Legal & Privacy

1. Data Protection Policy

1.1 Purpose

This policy sets out how Amecron Nigeria Limited collects, uses, stores, shares, and disposes of personal data in the course of its operations, including personal data processed on behalf of clients under its Manpower Supply, HR Consultancy, and Background Verification service lines. It exists to protect the rights of data subjects — including employees, job candidates, contractors, and client personnel — and to ensure Amecron's processing activities remain lawful, fair, and transparent at all times.

1.2 Data Protection Principles

Amecron processes personal data in line with the following principles, consistent with Section 24 of the NDPA:

• Lawfulness, fairness, and transparency — data is processed only where a valid legal basis exists, and data subjects are informed of how their data will be used.
• Purpose limitation — data is collected for specified, explicit purposes and not processed further in a way incompatible with those purposes.
• Data minimisation — only data that is adequate, relevant, and limited to what is necessary is collected.
• Accuracy — reasonable steps are taken to ensure personal data is accurate and kept up to date.
• Storage limitation — data is retained only for as long as necessary, in line with the Data Retention Policy (Section 2).
• Integrity and confidentiality — appropriate technical and organisational measures protect data against unauthorised access, loss, or destruction.
• Accountability — Amecron maintains records of processing activities and can demonstrate compliance with the NDPA on request.

1.3 Lawful Basis for Processing

Amecron relies on one or more of the following lawful bases depending on the processing activity: the consent of the data subject; performance of a contract to which the data subject is party (e.g. an employment or engagement contract); a legitimate interest pursued by Amecron or a client (e.g. workforce screening and risk management), balanced against the rights of the data subject; and compliance with a legal obligation, where applicable.

1.4 Roles and Responsibilities

• The Board of Amecron Nigeria Limited holds overall accountability for data protection compliance.
• The Data Protection Officer (DPO), designated below, oversees day-to-day compliance, monitors adherence to this framework, and serves as the primary contact for the NDPC and data subjects.
• Departmental heads ensure staff under their supervision are trained on and comply with this policy.
• All staff and contractors are individually responsible for handling personal data in line with this policy and any supporting procedures.

1.5 Data Subject Rights

Amecron recognises and facilitates the rights of data subjects under the NDPA, including the right to be informed, the right of access, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability, and the right to object to processing. Detailed procedures for handling these rights are set out in Section 4.

1.6 Review

This policy is reviewed at least annually, or sooner where changes in law, NDPC guidance, or Amecron's business operations require it.

2. Data Retention Policy

2.1 Purpose

This policy establishes how long Amecron retains different categories of personal data, and the process for secure disposal once retention periods expire, in line with the storage limitation principle under the NDPA.

2.2 Retention Schedule

Data Category	Retention Period	Basis
Background verification reports (unsuccessful candidates)	6 months from completion	Legitimate interest / dispute defence
Background verification reports (successful / engaged candidates)	Duration of engagement + 3 years	Contract performance
Employee personnel files	Duration of employment + 6 years	Statutory / labour law obligations
Criminal record check data	6 months post-decision, unless a longer period is agreed with the client in writing	Data minimisation; sensitive data
Client contracts and correspondence	7 years from contract end	Statutory / tax obligations
Consent records	Duration of processing + 2 years	Accountability / evidence of consent

Where a specific timeline has been agreed with an individual client, that contractual period may override these defaults.

2.3 Secure Disposal

On expiry of the applicable retention period, personal data is securely deleted from electronic systems and, where held in physical form, cross-shredded or incinerated. Disposal is logged — recording the data category, disposal date, and method — to maintain an auditable record.

3. Refund Policy

3.1 Purpose

Amecron provides engineering, procurement, project management, and human-resource consultancy services delivered under written engagement contracts. This policy explains how requests relating to fees and refunds are handled, so that clients understand their position before, during, and after an engagement.

3.2 Service-Based Engagements

Fees for professional services are set out in the applicable proposal, contract, or purchase order. Unless a specific engagement contract states otherwise:

• Amounts paid for work already performed, delivered, or in progress are non-refundable, as they cover professional time, mobilisation, and third-party costs already committed.
• Where a client cancels an engagement before work begins, any advance or mobilisation payment is refundable less any costs Amecron has already reasonably incurred or committed on the client's behalf.
• Where Amecron is unable to deliver a contracted service for reasons within its control, the client is entitled to a refund of amounts paid for the undelivered portion of that service.

3.3 Requesting a Refund

Refund requests should be made in writing to Amecron's Finance team, quoting the relevant contract or invoice reference, within 30 days of the event giving rise to the request. Each request is reviewed against the terms of the applicable engagement contract, which takes precedence where its terms differ from this general policy.

3.4 Processing

Approved refunds are processed to the original payment source within 30 business days of approval. Amecron will confirm the outcome of every request in writing, including the reasons where a request is declined.

4. Data Subject Rights & Grievance Redress Policy

4.1 Purpose

This policy explains how Amecron publicises data subject rights and provides an accessible, active mechanism for individuals to raise requests or complaints about how their personal data is processed.

4.2 Your Rights

Amecron makes data subjects aware of their rights at the point personal data is collected — through candidate consent forms, employment documentation, and, where applicable, a privacy notice made available on request. In plain language, you have the right of access, rectification, erasure, restriction of processing, data portability, and the right to object.

4.3 Grievance Redress Mechanism

• Data subjects may submit a request or complaint in writing to the DPO using the contact details below.
• Requests are acknowledged within 3 business days of receipt.
• Amecron responds substantively within 30 days, consistent with NDPA timelines, or informs the data subject of any extension required due to complexity.
• Where a data subject is dissatisfied with Amecron's response, they may escalate the matter to the Nigeria Data Protection Commission.
• All requests and their outcomes are logged in a Data Subject Request Register maintained by the DPO.

5. Incident Response & Remediation Policy

5.1 Purpose

This policy sets out how Amecron identifies, contains, investigates, and reports personal data breaches, in line with NDPA breach notification requirements and NDPC guidance.

5.2 What Constitutes a Breach

A personal data breach includes any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. This covers incidents such as a lost or stolen device containing candidate data, an email sent to the wrong recipient, unauthorised access to verification records, or a compromised system.

5.3 Response Procedure

• Identify and contain — the staff member who identifies a suspected breach reports it immediately to the DPO; access is restricted and further exposure is contained without delay.
• Assess — the DPO assesses the nature, scope, and likely risk to affected data subjects within 24 hours of the report.
• Notify the NDPC — where the breach is likely to result in a risk to the rights of data subjects, Amecron notifies the NDPC without undue delay, and within the timeframe prescribed under the NDPA.
• Notify affected data subjects — where the breach is likely to result in a high risk to individuals, affected data subjects are informed directly, in clear language.
• Notify affected clients — where client data is implicated, the relevant client contact is notified promptly under the applicable service agreement.
• Remediate — root cause is identified and corrective action taken to prevent recurrence.
• Document — every incident is logged in an internal breach register, recording the facts, effects, and remedial action taken.

6. Vendor & Third-Party Data Management Policy

6.1 Purpose

This policy governs how Amecron selects, contracts with, and monitors third parties involved in the delivery of its services — including institutions and agencies contacted in the course of background verification (e.g. educational institutions, credit bureaux, and law enforcement authorities) — to ensure personal data shared with or processed by them is adequately protected.

6.2 Due Diligence

Before engaging a third party that will process personal data, Amecron assesses the party's data protection practices, including their security measures and, where applicable, their own NDPA compliance status.

6.3 Contractual Safeguards

Where a third party processes personal data on Amecron's behalf, a written data processing agreement is put in place, setting out the scope and purpose of processing, confidentiality obligations, security requirements, breach notification obligations to Amecron, and data return or deletion obligations on termination.

6.4 Ongoing Monitoring

Amecron periodically reviews third-party compliance with agreed data protection terms and reserves the right to suspend data sharing with any party found to be in breach of its obligations.

7. Data Privacy Impact Assessment (DPIA) Policy

7.1 Purpose

This policy sets out when and how Amecron conducts a Data Privacy Impact Assessment (DPIA) to identify and mitigate data protection risks before new processing activities begin.

7.2 When a DPIA Is Required

• Before onboarding a new client engagement involving large-scale background verification.
• Before processing any new category of sensitive personal data (e.g. extending into credit or financial checks for a new client).
• Before adopting a new system or technology for storing or processing personal data.
• Before sharing personal data with a new category of third party.

7.3 DPIA Process

• Describe the proposed processing, its purpose, and the categories of data and data subjects involved.
• Assess the necessity and proportionality of the processing against its stated purpose.
• Identify risks to data subjects and the likelihood and severity of those risks.
• Identify measures to mitigate identified risks, including technical and organisational safeguards.
• Record the outcome and, where residual risk remains high, consult the NDPC before proceeding.

8. Technical & Security Measures Policy

8.1 Purpose

This policy sets out the technical safeguards Amecron applies to protect personal data against unauthorised access, loss, alteration, or destruction, in support of the integrity and confidentiality principle under the NDPA.

8.2 Technical Controls

• Network security & firewalls — perimeter and internal network traffic is filtered and monitored to prevent unauthorised access to systems holding personal data.
• Data security systems — endpoint protection and system-level controls are maintained on devices used to process personal data.
• Data loss prevention (DLP) — controls detect and prevent unauthorised transfer of personal data outside approved channels.
• Data recovery — regular backups are taken of systems holding personal data, with tested recovery procedures.
• Data encryption — personal data is encrypted at rest and in transit where technically feasible, particularly sensitive data such as criminal-record and financial information.
• Audit trail & logging — access to systems holding personal data is logged and reviewed periodically.
• Access authorisation & authentication — access is restricted on a need-to-know basis with individual credentials; shared logins are not permitted.
• Data minimisation — systems and forms are designed to collect only the personal data necessary for the stated purpose.

9. Staff Training & Awareness Policy

9.1 Purpose

This policy ensures staff understand their data protection obligations and are equipped to identify and respond appropriately to data protection risks.

9.2 Training Requirements

• All new staff and contractors receive data protection induction training before being granted access to personal data.
• Staff directly involved in background verification receive specialised training on handling sensitive personal data.
• Refresher training is delivered at least annually, and whenever this framework or applicable law changes materially.
• Training completion is recorded by the DPO as part of Amecron's accountability records.

10. Cookie Consent Policy

10.1 Purpose

This policy governs the use of cookies and similar tracking technologies on Amecron's website, ensuring visitors are informed and, where required, give consent before non-essential cookies are set.

10.2 Cookie Practices

• A cookie banner is displayed to first-time visitors, explaining the categories of cookies used (essential, analytics, marketing) and allowing acceptance or rejection of non-essential cookies.
• Essential cookies required for basic website functionality are set without consent, as permitted under the NDPA.
• Analytics and marketing cookies are set only after affirmative consent is obtained, and visitors may withdraw consent at any time.
• This cookie policy describes each category of cookie in use, its purpose, and its duration, and is linked from the consent banner.
• Your choice is remembered in your own browser for up to 12 months, after which we ask again. You can change it sooner at any time using the button below.

You can review or change your cookie choice at any time using the button below.

Manage cookie preferences

Data Protection Officer

In accordance with the Nigeria Data Protection Act 2023 and NDPC guidance, Amecron Nigeria Limited designates the following individual as its Data Protection Officer:

Name	Oludotun Taiwo
Title	General Manager, HR & Operations / Data Protection Officer
Responsibilities	Oversight of data protection compliance; primary contact for the NDPC; management of data subject requests and breach response.
Email	amecron@yahoo.co.uk
Phone	+234 8178 374 675
Address	3rd floor, Pneuma Place, KM 1 Woji-Akpajo new link road, by Elelewon Bridge, Port Harcourt.

Back to home