Trust
Data Subject Request Process
Your personal data is about you.
If ANAKALICE DIGITAL LIMITED processes your personal data, you may have rights under the Nigeria Data Protection Act 2023 (NDPA), depending on the circumstances.
This page explains how to exercise those rights.
You do not need to understand Nigerian data protection law before making a request.
Simply tell us what you need.
1. What Can You Ask Us to Do?
Depending on the circumstances, you may ask us to:
- tell you whether we process your personal data;
- provide access to personal data we hold about you;
- explain how we use your personal data;
- correct inaccurate or incomplete personal data;
- delete personal data where you have a valid right to erasure;
- restrict certain processing;
- stop processing where you have a valid right to object;
- stop using your personal data for direct marketing;
- provide your data in a portable format where the right applies;
- allow you to withdraw consent where consent is the basis for processing; or
- address concerns about certain automated decision-making.
Not every request will apply in every situation.
Some rights have legal conditions or exceptions, and certain information may need to be retained because we are legally required or permitted to keep it.
2. How to Make a Request
Send your request to:
Privacy/Data Protection Email: info@anakalicedigital.com
Use the subject line:
Data Subject Request
You can write your request in your own words.
For example:
"I want to know what personal information Anakalice Digital holds about me."
or:
"Please correct the phone number associated with my information."
or:
"I object to my personal data being used for direct marketing."
You do not need to quote sections of the NDPA or use legal terminology.
3. What Information Should You Include?
To help us process your request, please provide:
Your name
The name you used when interacting with us.
Your contact information
An email address or other contact detail through which we can communicate with you.
Your request
Clearly tell us what you want us to do.
Relevant context
If possible, tell us which service, website, account, project, form submission or interaction your request relates to.
The more specific your request is, the easier it may be for us to locate the relevant information.
4. We May Need to Verify Your Identity
We have a responsibility to protect personal data from being disclosed to the wrong person.
For that reason, we may need to verify your identity before completing certain requests.
The verification information we request will depend on the nature and sensitivity of the request.
We will aim to use reasonable and proportionate verification rather than demanding unnecessary information.
For example, if you are asking us to provide personal data, we need to be reasonably satisfied that we are providing it to the person who is entitled to receive it.
5. What Happens After We Receive Your Request?
Once we receive your request, we will:
Step 1: Record the request
We will record the request and the date it was received.
Step 2: Identify what you are asking for
We will determine which data protection right or rights your request relates to.
If your request is unclear, we may contact you for clarification.
Step 3: Verify your identity where necessary
We may request reasonable information to confirm your identity before releasing or changing personal data.
Step 4: Locate the relevant information
We will identify the systems, records or business functions that may contain information relevant to your request.
Step 5: Assess the request
We will determine what we can lawfully do with the information requested.
This assessment may consider:
- the applicable data protection law;
- the purpose for which the information is being processed;
- whether another person's privacy is affected;
- legal obligations to retain information;
- legal claims or regulatory requirements;
- contractual obligations; and
- other applicable exemptions or restrictions.
Step 6: Respond
We will provide the appropriate response within the timeframe required by applicable law.
Where we cannot fully comply with your request, we will explain the reason where we are legally required or permitted to provide that explanation.
6. How Long Will We Take?
We will handle requests without undue delay and within the applicable statutory timeframe.
The NDPC's published data-subject access process provides for a response within 30 days of a written access request and any further information reasonably required to process it. The applicable timeframe may vary depending on the type of request and the circumstances.
If a request is unusually complex, requires clarification, or involves circumstances that affect the applicable timeframe, we will communicate with you as appropriate.
7. Will You Always Delete My Information If I Ask?
No.
The right to erasure is important, but it is not unlimited.
For example, we may need to retain certain information where:
- the law requires us to keep it;
- we need it for legal proceedings or potential legal claims;
- we need it to establish or defend our legal rights;
- another lawful basis permits continued processing; or
- another legal exception applies.
If we cannot comply with a deletion request, we will explain the reason where required.
8. Can Someone Make a Request for Me?
In some circumstances, an authorised representative may make a request on your behalf.
We may need evidence that:
- you have authorised the person to act for you; and
- the representative is genuinely the person they claim to be.
Additional safeguards may apply where the request concerns a child or another person who cannot reasonably exercise their rights independently.
9. What If We Do Not Have the Information?
Sometimes a request may relate to information that we do not hold.
If we determine that the requested personal data is not within our possession or control, we will communicate this where appropriate rather than pretending that we have information we do not have.
Where another organisation is the data controller, we may direct you to that organisation where appropriate.
10. What If Your Data Is Being Processed Through a Client's Platform?
ANAKALICE DIGITAL LIMITED may develop, host or maintain digital platforms for clients.
If your personal data was collected by one of our clients and we are processing it solely on that client's instructions, the client may be the data controller.
In such circumstances, your request may need to be directed to the relevant client.
Where we receive a request relating to personal data for which one of our clients is the controller, we will handle the request in accordance with our contractual responsibilities and applicable law.
We will not assume that we have authority to make decisions about a client's data simply because we operate the technology through which that data is processed.
11. Can You Complain?
Yes.
If you are unhappy with how we have handled your request, you can contact us and ask us to review the matter.
You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) where you believe your data protection rights have been infringed.
Our contact details are:
ANAKALICE DIGITAL LIMITED
Privacy/Data Protection Email: info@anakalicedigital.com
Location: Abuja, FCT, Nigeria
Website: anakalicedigital.com
12. No Retaliation
You should not be penalised simply because you exercise a legitimate data protection right.
Making a data subject request will not, by itself, result in the termination of a service or business relationship.
However, exercising a right does not remove obligations that independently apply to you under a contract or under applicable law.
13. Protecting Your Information During the Request
A data request should not become a new privacy problem.
We will take reasonable steps to ensure that information disclosed in response to a request is provided securely and to the appropriate person.
We may therefore use appropriate verification and secure communication methods depending on the sensitivity of the information involved.
14. Questions?
If you are unsure whether your concern qualifies as a formal data subject request, contact us anyway.
You do not need to get the terminology right.
Tell us what you want to know, change, stop or delete, and we will determine how best to handle the request.
ANAKALICE DIGITAL LIMITED
Privacy/Data Protection Email: info@anakalicedigital.com
Nigeria
Our commitment
A data protection right is only useful if a person can actually exercise it.
Our goal is therefore not to make requests difficult by hiding behind legal terminology or unnecessary administrative steps.
If we hold your personal data, you should have a practical way to ask questions about it and, where the law gives you a right, exercise that right.
ANAKALICE DIGITAL LIMITED