NDPR compliance.

1. Who we are

Zionstand Digital Technologies (“ZDT”), operating the STAXIS managed service, is based in Lagos, Nigeria. We handle personal data in two capacities:

• As a data controller — for the personal data of our own customers, contacts, and website visitors.
• As a data processor — for personal data inside systems we manage on behalf of a client, processed only on that client's documented instructions.

2. Applicable law

We aim to align with the Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act (NDPA) 2023, as administered by the Nigeria Data Protection Commission (NDPC).

3. What we collect

• Account data — name, work email, phone number, company details, and role.
• Billing data — subscription, invoice, and transaction records. Card details are handled by our payment processor; we do not store full card numbers.
• Support data — tickets, messages, and attachments you send us.
• Audit data — answers submitted through the public infrastructure audit.
• Technical data — logs and monitoring necessary to keep managed systems secure and available.

4. Lawful basis

• Contract — to deliver the service you subscribed to.
• Legitimate interest — to secure, monitor, and improve our services.
• Legal obligation — to meet tax, accounting, and regulatory duties.
• Consent — for marketing communications, which you can withdraw at any time.

5. How we protect it

• Encryption in transit; access restricted to staff who need it for their role.
• Authentication with session controls, and separation between client environments.
• Monitoring and logging, with an escalation path for suspected incidents.
• Staff bound by confidentiality obligations.

6. Sharing and third parties

We do not sell personal data. We share it only with processors needed to run the service — for example payment processing, email delivery, hosting, and the productivity platforms we manage on your behalf. Each is expected to provide protections consistent with this statement.

7. Retention

We keep personal data only as long as needed for the purpose collected, or as required by law. Account and billing records are retained for the statutory period; support and audit records are retained while they remain operationally relevant and then deleted or anonymised.

8. Your rights

Subject to law, you may exercise the following rights free of charge:

• Access — Ask what personal data we hold about you and get a copy.
• Rectification — Have inaccurate or incomplete data corrected.
• Erasure — Ask us to delete your data where we have no lawful basis to keep it.
• Restriction — Ask us to pause processing while a concern is resolved.
• Portability — Receive your data in a structured, commonly used format.
• Objection — Object to processing carried out on the basis of legitimate interest.
• Withdraw consent — Withdraw consent at any time, where consent is the basis we rely on.

To exercise any of these, email staxis@zionstand.com. We aim to respond within 30 days. If a request is made on behalf of a client whose systems we manage, we will refer it to that client as the controller.

9. Breach response

If we become aware of a personal data breach, we investigate immediately, contain it, and notify affected clients without undue delay, along with the regulator where the law requires it. Clients receive the facts we have, the impact, and the remediation steps taken.

10. Data Processing Agreements

Where we act as a processor, we can enter a Data Processing Agreement setting out scope, instructions, security measures, sub-processors, and breach obligations. Formal NDPR compliance reporting is also available as an add-on for managed clients.

11. Contact

For any data protection question, or to request our DPA, email staxis@zionstand.com or get in touch. You also have the right to lodge a complaint with the Nigeria Data Protection Commission.