Privacy Policy

1. Who we are

The data controller is Amber Royal Multi Ltd, a company registered in the Federal Republic of Nigeria (RC-803937), registered office Lagos, Nigeria. Data protection contact: info@amberroyalmulti.com.

2. Data we collect

• Account data — name, email, business name, phone number, login credentials.
• Payment data — payments are made by bank transfer directly to our GTBank account; we never collect or store card details.
• Project data — intake form responses, uploaded files, dashboard messages.
• Usage data — login times, dashboard activity, IP addresses, browser metadata.
• Your visitors' data — where your delivered website collects visitor data (e.g. contact forms), you are the controller and Amber Royal Multi acts as processor on your behalf.

3. Why we use it (lawful bases)

We process personal data only on the lawful bases set out in section 25 of the Nigeria Data Protection Act 2023:

• Delivering the service you booked — performance of our contract with you.
• Confirming and recording your bank-transfer payments — performance of our contract with you.
• Service improvement, security, and fraud prevention — our legitimate interests, balanced against your rights.
• Marketing emails — your consent only, and only if you opt in; you can withdraw it at any time.
• Tax and record-keeping — compliance with our legal obligations.

4. Sub-processors

We use the following providers to run the service: Vercel (hosting infrastructure) and Supabase (database, authentication, and file storage). If we add further providers (for example a transactional-email service), this list is updated first. Your bank handles your transfer independently under its own terms — we never see your banking credentials.

5. International transfers

Where personal data is transferred outside Nigeria (for example to US-based infrastructure providers), we rely on appropriate safeguards — including contractual protections with those providers — consistent with the cross-border transfer provisions of the Nigeria Data Protection Act 2023 and any conditions issued by the Nigeria Data Protection Commission.

6. How long we keep it

• Account data: while the account is active, then 6 years after closure (Nigerian tax and contract limitation periods).
• Payment and tax records: at least 6 years (Federal Inland Revenue Service record-keeping requirements).
• Project intake data: for the duration of the hosting relationship plus 6 years.
• Dashboard messages: duration of the hosting relationship plus 2 years.
• Marketing subscriptions: until you withdraw consent.

7. Your rights

Under the Nigeria Data Protection Act 2023 you can access, rectify, erase, restrict, port, and object to processing of your personal data, and withdraw consent where processing is based on consent. Exercising these rights is free of charge. Email info@amberroyalmulti.com — we respond within one month. We do not use automated decision-making or profiling that produces legal or similarly significant effects about you.

8. Security

We apply reasonable technical and organisational measures including encrypted transmission (HTTPS/TLS), access controls, row-level database security, regular software updates, and platform-level backups. No system is 100% secure — please use a strong, unique password for your dashboard.

9. Cookies

See our Cookie Policy.

10. Children

Our services are not intended for under-18s and we do not knowingly collect data from minors.

11. Changes

Material changes are notified via dashboard message at least 30 days before taking effect.

12. Complaints

Contact us first at info@amberroyalmulti.com and we'll do our best to put things right. You also have the right to complain to the Nigeria Data Protection Commission (ndpc.gov.ng).