Privacy Policy

1. Introduction

Fronthill Controls Limited (“Fronthill Controls”, “we”, “us”, or “our”) is a building technology and systems integrator registered and operating in Nigeria. We are committed to protecting the privacy and personal data of all individuals who interact with our website, services, and business operations.

This Privacy Policy explains how we collect, use, store, disclose, and protect personal information in accordance with the Nigeria Data Protection Act 2023 (NDPA) and its implementing regulations, including the Nigeria Data Protection Regulation (NDPR). It applies to all data subjects who visit our website at www.fronthillcontrols.com or engage with us through any of our services.

By accessing our website or engaging with our services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the terms stated herein, please discontinue use of our website and services.

2. Data Controller Information

Company Name: Fronthill Controls Limited

Website: www.fronthillcontrols.com

Country of Operation: Federal Republic of Nigeria

Email: contact@fronthillcontrols.com

As the data controller, Fronthill Controls determines the purposes and means of processing your personal data. We are subject to the regulatory oversight of the Nigeria Data Protection Commission (NDPC).

3. Personal Data We Collect

We collect personal data in the following categories, depending on your interaction with us:

3.1 Data You Provide Directly

Full name and title
Email address and telephone number
Business name and registered address
Project requirements and enquiry details
Payment and billing information (processed securely via compliant payment processors)
Any other information you voluntarily submit through our contact or enquiry forms

3.2 Data Collected Automatically

Internet Protocol (IP) address
Browser type, version, and operating system
Pages visited and time spent on each page
Referring URLs and exit pages
Device identifiers and screen resolution
Cookie and tracking data (see Section 9)

3.3 Data from Third Parties

We may receive personal data about you from third-party referral partners, public directories, social media platforms (where you engage with our content), and analytics providers, subject always to lawful basis.

4. Lawful Basis for Processing

In compliance with the NDPA 2023, we process your personal data only when we have a lawful basis to do so. The lawful bases we rely on include:

Consent: Where you have given explicit, freely obtained, informed, and unambiguous consent to the processing of your data for a specified purpose.
Contract Performance: Where processing is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into a contract.
Legal Obligation: Where processing is necessary for compliance with a legal obligation to which we are subject under Nigerian law.
Legitimate Interests: Where processing is necessary for the purposes of our legitimate business interests, provided such interests are not overridden by your fundamental rights and freedoms.

5. Purposes of Processing

We use the personal data we collect for the following purposes:

To respond to enquiries, project briefs, and service requests
To provide, manage, and deliver our building technology and systems integration services
To issue quotations, invoices, and process payments
To maintain business records and manage client relationships
To send service updates, project progress communications, and support messages
To send marketing communications where you have consented or where we have a legitimate interest (with opt-out always available)
To improve our website performance, user experience, and service quality
To comply with applicable laws, regulations, and court orders
To detect, prevent, and respond to fraud, security incidents, and other harmful activities

6. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data to third parties. We may share your data in the following limited circumstances:

6.1 Service Providers and Processors

We engage trusted third-party companies to assist us in delivering our services, including IT infrastructure providers, payment processors, email service providers, and analytics platforms. These parties are contractually bound to process your data only on our instructions and to maintain appropriate security measures.

6.2 Professional Advisers

We may share data with our legal counsel, auditors, insurers, and financial advisers where necessary for legitimate professional purposes.

6.3 Regulatory and Law Enforcement Authorities

We may disclose personal data to government bodies, regulators, or law enforcement agencies where required by applicable Nigerian law, court order, or regulatory obligation.

6.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets, personal data may be transferred as part of that transaction. We will notify affected data subjects as required by law.

7. International Data Transfers

Where we transfer personal data outside the Federal Republic of Nigeria, we ensure that such transfers comply with the NDPA 2023 and are made only to countries or organisations that provide an adequate level of data protection, or where appropriate contractual or technical safeguards are in place.

8. Data Retention

We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable Nigerian law and regulatory obligations. Our general retention guidelines are as follows:

Client and project records: 7 years from completion of the engagement, in line with statutory business record-keeping requirements.
Website enquiry and contact form data: 2 years from last interaction unless a commercial relationship is established.
Marketing consent records: Retained until consent is withdrawn or the purpose lapses.
Financial and transaction records: As required by the Companies and Allied Matters Act (CAMA) 2020 and FIRS guidelines.

Upon expiry of the applicable retention period, data is securely deleted or anonymised.

9. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to enhance your browsing experience and gather analytical data. The types of cookies we use include:

Strictly Necessary Cookies: Essential for the operation of the website. These cannot be disabled.
Analytical/Performance Cookies: Help us understand how visitors interact with our website. Data is aggregated and anonymised where possible.
Functionality Cookies: Remember your preferences and settings for a personalised experience.
Marketing/Targeting Cookies: Used only where you have given explicit consent, to deliver relevant content and track the effectiveness of our communications.

You may manage or withdraw your cookie consent at any time through your browser settings or our cookie consent tool. Please note that disabling certain cookies may affect website functionality.

10. Your Rights as a Data Subject

Under the Nigeria Data Protection Act 2023, you have the following rights with respect to your personal data:

Right of Access: You have the right to request a copy of the personal data we hold about you.
Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data.
Right to Erasure: You have the right to request deletion of your personal data where there is no lawful basis for continued processing.
Right to Restrict Processing: You have the right to request that we limit the processing of your personal data in certain circumstances.
Right to Data Portability: Where processing is based on consent or contract, you have the right to receive your data in a structured, commonly used, and machine-readable format.
Right to Object: You have the right to object to processing based on legitimate interests or for direct marketing purposes.
Right to Withdraw Consent: Where processing is based on consent, you have the right to withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
Right to Lodge a Complaint: You have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your data protection rights have been violated.

To exercise any of the above rights, please contact us using the details provided in Section 2. We will respond to your request within 30 days, as required by the NDPA 2023.

11. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, accidental loss, or destruction. These measures include:

Encrypted data transmission using Secure Socket Layer (SSL/TLS) technology
Access controls and authentication mechanisms restricting data access to authorised personnel only
Regular security assessments and vulnerability management
Staff training on data protection and information security obligations
Incident response and breach notification procedures

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the NDPC within 72 hours and affected data subjects as required by law.

12. Children’s Privacy

Our website and services are not directed at children under the age of 13. We do not knowingly collect personal data from children without verifiable parental or guardian consent. If we become aware that we have inadvertently collected personal data from a minor, we will take immediate steps to delete such data. If you believe a child has provided us with personal data, please contact us immediately.

13. Third-Party Links

Our website may contain links to third-party websites or services. We are not responsible for the privacy practices or content of such external sites. We encourage you to review the privacy policies of any third-party websites you visit.

14. Changes to This Privacy Policy

We reserve the right to update or amend this Privacy Policy at any time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the “Effective Date” at the top of this document and, where appropriate, notify you by email or a prominent notice on our website.

Your continued use of our website or services following the posting of changes constitutes acceptance of the updated Privacy Policy.

15. Contact and Complaints

If you have any questions, concerns, or complaints regarding this Privacy Policy or our data processing practices, please contact us at:

Fronthill Controls Limited

Email:contact@fronthillcontrols.com