Privacy Policy
This Privacy Policy explains how Thoarax Digital collects, uses, stores, and protects your personal information when you use our website or engage our services. We are committed to protecting your privacy and handling your data responsibly and transparently.
About Us
Thoarax Digital (“we,” “us,” “our,” or “the Company”) is a web development and digital marketing agency registered and operating in the Federal Republic of Nigeria. We provide website development, digital marketing, social media management, community management, business management, hosting, and related digital services to individuals, businesses, and organisations.
Our registered business address is: No. 3, 3rd Avenue, 26 Road, Gwarimpa Estate, Abuja, FCT, Nigeria.
This Privacy Policy applies to all personal data collected through our website at thoarax.com, our client portal, our marketing communications, and any other service we provide.
Information We Collect
We collect information about you in the following ways:
When you fill in a form, book a call, make a purchase, or communicate with us, we may collect:
2.2 Information Collected Automatically
When you visit our website, we automatically collect certain technical information:
2.3 Information from Third Parties
If you choose to sign in using Google or Facebook via our client portal, we receive basic profile information (name, email address) from those platforms in accordance with their own privacy policies. We do not receive your password from these platforms.
We use your personal information only for legitimate purposes directly related to providing our services and running our business.
| Purpose | Data Used | Basis |
|---|---|---|
| Responding to enquiries and proposals | Contact data, project data | Legitimate interest / Contract |
| Delivering website and digital services | Identity, contact, project data | Contract performance |
| Processing payments and issuing invoices | Financial data, identity data | Contract performance |
| Managing client accounts and subscriptions | Account data, financial data | Contract performance |
| Sending service-related emails | Contact data | Contract performance |
| Sending marketing emails (newsletter) | Contact data | Consent |
| Delivering the free website audit | Website URL, email | Legitimate interest / Consent |
| Improving our website and services | Usage data, device data | Legitimate interest |
| Complying with legal obligations | All relevant data | Legal obligation |
| Preventing fraud and protecting security | Usage data, device data | Legitimate interest |
We do not use your data for automated decision-making or profiling that produces legal effects on you. We do not sell your personal data to any third party.
Legal Basis for Processing
We process your personal data in compliance with the Nigeria Data Protection Regulation (NDPR) 2019, issued by the National Information Technology Development Agency (NITDA), and where applicable, the Nigeria Data Protection Act (NDPA) 2023.
Our lawful bases for processing your personal information are:
How We Share Your Information
We do not sell, rent, or trade your personal information. We may share your data only in the following limited circumstances:
5.1 Service Providers
We use trusted third-party service providers who process data on our behalf, subject to confidentiality obligations:
5.2 Legal Requirements
We may disclose your information where required to do so by law, court order, or in response to lawful requests by Nigerian public authorities, including to meet national security or law enforcement requirements.
5.3 Business Transfers
In the event of a merger, acquisition, or sale of all or part of our business, your personal data may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website if this occurs.
Your data is stored on servers managed by WhoGoHost (Go54), a Nigerian hosting provider, located within Nigeria. We take reasonable technical and organisational measures to protect your personal information against unauthorised access, disclosure, alteration, or destruction.
Despite these measures, no method of transmission over the internet or electronic storage is 100% secure. If you become aware of any security vulnerability or breach, please contact us immediately at support@thoarax.com.
Our website uses cookies — small text files stored on your device — to improve your browsing experience and help us understand how visitors use the site.
| Cookie Type | Purpose | Can Be Declined |
|---|---|---|
| Essential cookies | Required for the site to function — login sessions, security, form submissions | No — required for functionality |
| Analytics cookies | Google Analytics 4 — anonymous data on how visitors use the site (pages visited, time on site, traffic sources) | Yes |
| Preference cookies | Remembers your settings and preferences across visits | Yes |
| Marketing cookies | Used only if you engage with our paid advertising (Google Ads, Meta Ads retargeting) | Yes |
You can control and delete cookies at any time through your browser settings. Disabling cookies may affect some functionality on the site. For more information about cookies, visit aboutcookies.org.
We do not use any third-party tracking pixels except where you have explicitly engaged with our advertising campaigns on Google or Meta platforms.
Third-Party Services & Links
Our website may contain links to external websites, including the websites of our clients (visible in our portfolio). These third-party websites have their own privacy policies, and we are not responsible for their content or data practices. We encourage you to review the privacy policy of any website you visit.
Your Rights
Under the Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act (NDPA) 2023, you have the following rights regarding your personal data:
- Right to be informed:you have the right to know what personal data we hold about you and how we use it — which this Privacy Policy provides.
- Right of access:you may request a copy of all personal data we hold about you. We will respond within 30 days.
- Right to rectification:if any data we hold about you is inaccurate or incomplete, you have the right to have it corrected.
- Right to erasure (“right to be forgotten”):you may request that we delete your personal data where there is no compelling reason for us to continue processing it.
- Right to restrict processing:you may request that we restrict the use of your data in certain circumstances.
- Right to data portability:where processing is based on consent or contract, you may request your data in a structured, machine-readable format.
- Right to object:you may object to processing based on our legitimate interests, including direct marketing. We will stop immediately upon receiving a valid objection to marketing.
- Right to withdraw consent:where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, contact us at info@thoarax.com with the subject line “Data Rights Request.” We will respond within 30 days of receiving your request. We may need to verify your identity before processing the request.
You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your data rights have been violated. Visit ndpc.gov.ng for contact details.
Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law.
| Data Type | Retention Period |
|---|---|
| Enquiry and contact form data | 3 years from last contact, unless a commercial relationship follows |
| Client project and contract data | 7 years from project completion (required for tax and legal purposes) |
| Payment and invoice records | 7 years (required under Nigerian tax law) |
| Client account data | Duration of account + 2 years after closure |
| Marketing/newsletter subscriber data | Until you unsubscribe or request deletion |
| Website analytics data | 26 months (Google Analytics default) |
| Support ticket data | 3 years from ticket closure |
| Security and access logs | 90 days |
When data is no longer required, it is securely deleted or anonymised so that it can no longer be associated with you.
Section 11
Children’s Privacy
Our website and services are intended for adults and businesses. We do not knowingly collect personal information from children under the age of 18.
If you are a parent or guardian and believe that your child has provided personal information to us without your consent, please contact us immediately at info@thoarax.com and we will take steps to delete that information from our records.
Section 12
International Users
Thoarax Digital is based in Nigeria and our primary operations and data processing occur within Nigeria. If you are accessing our website or engaging our services from outside Nigeria — including from the European Union, United Kingdom, United States, or other jurisdictions — please be aware that your data will be transferred to and processed in Nigeria.
By using our services, you consent to this transfer. We take appropriate safeguards to ensure your data is treated securely and in accordance with this Privacy Policy, regardless of where you are located.
For clients in the European Union or United Kingdom, we acknowledge the requirements of the General Data Protection Regulation (GDPR) and UK GDPR where applicable and will endeavour to honour equivalent data rights to those described in Section 9.
Section 13
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make significant changes, we will:
We encourage you to review this Privacy Policy periodically. Your continued use of our website or services after any changes constitutes your acceptance of the updated policy.
The current version of this Privacy Policy is always available at thoarax.com/privacy-policy.
Section 14
Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us using the details below. We are committed to resolving any concerns promptly and transparently.
If you are not satisfied with our response, you have the right to escalate your complaint to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.