This notice explains how Stephen Alaekwe & Co (SAC) collects, uses, shares, protects and retains personal data — across our website, our professional services, and our training programmes and events. We are a data protection firm; this notice is written to the standard we advise our clients to meet.
Stephen Alaekwe & Co (SAC) is a professional services firm and the data controller for the processing described in this notice. We are a Data Protection Compliance Organization licensed by the Nigeria Data Protection Commission (NDPC) — Licence No. NDPC-Licensed DPCO — and an accredited Training Organization.
Where we deliver client engagements as a DPCO, auditor or consultant, we generally act as a processor or independent professional on our client's instructions; the client's own privacy notice governs that data. This notice covers the processing for which SAC decides the purposes and means.
This notice applies when you:
We collect data directly from you, from your organization where it nominates you for training or engages us, and automatically through the website. We do not seek sensitive personal data through our website or enrolment forms; please do not include any in free-text fields.
Under section 25 of the NDPA 2023, every use of personal data requires a lawful basis. Ours are:
| Purpose | Lawful basis (NDPA s.25) |
|---|---|
| Responding to enquiries; providing quotations and proposals | Legitimate interest (responding to your request); steps prior to a contract |
| Delivering contracted professional services; administration, invoicing and records | Contract; legal obligation (tax, accounting, professional records) |
| Training enrolment, delivery, assessment and certification (detail in Section 5) | Contract; legal/regulatory obligation for certification records |
| Sending the Executive Briefing, CPD Readiness Check results, and marketing you have opted into | Consent — withdrawable at any time |
| Operating, securing and improving our website | Legitimate interest (security, service quality); consent for non-essential cookies |
| Establishing, exercising or defending legal claims; complying with regulator requests | Legal obligation; legitimate interest |
Where we rely on legitimate interest, we have carried out the assessment required by GAID 2025 (Schedule 8) and concluded that our interest does not override your rights; you may object at any time (Section 10).
We separate what is necessary for your training from what is optional. Necessary processing proceeds on the basis of your enrolment contract. Everything optional — marketing, alumni engagement, testimonials, photographs — is asked for separately and happens only with your consent, which you can withdraw at any time without affecting your training or certification.
When you enrol in a programme such as the SAC CDPO Accelerator™, we process your identity, contact, professional-background, payment and attendance data to admit you, confirm payment, deliver sessions and materials, run practice labs and assessments, communicate joining instructions and programme updates, and provide post-training support included in your package. Without this data we cannot deliver the programme.
We process assessment results and certification data to administer examinations, issue certificates, and maintain the certification records that accreditation and certification frameworks require. Where certification involves an accrediting or certifying body (for example the Institute of Information Management (IIM) or the NDPC's frameworks), we share the data reasonably required for your examination, certification, verification and accreditation compliance — limited to that purpose.
Live virtual sessions may be recorded so that enrolled participants can access recordings — a stated programme feature. Recordings capture facilitators and participants who speak or appear on camera. If you prefer not to appear, keep your camera off and use the chat; your attendance and participation are not affected.
Only if you opt in, we will tell you about future cohorts, CPD opportunities, and SAC products and events. Declining has no effect on your enrolment.
Only if you opt in, we will include you in the SAC alumni and professional network: CPD-credited sessions, roundtables, mentoring and community communications.
Only with your specific consent will we (a) publish a testimonial attributed to you, or (b) use event photographs or recordings featuring you identifiably in our promotional materials. You may consent to one and not the other, limit the channels, and withdraw consent at any time — we will then stop future use and remove the material from channels we control within a reasonable period.
Some of our service providers (for example cloud, forms and video-conferencing platforms) store or process data outside Nigeria. Where that occurs, we transfer only under the conditions permitted by Part VIII of the NDPA 2023 and GAID 2025 Article 45 — relying on adequacy, appropriate contractual safeguards with the provider, or another lawful ground — and we minimise what is transferred to what the service requires.
We keep personal data only as long as the purpose requires, then delete or anonymise it in line with our Data Retention Schedule. Indicatively:
| Category | Retention |
|---|---|
| Enquiries that do not become engagements | Up to 12 months after last contact |
| Client engagement and professional records | 6 years after the engagement ends, per professional and statutory requirements |
| Training, assessment and certification records | Certification records for as long as needed to verify your certification; supporting course records 3 years after programme end |
| Financial and tax records | 6 years, per statutory requirements |
| Marketing lists and consent records | Until you withdraw, plus a suppression record; consent evidence retained as required |
| Website technical logs | Up to 6 months |
Where no legal requirement applies, our default aligns with GAID 2025 Article 49(3): deletion within six months after the purpose is exhausted, unless you request earlier deletion (Section 10) or a legal ground requires longer retention.
Consistent with section 39 of the NDPA 2023, we apply technical and organizational measures proportionate to risk: access on a need-to-know basis with authentication controls; encryption in transit; vetted providers under data processing agreements; staff confidentiality and data protection training; secure disposal; and a documented incident-response procedure. In the event of a breach likely to risk your rights, we will notify the NDPC within 72 hours of becoming aware and inform affected individuals without undue delay where the risk is high, as sections 40 of the NDPA and GAID Article 33 require.
Under Part VI of the NDPA 2023 you may, at any time:
To exercise any right: email info@sac.ng with the subject "Data Subject Request", describing the right you wish to exercise. We will verify your identity, never charge for a first request made in good faith, and respond within the period prescribed under the NDPA and NDPC directions — telling you promptly if we need clarification or a lawful extension applies.
If you believe we have handled your data improperly, please contact info@sac.ng — we take every concern seriously and will investigate and respond in writing. You may formally serve us a Standard Notice to Address Grievance (SNAG) under the GAID 2025 remediation framework, and we will respond within the prescribed period.
You also have the right, at any time, to lodge a complaint directly with the Nigeria Data Protection Commission — ndpc.gov.ng.
Our website, services and programmes are directed at professionals and organizations, not children. We do not knowingly collect children's data. If you believe a child's data has been provided to us, contact info@sac.ng and we will delete it.
We review this notice at least annually and upon material regulatory or operational change. The current version and its effective date always appear at the top of this page; material changes affecting active participants or subscribers will also be communicated directly.
Version 2.0 · Effective 21 July 2026 · Supersedes Version 1.0 · Approved by the Principal, Stephen Alaekwe & Co · Questions: info@sac.ng