NDPA Compliance

Our status and registration

We act as a data controller for the personal data we collect through obana.africa and our related services, and as a data processor where we handle data on behalf of a vendor, supplier or partner under contract.

Our registration with the Commission is valid from 21 July 2026 to 21 July 2027, and we renew it before it lapses.

As a data controller of major importance, we file the annual compliance audit return required by the NDPA within the timeframe set by the Commission.

The principles we apply

Section 24 of the NDPA requires that personal data be handled to a set of standards. In practice that means we:

• process data fairly, lawfully and transparently, and tell you at the point of collection what we are doing;
• collect it for specified, legitimate purposes and do not reuse it for something incompatible with those purposes;
• keep it adequate, relevant and limited to what the purpose needs — our forms ask only for what a quote, booking or enquiry actually requires;
• keep it accurate and up to date, and correct it when you tell us it is wrong;
• retain it no longer than necessary, subject to tax, customs and accounting obligations; and
• apply appropriate security against loss, destruction and unauthorised access.

We also apply data protection by design and default: new forms and integrations are reviewed for what they collect, who receives it and how long it is kept before they go live.

Lawful bases under the NDPA

Under section 25 of the NDPA we process personal data only where one of the following applies:

• Consent — freely given, specific, informed and unambiguous, and withdrawable at any time;
• Contract — processing necessary to perform a contract with you or take pre-contract steps you have requested;
• Legal obligation — tax, customs, accounting and regulatory requirements;
• Vital interests — to protect life, in the rare cases that arises;
• Public interest or official authority — where a lawful request requires it; or
• Legitimate interests — where these are not overridden by your rights and freedoms, such as fraud prevention and securing our platform.

How we handle consent

Where we rely on consent — newsletters and marketing, chiefly — we ask for it separately from other terms, we do not use pre-ticked boxes, and we do not make a service conditional on consent you do not need to give.

You can withdraw consent at any time using the unsubscribe link in any marketing email or by writing to contact@obana.africa. Withdrawal does not affect processing carried out before you withdrew.

Your rights as a data subject

Sections 34 to 37 of the NDPA give you rights over your personal data. You may:

• Be informed — know who is processing your data, why, and who receives it;
• Access — obtain confirmation and a copy of the data we hold about you;
• Rectify — have inaccurate or incomplete data corrected;
• Erase — have data deleted where we no longer have a lawful reason to keep it;
• Restrict — limit how we use your data while a dispute or accuracy question is resolved;
• Object — to processing based on legitimate interests, and to direct marketing at any time;
• Port — receive your data in a structured, commonly used, machine-readable format; and
• Not be subject to a decision based solely on automated processing that significantly affects you.

To exercise any of these, email contact@obana.africa with “NDPA request” in the subject line. We acknowledge requests promptly and respond within 30 days. We may ask you to verify your identity before we act, and we will tell you if an exemption means we cannot fully comply.

Exercising your rights is free unless a request is manifestly excessive or repetitive.

Data Protection Officer

We have designated a Data Protection Officer responsible for monitoring compliance with the NDPA, advising on data protection impact assessments, and acting as the contact point for data subjects and the NDPC.

• Email: contact@obana.africa (mark it for the attention of the Data Protection Officer)
• Address: 77 Opebi Road, Ikeja, Lagos, Nigeria

Processors and third parties

Where we engage a processor — our CRM, email, file storage and hosting providers, and the suppliers and carriers who fulfil orders — the NDPA requires a written contract. Ours require the processor to:

• process personal data only on our documented instructions;
• apply appropriate technical and organisational security;
• impose confidentiality obligations on staff with access to the data;
• not engage a sub-processor without our authorisation, and pass these obligations down;
• assist us with data subject requests and breach notification; and
• delete or return the data when the engagement ends, unless the law requires retention.

We assess a provider’s security and data protection posture before onboarding them and review it periodically.

Cross-border transfers

Sections 41 to 43 of the NDPA govern transfers of personal data out of Nigeria. We transfer data only where one of the permitted grounds applies:

• the destination country provides an adequate level of protection as recognised by the Commission;
• the recipient is bound by legally enforceable contractual terms, binding corporate rules or an approved code of conduct;
• you have given explicit consent after being informed of the risks; or
• the transfer is necessary to perform a contract with you, or a contract concluded in your interest.

Before transferring, we satisfy ourselves that the recipient is subject to a regime affording adequate protection. You can request details of the safeguards applied to a specific transfer.

Security and breach notification

We apply technical and organisational measures proportionate to the risk, including encryption in transit, role-based access control, bot protection on public forms, and vetted infrastructure providers.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and inform affected data subjects without undue delay where the risk is high. We maintain an internal record of breaches and the remedial action taken.

Our NDPC Certificate

ICON Tech & E-Commerce Service Limited is registered with the Nigeria Data Protection Commission as a data controller / processor of major importance pursuant to Section 44 of the Nigeria Data Protection Act 2023, under registration ID NDPC/DCP/12998.

Complaints

If you believe we have handled your personal data in breach of the NDPA, please raise it with us first at contact@obana.africa. We take complaints seriously and will investigate and respond.

You also have the right to lodge a complaint directly with the Nigeria Data Protection Commission, and to seek a judicial remedy, at any time.