Privacy Notice
How Credence collects, uses and protects personal data under the Nigeria Data Protection Act 2023.
This notice explains how Credence Firm collects, uses and protects personal data when you visit credencefirm.com, contact us, register for an event, or become a client. We handle personal data in line with the Nigeria Data Protection Act 2023 (NDPA) and the rules issued under it by the Nigeria Data Protection Commission (NDPC).
Last updated: 27 October 2026
1. Who we are
Credence Firm is the data controller for the personal data described in this notice. This means we decide how and why your data is used.
- Address: No 6 Daura Close, Area 1, Garki, Abuja, Federal Capital Territory, Nigeria
- Privacy contact: Data Protection Officer, info@credencefirm.com, +234 706 170 2558
2. What personal data we collect
We collect only the data we need for the purpose you give it to us for.
| Who you are | What we collect | How we get it |
|---|---|---|
| Website visitor | IP address, browser type, pages visited, date and time of visit | Automatically, through our web server logs |
| Someone who contacts us | Name, email address, phone number, the service you ask about, your message | The contact form, email, phone or WhatsApp |
| Event registrant | Name, email address, phone number, organization, city and state | Event registration |
| Credence Nexus applicant | Name, contact details, city and state, education, professional exams, work experience, profile or CV link, and the personal statement you write | The Credence Nexus application form |
| Client or prospective client | Identity and contact details of owners, directors and staff; tax identification numbers; financial records, bank statements, payroll and tax records; details needed for checks on who we work with | From you, your organization, and public registers such as the Corporate Affairs Commission |
| Person whose data is in client records | Names, salaries, tax and pension details of a client’s employees, customers or suppliers | From our clients, when we provide accounting, payroll, tax, audit or automation services |
We do not knowingly collect data from children through this website. We do not ask for sensitive data (such as health or religious information) unless a specific engagement requires it, and then only with the safeguards the NDPA requires.
3. How we use your data and why we are allowed to
The NDPA allows us to use personal data only where we have a lawful basis. The table shows each use and its basis.
| What we use it for | Lawful basis under the NDPA |
|---|---|
| Replying to your enquiry and arranging a consultation | Steps you ask for before a contract, or our legitimate interest in responding |
| Providing accounting, tax, audit, advisory, funding and automation services | Performing our contract with you or your organization |
| Filing returns and reports with tax and regulatory authorities on a client’s behalf | Legal obligation, and performing our contract |
| Checking who our clients are and meeting anti-money laundering duties | Legal obligation |
| Keeping professional records and handling complaints or legal claims | Legal obligation and legitimate interest |
| Running and securing this website and preventing spam | Legitimate interest |
| Managing event registrations | Steps you ask for when you register, and our legitimate interest in running the event |
| Assessing Credence Nexus applications and contacting applicants | Steps you ask for when you apply, and your consent given on the form |
| Sending event invitations and newsletters | Your consent, which you can withdraw at any time |
We do not sell your personal data. We do not make decisions about you based only on automated processing that have legal or similarly significant effects.
4. Who we share it with
- Government and regulatory bodies, such as federal and state tax authorities, the Corporate Affairs Commission and pension administrators, when we file or report for a client or the law requires it.
- Service providers who work for us, such as our web hosting and email provider (Namecheap), Google (Google Sheets, where website enquiries, event registrations and program applications are recorded), cloud accounting software providers, and WhatsApp. They may use the data only on our instructions and must keep it secure.
- Funders and partners, with your permission, for example lenders or investors when we prepare an SME for funding.
- Professional advisers and insurers, such as our lawyers and auditors, under confidentiality.
- Courts or law enforcement, when the law requires it.
Transfers outside Nigeria
Some service providers store data on servers outside Nigeria, for example email, cloud accounting, Google Sheets and website hosting. When data leaves Nigeria, we make sure it has the protection the NDPA requires, such as contractual safeguards or a lawful basis the Act recognizes.
5. How long we keep it and how we protect it
We keep personal data only as long as we need it, then delete it or make it anonymous.
| Data | How long we keep it |
|---|---|
| Enquiries that do not lead to an engagement | 2 years from our last contact |
| Client files, accounting, tax and audit records | 6 years after the engagement ends, as Nigerian company and tax record-keeping rules require |
| Event registrations | 2 years after the event |
| Credence Nexus applications (not admitted) | 2 years after the application |
| Newsletter subscriptions | Until you unsubscribe |
| Website server logs | 90 days |
We protect data with measures suited to its sensitivity, including:
- Access limited to staff who need it, with individual passwords and two-step sign-in where available
- Encrypted connections (HTTPS) on our website and secure file sharing with clients
- Confidentiality duties for all staff and service providers
- Regular backups and a plan for responding to data breaches
If a breach is likely to put your rights at risk, we will notify the NDPC and, where required, you, within the time the NDPA sets.
6. Cookies and website technology
Our website does not use advertising or tracking cookies.
- One strictly necessary cookie. When you send a form, the site sets a short-lived session cookie to stop repeated spam submissions. It holds no personal details and is deleted when you close your browser. Because it is strictly necessary, it does not need your consent.
- Fonts from Google. Our pages load typefaces from Google Fonts, so your browser sends your IP address to Google when a page loads.
- Links to other services. WhatsApp, Google Maps, X and Instagram links take you to those services, which have their own privacy policies.
If we add analytics or other non-essential cookies in future, we will ask for your consent first, with a clear option to accept or reject them, and update this notice.
7. Your rights
Under the NDPA you have the right to:
- Know and access what personal data we hold about you, and get a copy
- Correct data that is wrong or incomplete
- Delete data we no longer have a reason to keep
- Restrict how we use your data in certain cases
- Object to our use of your data based on legitimate interest, and to direct marketing at any time
- Withdraw consent where we rely on it, without affecting what we did before
- Receive your data in a common electronic format and have it sent to another organization (data portability)
- Not be subject to decisions based only on automated processing that significantly affect you
To use any of these rights, email info@credencefirm.com or call +234 706 170 2558. We may ask you to confirm your identity first. We will respond within 30 days and will not charge you, unless a request is clearly excessive.
Some rights are limited by law. For example, we cannot delete records that tax or professional rules require us to keep.
Complaints
If you are unhappy with how we handle your data, please contact us first so we can put it right. You also have the right to complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
8. Changes to this notice
We may update this notice when our services, systems or the law change. The date at the top shows the latest version. If a change significantly affects how we use your data, we will tell clients directly.