Privacy Policy
1. Who we are and what this policy covers
The Workplace Consult (“TWC”, “we”, “us”, “our”) is a human resources consultancy registered with the Corporate Affairs Commission of Nigeria (registration number 7823694), with its office at 28 Obanikoro Street, Obanikoro, Lagos. We provide HR technology advisory, HRIS reselling and implementation, performance management, organisational effectiveness, quality-management (ISO 9001) advisory, and training and facilitation services to organisations, mainly SMEs and startups.
This Privacy Policy explains how we collect, use, share and protect personal data when you:
- visit theworkplaceconsult.org or any page that links to this policy (the “Website”);
- respond to our adverts, including LinkedIn Lead Gen Forms and other social media or search ads;
- contact us, request a proposal, demo or consultation, or subscribe to our updates;
- attend our webinars, trainings, workshops or events;
- work with us as a client, a client’s employee, a vendor, partner or job applicant.
We process personal data in line with the Nigeria Data Protection Act 2023 (“NDPA”) and the General Application and Implementation Directive 2025 (“GAID”) issued by the Nigeria Data Protection Commission (“NDPC”). Where we process data of people outside Nigeria, we also apply the data protection laws that govern them where they apply to us.
Our role: controller and processor
For marketing, enquiries, events, recruitment for our own team and running our business, TWC decides how and why your data is used and is the data controller.
When we deliver consulting or HRIS implementation work, we often handle a client’s employee data (for example, staff records loaded into an HRIS, performance review data or survey responses) only on that client’s instructions. In those cases the client is the controller and TWC acts as a data processor under our contract with them. If you are an employee of one of our clients, your employer’s privacy notice is the main source of information about that processing, and requests about it should go to your employer first. We will help them respond.
2. Personal data we collect
Category | Examples | Where it comes from |
|---|---|---|
Contact and professional details | Name, job title, company, work email, phone number, city/country, company size, industry | You, via our Website forms, email, phone, events; LinkedIn Lead Gen Forms (pre-filled from your LinkedIn profile, which you can edit before submitting) |
Enquiry and service details | The service you are interested in (e.g. HRIS, performance management, ISO 9001), your HR challenges, budget range, timelines, messages you send us | You |
Client engagement data | Contract contacts, billing details, meeting notes, project documents, feedback | You and your organisation |
Client employee data (as processor) | Employee records, job and pay data, performance and appraisal data, survey or interview responses | Our client, under its instructions |
Event and training data | Registration details, attendance, questions, feedback, photos or recordings (we tell you beforehand when an event is recorded) | You, event platforms |
Job applicant data | CV, cover letter, work history, qualifications, references, interview notes | You, referees, recruitment platforms |
Website and ad data | IP address, device and browser type, pages visited, referring site, ad clicks and conversions, cookie identifiers | Your device, our analytics and ad partners (see section 5) |
Communications preferences | Marketing opt-ins and opt-outs | You |
We do not ask for sensitive personal data (such as health, religion, ethnicity or political opinion) through our Website or adverts. If a client engagement requires us to handle such data, we do so only on the client’s documented instructions and with extra safeguards.
Our services are aimed at businesses and professionals. We do not knowingly collect personal data from anyone under 18 through the Website or our adverts.
3. How we use your data and our lawful bases
Under section 25 of the NDPA and Articles 16 to 26 of the GAID, we must have a lawful basis for each use of your data. We rely on consent wherever the law requires it, including for direct marketing and for non-essential cookies (GAID Articles 18 and 19).
Purpose | Lawful basis |
|---|---|
Responding to enquiries, demo or proposal requests, including leads from LinkedIn Lead Gen Forms and other ad forms | Your consent (given when you submit the form) and steps you ask us to take before entering a contract |
Following up on a lead about the specific service or offer you responded to | Your consent; you can withdraw it at any time |
Sending newsletters, insights, event invitations and offers about our other services (direct marketing) | Your explicit opt-in consent; every email has an unsubscribe link |
Sharing your details with an HR software vendor for a demo, trial, quote or licence | Your explicit consent, asked for at the time |
Delivering consulting, HRIS implementation, training and advisory services; managing the client relationship; invoicing | Performance of our contract |
Processing client employee data on a client’s behalf | The client’s lawful basis, under a data processing agreement with them |
Registering and running events and trainings | Consent and/or performance of a contract |
Assessing job applicants for roles at TWC | Steps you ask us to take before a contract; consent if we keep your CV for future roles |
Website analytics, ad measurement and retargeting (non-essential cookies) | Your consent via our cookie banner |
Keeping the Website and our systems secure and preventing fraud | Our legitimate interests, assessed and documented in a Legitimate Interest Assessment |
Keeping accounting and tax records; responding to regulators, courts and lawful requests | Legal obligation |
Means of processing. We process personal data electronically, using our email and office software, CRM, cloud storage, accounting tools, video-conferencing and event platforms, and the HR software we implement for clients. Paper records (for example signed contracts or training attendance sheets) are kept securely and digitised where possible.
How we use LinkedIn Lead Gen Form data. When you submit a LinkedIn Lead Gen Form for a TWC advert, LinkedIn passes the details you submitted to us. We use them only to contact you about the offer or service named in that advert, to qualify whether our services suit your organisation, and, if you opted in, to send you related updates. We store these leads in our customer relationship management (CRM) and email tools, and we do not sell them.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
4. Who we share your data with
We share personal data only where needed for the purposes above:
- HR software vendors we resell or implement. When you ask for a demo, trial, quote or licence for an HRIS or HR software product we represent (for example SeamlessHR or Zoho), we ask for your explicit consent and then share your contact and organisation details with that vendor so it can set up your account, issue licences and support you. Once your organisation subscribes, the vendor’s own privacy policy and terms govern its processing of your data.
- Service providers acting for us. Email and office software, CRM, cloud storage, website hosting, payment and invoicing, video-conferencing and event platforms, analytics and advertising partners. They process data only on our instructions and under confidentiality and security obligations.
- Associates and subcontractors. Independent consultants or facilitators who help deliver an engagement, bound by confidentiality.
- Professional advisers. Lawyers, auditors and accountants.
- Authorities. Regulators, courts or law enforcement where the law requires it, or to protect our rights, our clients or the public.
- Business transfers. A buyer or successor if TWC is merged, restructured or sold, subject to this policy.
We do not sell personal data, and we do not share client employee data with anyone except as our client instructs.
International transfers
Some of our service providers and software vendors store data on servers outside Nigeria (for example in the EU, UK, US or India). We transfer personal data outside Nigeria only in line with Part VIII (sections 41 to 43) of the NDPA and Article 45 of the GAID: to countries the NDPC recognises as providing adequate protection, or under appropriate safeguards such as binding contractual clauses. Where neither applies, we ask for your consent before the transfer, as GAID Article 18 requires, and explain the possible risks.
5. Cookies, analytics and advertising
Our Website uses cookies and similar technologies:
- Strictly necessary cookies keep the Website working and secure. They do not need consent.
- Analytics cookies (for example Google Analytics) tell us how visitors use the Website so we can improve it.
- Advertising cookies and pixels (for example the LinkedIn Insight Tag and Meta Pixel) measure how our adverts perform, report conversions, and let us show relevant TWC adverts to people who have visited our Website or engaged with our forms. LinkedIn may use this data in line with its own privacy policy.
TWC is the organisation responsible for the cookies set on this Website. When you first visit, a cookie banner appears prominently on the screen, without you needing to scroll, and gives you a clear choice to Accept or Reject non-essential cookies. We only set analytics and advertising cookies if you accept. You can withdraw or change your consent at any time through the “Cookie settings” link in the Website footer, or by clearing cookies in your browser. You can also manage ad preferences in your LinkedIn account settings.
Our Website may link to other sites, including vendor and partner sites. We are not responsible for their privacy practices, so please read their policies.
6. How long we keep your data
We keep personal data only as long as the purpose requires. In line with GAID Articles 21(2) and 49(3), once a purpose is accomplished, or a prospective contract does not go ahead, we delete the data within 6 months unless we need it to defend a legal claim or the law requires us to keep it longer.
Data | Retention |
|---|---|
Leads and enquiries that do not become clients | Deleted within 6 months of our last interaction, unless you have opted in to our updates |
Marketing subscribers | Until you unsubscribe or withdraw consent; we then keep only a minimal suppression record so we do not contact you again |
Client contract, billing and engagement records | Duration of the engagement plus 6 years, for tax, accounting and limitation-period purposes |
Client employee data (as processor) | Returned or deleted at the end of the engagement, as the client instructs in our data processing agreement |
Unsuccessful job applicants | Deleted within 6 months after the role is filled, unless you consent to us keeping your CV for future roles (then up to 12 months) |
Event registration data | Deleted within 6 months after the event, except records needed for certificates of attendance or invoicing |
7. How we protect your data
We use appropriate technical and organisational measures, including access controls and strong passwords, multi-factor authentication on key systems, encryption in transit, reputable cloud providers, confidentiality agreements with staff and associates, and limiting access to people who need it. No system is completely secure. If a personal data breach is likely to put your rights at risk, we will notify the NDPC within 72 hours of becoming aware of it and inform you where the law requires.
8. Your rights
Under the NDPA you have the right to:
- be informed about how we use your data;
- access the personal data we hold about you and get a copy;
- have inaccurate or incomplete data corrected;
- have your data deleted where we no longer need it or have no lawful basis to keep it;
- restrict or object to our processing, including objecting to direct marketing at any time;
- receive your data in a commonly used, machine-readable format (data portability);
- withdraw consent at any time, without affecting processing done before you withdrew;
- not be subject to decisions based solely on automated processing with significant effects;
- lodge a complaint with the Nigeria Data Protection Commission (ndpc.gov.ng).
Portability applies to data you gave us on the basis of consent or contract (GAID Article 37). Correcting an error we made will never cost you anything.
To use any of these rights, or to raise a complaint, contact us using the details in section 9. You may also use the NDPC’s Data Subject’s Standard Notice to Address Grievance (SNAG). We may need to verify your identity. We will acknowledge your request promptly and aim to resolve it within 30 days. You do not have to contact us first before complaining to the NDPC or going to court.
9. Contact us
Nelson Dominic, Principal, The Workplace Consult
Email: info@theworkplaceconsult.com (subject line: “Privacy request”)
Post: 28 Obanikoro Street, Obanikoro, Lagos, Nigeria
10. Changes to this policy
We may update this policy when our services, tools or the law change. We will post the updated version on this page with a new effective date and, where changes are significant, tell you by email or a notice on the Website.
