Privacy policy

Who we are

Edderton Scott Consulting Ltd (“we”, “us”) is a business systems and automation company registered in Nigeria. We are the data controller of the personal data described here, and we handle it under the Nigeria Data Protection Act 2023 (NDPA). We work remotely, so some of our team may access data from outside Nigeria (see “Where your data is kept”). To contact us about your data, use the request form below.

What we collect, and why

When you contact us or fill in a form

Your name, work email, company, role, and anything you tell us about your business (such as turnover band, team size and the problem you want solved). We use it to reply, to decide whether we can help, and to arrange calls. Lawful basis: our legitimate interest in responding to business enquiries, or steps you ask us to take before entering a contract.

When you book a call

Your booking details and any notes you add. We use them to hold the appointment, send confirmations and reminders, and prepare. Lawful basis: performing a contract or taking steps at your request.

When you pay us

We send invoices through your client portal, and you pay on the secure page of Paystack (card, bank transfer or USSD). You can also pay by bank transfer straight to our account.

• What we share with them: what they need to take the payment, such as your name, email address, company, the invoice number and the amount.
• What we never see: your card or bank details. You enter them on the provider’s own page, and they never reach us or our client portal.
• What they tell us: whether the payment worked, their reference for it, and, if you agree to save a card with Paystack, a short label such as “Visa ending 4081”. We use a saved card only for the payments your agreement sets out, and we tell you before we take one. You can remove it in your portal at any time.
• Their own use: Paystack also uses your details for its own purposes, such as preventing fraud, keeping payments secure and meeting its legal duties. For that, it’s responsible for your data itself, under its own privacy policy.
• Withholding tax: if your organisation deducts withholding tax and sends us a credit note, we keep it with the invoice it relates to.

We keep invoices, payments, tax records and their references with your client records for at least 6 years, as Nigerian accounting and tax law requires. Lawful basis: performing our contract with you, our legal obligations (accounting and tax records), and our legitimate interest in preventing fraud.

When you respond to our ads

If you submit a lead form on LinkedIn or Facebook/Instagram, the platform passes us the details you chose to share. We use them as described under “When you contact us”.

If we contacted you first

We research businesses we think we could help, using publicly available sources (company websites, LinkedIn, the Corporate Affairs Commission register, job adverts) and business-contact data providers. We may hold your name, role, work email and company, and a note of why we got in touch. Lawful basis: our legitimate interest in offering relevant services to organisations. We contact a small number of businesses directly, never more than three times, and every message lets you opt out. Our emails link to a short page on this site made for your business; it uses what we already hold (your name, company and why we got in touch) to fill in your free preview for you, and it tells us when someone has looked at it, so we can stop emailing and reply in person instead. We use your website's public text to help write our message, and we write those emails with the help of an AI service that processes data for us under contract. If you ask us to stop, we will, and we keep only enough to make sure we don't contact you again.

If you ask to see your system

Your name, work email, company, role and website if you give it, and your answers about your business: what it does, the tools you use, your team size and salary band, where time goes, and what you’d most like fixed. We first email you a link to confirm your address; if you don’t confirm it within 48 hours, everything is deleted.

Once confirmed, we use your answers to build your preview, with the help of an AI provider (such as OpenAI or Anthropic), which receives your answers but not your email address. Someone from our team may check the preview before it’s sent. Your preview lives at a private link that isn’t listed or indexed anywhere, and the link works for 14 days after we send it. We keep a copy of the preview and your answers as a record of your enquiry, in our website and our internal client system, until you ask us to delete them or we no longer need them (see “How long we keep it”). We keep a record of the enquiry itself (your contact details, company, the estimate and what you’d like fixed) as described under “How long we keep it”.

We email you about your preview: when it’s ready, and a few short follow-ups while it’s open and for a while after, such as a reminder to look, ideas relevant to your business, a note before the link closes, and the occasional check-in. To make these useful rather than generic, we note how you use your preview (when you open it, which parts you look at and for how long, and whether you press the button to talk to us), and our AI provider helps us write the follow-ups from your answers and that activity. We never sell this or use it for advertising. Every email lets you unsubscribe in one click, and the follow-ups stop as soon as you book a call, reply to us, or ask us to stop. If you add your logo, we use it only to show on your preview. Lawful basis: steps you ask us to take, and our legitimate interest in following up an enquiry you made.

Keeping out spam and bots (Cloudflare Turnstile)

Our forms, the booking calendar, the chat’s “leave your details” step and our sign-in pages use Cloudflare Turnstile to check that a person, not an automated program, is sending them. It usually works invisibly. To do this, Cloudflare processes technical signals from your browser and device, such as your IP address, browser (User-Agent) details and connection characteristics, and the site you’re on. Cloudflare uses these signals to tell people from bots and to improve that check; it does not use them to identify you or to show you advertising. Lawful basis: our legitimate interest in keeping our site and your information safe from spam and abuse. How Cloudflare handles this data is set out in the Cloudflare Turnstile Privacy Addendum and Cloudflare’s Privacy Policy.

Cookies

See our cookie policy. Marketing cookies are only set if you accept them. How you can use our website, your preview and your client portal is set out in our terms.

Who we share it with

Only the service providers that help us run the business: website hosting, email delivery, our internal client and project system (the Edderton Scott Platform), our payment provider (Paystack, see above), automation tools that move enquiries into our systems, Cloudflare (to protect our forms and sign-in from bots, see above), an AI provider (such as OpenAI or Anthropic) that helps build the system preview you ask for and write our own call notes, and (only if you consent to marketing cookies) LinkedIn and Meta. People we send to help on site (for example, to scan paper records) sign a confidentiality and data-handling agreement with us first. We never sell personal data.

Where your data is kept

Our website, our client portal and the systems we build for clients are hosted with Nigerian hosting companies, so your records are held in Nigeria. A few of the services listed above (such as email delivery, Cloudflare and our AI provider) process data outside Nigeria, and our team works remotely, partly from the United Kingdom. Where data leaves Nigeria, we only allow it on the grounds the NDPA permits, such as the receiving country’s adequate level of protection, appropriate contractual safeguards, or your consent, and we only send what the task needs.

How long we keep it

• System previews and the answers behind them: the link works for 14 days; we keep a copy with your enquiry, as below, unless you ask us to delete it sooner (48 hours in total if you never confirm your email).
• Enquiries that don't become work: up to 24 months, then deleted.
• Outreach research with no reply: up to 12 months.
• Client and billing records: 6 years after the engagement ends, as required for accounting.
• Consent records: as long as needed to show your cookie choices were respected.

Your rights

Under the NDPA you can ask to see the data we hold about you, correct it, delete it, restrict or object to how we use it (including any direct marketing, at any time), receive a copy to take elsewhere, withdraw any consent you have given, and not be subject to a decision made only by automated means that significantly affects you. Use the form below. We'll respond promptly, and within 30 days.

If you're unhappy with how we've handled your data, you can complain to the Nigeria Data Protection Commission at ndpc.gov.ng, though we'd appreciate the chance to put it right first.

Make a request

Leave this empty

Name The email address we have for you What would you like us to do? See my data Correct my data Delete my data Stop marketing / object Copy of my data Something else Anything that helps us find your data (optional)

Send my request