1. DATA CONTROLLER
Winelval Group Limited is the Data Controller responsible for personal data collected through the Website. Each Group Company acts as a Data Controller (or Joint Controller, as applicable) in respect of personal data processed for the specific Service it renders to you.
Registered Address: [Registered Address] RC Number: [_______] Data Protection Officer: [DPO Name/Email]
2. PERSONAL DATA WE COLLECT
2.1 Identity and Contact Data
Full name, title, date of birth, gender, phone number, email address, residential/business address, and identification documents (e.g., BVN, NIN, International Passport, driver's licence) where required for onboarding, know-your-customer (KYC), or regulatory compliance purposes.
2.2 Financial and Payment Data
Billing address, payment card details (processed directly by our licensed third-party payment processor and not stored on our servers), transaction history, and, where relevant to Winelval Priva Adviser engagements, financial position, income, and investment information.
2.3 Professional and Case-Specific Data
For clients of Winelval & Partners Solicitors, this may include sensitive personal data relevant to your legal matter (e.g., data concerning litigation, family matters, or property disputes), handled under strict confidentiality and legal professional privilege, in addition to this Policy.
2.4 Property and Transaction Data
For clients of Winelval Property Ltd, this includes property ownership records, valuation data, tenancy information, and transaction documentation.
2.5 Technical and Usage Data
IP address, browser type and version, device information, operating system, pages visited, time spent on the Website, and referring URLs, collected via cookies and similar technologies as further described in our Cookie Policy.
3. LEGAL BASIS FOR PROCESSING
- Consent — where you have given clear consent for us to process your data for a specific purpose (e.g., marketing communications).
- Contractual Necessity — where processing is necessary to perform a contract with you (e.g., delivering a booked consultancy, legal, property, or advisory Service).
- Legal Obligation — where processing is required to comply with a legal or regulatory obligation (e.g., anti-money laundering checks under the Money Laundering (Prevention and Prohibition) Act 2022).
- Legitimate Interest — where processing is necessary for our legitimate business interests (e.g., fraud prevention, Website security), provided this does not override your fundamental rights and freedoms.
4. HOW WE USE YOUR PERSONAL DATA
- to create and manage your account and process bookings or engagements;
- to deliver, administer, and bill for Services across the Group;
- to verify your identity and conduct KYC/AML due diligence as required by law;
- to communicate with you regarding your engagement, invoices, or Website updates;
- to improve the Website, our Services, and user experience;
- to detect, prevent, and investigate fraud, security incidents, or unlawful activity;
- to comply with applicable legal, regulatory, and professional obligations;
- to send marketing communications, where you have opted in, which you may withdraw consent to at any time.
5. DATA PROTECTION PRINCIPLES
In line with the NDPA, we process personal data in accordance with the principles of: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.
6. SHARING OF YOUR DATA
We do not sell your personal data. We may share your data with:
- licensed payment processors and financial institutions, to process transactions;
- cloud hosting and IT service providers, bound by contractual confidentiality and security obligations;
- professional partners, co-counsel, or correspondent firms, strictly where necessary to deliver your instructed Service, and subject to confidentiality;
- regulatory authorities, law enforcement, or courts, where required by law or valid legal process;
- our auditors, insurers, and professional advisers, on a need-to-know basis.
7. INTERNATIONAL DATA TRANSFERS
Where personal data is transferred outside Nigeria (for example, where you are a client resident in another country, or where we use an international service provider), we ensure such transfer is conducted in accordance with the cross-border data transfer requirements of the NDPA, including verification that the receiving country provides an adequate level of data protection, or through appropriate safeguards such as standard contractual clauses, consistent with global standards including the GDPR.
8. DATA RETENTION
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, regulatory, or professional retention requirement (for example, Winelval & Partners Solicitors retains case files in accordance with professional conduct rules and limitation periods). Where data is no longer required, it is securely deleted or anonymised.
9. DATA SECURITY
We implement appropriate technical and organisational measures to protect your personal data, including encryption of data in transit, access controls, staff confidentiality training, secure hosting infrastructure, and PCI-DSS-compliant payment processing. Notwithstanding these measures, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.
10. YOUR RIGHTS AS A DATA SUBJECT
Under the NDPA, you have the right to:
- be informed about how your data is processed;
- access the personal data we hold about you;
- request correction of inaccurate or incomplete data;
- request erasure of your data, subject to our legal and professional retention obligations;
- restrict or object to certain processing of your data;
- request data portability, where technically feasible;
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
- lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your data protection rights have been violated.
11. CHILDREN'S PRIVACY
Our Website and Services are not directed at, or intended for use by, individuals under the age of 18. We do not knowingly collect personal data from minors.
12. COOKIES
Our use of cookies and similar tracking technologies is described in detail in our separate Cookie Policy, which forms part of this Policy by reference.
13. DATA BREACH NOTIFICATION
In the event of a personal data breach likely to result in a risk to your rights and freedoms, we shall notify the NDPC and affected Data Subjects without undue delay, in accordance with the notification timelines and requirements prescribed by the NDPA.
14. CHANGES TO THIS POLICY
We may update this Policy periodically to reflect changes in our practices or Applicable Law. Material changes will be notified via the Website or by direct communication, with an updated “Effective Date”.
15. CONTACT US / COMPLAINTS
For privacy-related queries, or to exercise your data protection rights, please contact our Data Protection Officer at support@winelvalgroup or +234 8147093769.
You may also contact the Nigeria Data Protection Commission at www.ndpc.gov.ng.