Privacy Policy

1. Who we are and what this policy covers

DISCOVERYHUB LTD, trading as DiscoveryTech Hub ("we", "us", "our") is an ICT training and digital services company based in Abuja, Nigeria. We are the data controller for personal data collected through:

• our main website, discoverytechhub.com, including our quote, contact, booking, review and waitlist forms;
• DiscoveryTech Academy at academy.discoverytechhub.com, and the Academy pages on our main site;
• our blog and any other discoverytechhub.com subdomain that links to this policy.

This policy explains what personal data we collect, why we collect it, who we share it with, and the choices and rights you have. It applies to visitors, clients, Academy learners and anyone who contacts us.

2. The laws we follow

We handle personal data in line with the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Commission's (NDPC) General Application and Implementation Directive 2025 (GAID), and other applicable Nigerian law.

If you are in the European Economic Area or the United Kingdom, we also respect the rights the GDPR and UK GDPR give you, as described in this policy. If another privacy law applies to you (for example in California), you may have additional rights. Contact us and we will honour them as the law requires.

3. Personal data we collect

Information you give us.

• Enquiries, quotes and bookings: name, email address, phone number, company name, and the details you include about your project or hall booking.
• Academy waitlist: name and email address.
• Academy account: name, email address and password (passwords are stored in hashed form by our authentication provider; we cannot read them). If you choose Sign in with Google, we receive your name, email address and profile picture from Google.
• Academy activity: your course progress, completed lessons and tasks, and anything you submit to us.
• Reviews and testimonials: your name, rating, review text and, if you provide one, a photo.
• Messages: the content of emails and WhatsApp messages you send us.

Information collected automatically.

• Device and browser type, operating system, IP address (from which we can infer approximate location), pages viewed, time spent, and the site that referred you.
• Cookie and local-storage data described in the "Cookies and similar technologies" section.

We do not intentionally collect sensitive personal data (such as health, religion, biometric or political information). Please do not send it to us.

4. How we use your data and our lawful bases

We only use personal data where we have a lawful basis to do so:

• Responding to enquiries, preparing quotes and handling bookings: to take steps you ask for before entering a contract, and for our legitimate interest in running our business.
• Providing your Academy account and learning experience (registration, sign-in, course access, progress tracking, password resets, service emails): to perform our agreement with you.
• Marketing and Academy updates (newsletters, waitlist announcements, new course launches): with your consent. You can withdraw it at any time using the unsubscribe link or by emailing us.
• Analytics and improving our website and courses: with your consent where the law requires it, and otherwise our legitimate interest in understanding how our services are used.
• Displaying reviews and testimonials: with your consent when you submit them.
• Security, fraud prevention and keeping our services working: our legitimate interests.
• Meeting legal obligations: such as tax, accounting and regulatory requirements.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

5. Cookies and similar technologies

Cookies are small files placed on your device. We also use your browser's local storage, which works in a similar way. We use:

• Essential and functional storage: to remember your light/dark theme, to remember your cookie choice, and to keep you signed in to the Academy. Where enabled, our security provider (Cloudflare) may also set cookies that help protect the site from bots and abuse.
• Analytics cookies: we use Google Analytics to understand which pages are visited and how people find us. This helps us improve our website and courses.

Where the law requires consent for non-essential cookies, we ask for it through our cookie banner. You can change your mind at any time by clearing this site's data in your browser settings (the banner will then appear again) or by blocking cookies in your browser. Google also offers a browser add-on to opt out of Google Analytics: tools.google.com/dlpage/gaoptout.

Blocking essential storage may stop some features, such as staying signed in to the Academy, from working properly.

6. Who we share your data with

We do not sell your personal data. We share it only with:

• Service providers that help us run our services: website hosting (Namecheap); website security, SSL encryption and DNS (Cloudflare), which means traffic to our website passes through Cloudflare's network and it processes technical data such as IP addresses; database and authentication (Supabase); email delivery for confirmation and password-reset emails (Resend); and analytics (Google Analytics).
• Google, if you choose Sign in with Google, under Google's own privacy policy.
• WhatsApp (Meta), if you contact us on WhatsApp, under WhatsApp's own terms and privacy policy.
• Professional advisers and authorities, where needed to protect our rights or to comply with the law, a court order or a regulator's request.
• A successor business, if we are ever involved in a merger, sale or restructuring. We will tell you and keep this policy's protections in place.

Where a provider acts as our data processor, we have contracts in place that require it to protect your data and use it only on our instructions.

7. International transfers

Some of our providers store or process data outside Nigeria. When we transfer personal data abroad, we make sure it is protected by safeguards the NDPA allows, such as an adequate level of protection in the destination country or appropriate contractual protections. For visitors in the EEA or UK, we rely on equivalent safeguards such as standard contractual clauses where required.

8. How long we keep your data

We keep personal data only for as long as we need it for the purposes above:

• Academy accounts: while your account is open, and then deleted or anonymised within 90 days of closure.
• Enquiries, quotes and bookings: up to 3 years after our last contact, so we can follow up and handle any queries or disputes.
• Marketing and waitlist data: until you unsubscribe or withdraw your consent.
• Financial records: for the period required by Nigerian tax and accounting law.

Backups are overwritten on a regular cycle, so deleted data may persist briefly in them.

9. How we protect your data

We use measures appropriate to the risk, including HTTPS encryption in transit, hashed passwords and access controls. No system is completely secure, so we cannot guarantee absolute security.

If a personal data breach is likely to put your rights and freedoms at risk, we will notify the NDPC within 72 hours of becoming aware of it, and we will tell affected individuals without undue delay where the law requires it.

10. Your rights

Under the NDPA (and the GDPR/UK GDPR where they apply) you have the right to:

• be informed about how your data is used (this policy);
• access the personal data we hold about you and get a copy;
• have inaccurate or incomplete data corrected;
• have your data erased, where the law allows;
• restrict or object to certain processing, including processing for direct marketing;
• receive your data in a portable format;
• withdraw consent at any time, without affecting processing that already took place;
• not be subject to decisions based solely on automated processing with significant effects.

To exercise any of these rights, email [email protected]. We may need to verify your identity first. We will respond without undue delay and in any event within one month, and we will tell you if we need longer.

If you are unhappy with how we handle your data, please contact us first so we can try to put it right. You also have the right to complain to the Nigeria Data Protection Commission (ndpc.gov.ng) or, if you are in the EEA or UK, to your local data protection authority.

11. Children's privacy

Our website and the Academy are not directed at children under 18. Under Nigerian law a child's personal data needs the consent of a parent or guardian. If you are under 18, please do not use the Academy or send us personal data without a parent or guardian's consent. If we learn that we hold a child's data without proper consent, we will delete it.

12. Links to other websites

Our website links to third-party sites and social platforms (for example Facebook, X, LinkedIn, Instagram and TikTok). We do not control them and are not responsible for their privacy practices. Please read their policies before sharing personal data with them.

13. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top shows when it last changed. If we make a material change, we will tell you through the website or by email.

14. Contact us

For any question about this policy, or to exercise your rights, contact our data protection contact: