annually and whenever something changes in what we collect, why we collect it, who receives it or how long we hold it. Where a change materially affects how we use personal data about you, we will bring it to your attention directly rather than rely on you rereading this page.
The date at the top of this notice is the date of the current version.
13. Related notices
Read this notice with the Cookie Notice, which explains what is and is not stored on your device, and the Terms of Use, which govern your use of this website.
Book a call
Choose a time below. The calendar is requested from Cal.com only once you ask for it, so nothing third party loads before then.
Loading the booking calendar.
Prefer a separate tab? Open the booking page on Cal.com.