Privacy Policy

1. Who we are

The data controller is Amber Royal Multi Ltd, a company registered in the Federal Republic of Nigeria (RC-803937), registered office Lagos, Nigeria. Data protection contact: info@amberroyalmulti.com.

2. Data we collect

• Account data — name, email, business name, phone number, login credentials.
• Payment data — payments are made by bank transfer directly to our GTBank account; we never collect or store card details.
• Project data — intake form responses, uploaded files, dashboard messages.
• Usage data — login times, dashboard activity, IP addresses, browser metadata.
• Your visitors' data — where your delivered website collects visitor data (e.g. contact forms), you are the controller and Amber Royal Multi acts as processor on your behalf.

3. Why we use it (lawful bases)

• Delivering the service you booked — contract performance (NDPA 2023, contract performance).
• Payment processing — contract performance.
• Service improvement and fraud prevention — legitimate interests (Art. 6(1)(f)).
• Marketing emails — consent only (Art. 6(1)(a)), and only if you opt in.
• Legal compliance — legal obligation (Art. 6(1)(c)).

4. Sub-processors

We use the following providers to run the service: Vercel (hosting infrastructure), Supabase (database and authentication), and Resend (transactional email). This list is kept current in this policy as the stack evolves.

5. International transfers

Where personal data is transferred outside Nigeria (for example to US-based infrastructure providers), we rely on appropriate safeguards consistent with the Nigeria Data Protection Act 2023.

6. How long we keep it

• Account data: while the account is active, then 6 years after closure (Nigerian tax and contract limitation periods).
• Payment records: 7 years (HMRC requirement).
• Project intake data: for the duration of the hosting relationship plus 6 years.
• Dashboard messages: duration of the hosting relationship plus 2 years.
• Marketing subscriptions: until you withdraw consent.

7. Your rights

Under the Nigeria Data Protection Act 2023 you can access, rectify, erase, restrict, port, and object to processing of your personal data, and withdraw consent where processing is based on consent. Email info@amberroyalmulti.com — we respond within one month.

8. Security

We apply reasonable technical and organisational measures including encrypted transmission (HTTPS/TLS), access controls, row-level database security, regular software updates, and platform-level backups. No system is 100% secure — please use a strong, unique password for your dashboard.

9. Cookies

See our Cookie Policy.

10. Children

Our services are not intended for under-18s and we do not knowingly collect data from minors.

11. Changes

Material changes are notified via dashboard message at least 30 days before taking effect.

12. Complaints

Contact us first at info@amberroyalmulti.com and we'll do our best to put things right. You also have the right to complain to the Nigeria Data Protection Commission (ndpc.gov.ng).