Colouresh data protection policy

This Data Protection Policy sets out how EshSpeaks LLP (“EshSpeaks,” “we,” “us”) handles personal data across the Colouresh platform, in compliance with the Nigeria Data Protection Act 2023 (NDPA) and, where applicable, the EU General Data Protection Regulation (GDPR).

While our Privacy Policy explains what this means for you as a user or visitor, this Data Protection Policy sets out the governing principles and internal standards by which EshSpeaks manages personal data as an organization, the framework behind that commitment.

EshSpeaks processes personal data in accordance with the following principles:

1. Lawfulness, fairness, and transparency: data is processed lawfully, fairly, and in a transparent manner
2. Purpose limitation: data is collected for specified, explicit, and legitimate purposes, and not processed further in a way incompatible with those purposes
3. Data minimization: only data that is adequate, relevant, and limited to what is necessary is collected
4. Accuracy: data is kept accurate and, where necessary, kept up to date
5. Storage limitation: data is kept only for as long as necessary for the purposes it was collected
6. Integrity and confidentiality: data is processed securely, protecting against unauthorized or unlawful processing, loss, destruction, or damage
7. Accountability: EshSpeaks is responsible for, and able to demonstrate, compliance with these principles

This Policy applies to all personal data processed by EshSpeaks in connection with Colouresh, including data relating to:

• Site visitors and readers
• Newsletter and email subscribers
• Commenters and contributors
• Job applicants and contractors engaging with EshSpeaks through the Site
• Any other individual whose personal data is processed through Colouresh's systems

It applies to all EshSpeaks staff, contractors, and third-party service providers who process personal data on our behalf.

EshSpeaks identifies and documents a lawful basis before processing any personal data. The lawful bases relied upon are: consent, contract, legal obligation, and legitimate interests as detailed in the Colouresh Privacy Policy, Section 4.

Where consent is the basis, it is:

• Freely given, specific, informed, and unambiguous
• Requested through a clear affirmative action (no pre-ticked boxes)
• As easy to withdraw as it is to give

Where EshSpeaks engages a third party (such as a hosting provider, email platform, or analytics service) to process personal data on its behalf, a written Data Processing Agreement (DPA) is put in place, requiring the processor to:

• Process data only on EshSpeaks' documented instructions
• Implement appropriate technical and organizational security measures
• Assist EshSpeaks in responding to data subject rights requests
• Notify EshSpeaks without undue delay of any data breach
• Delete or return data at the end of the engagement
• Not engage a sub-processor without prior authorization

EshSpeaks maintains a process for responding to data subject requests (access, rectification, erasure, restriction, portability, objection):

1. Requests are logged upon receipt at support@colouresh.com
2. Identity of the requester is verified before action is taken
3. Requests are actioned and responded to within one calendar month (extendable by two further months for complex requests, with notice to the requester)
4. Responses and actions taken are documented for accountability purposes

In the event of a personal data breach, EshSpeaks will:

1. Contain and assess the breach as soon as it is discovered
2. Determine whether the breach poses a risk to individuals' rights and freedoms
3. Where required, notify the relevant supervisory authority (the Nigeria Data Protection Commission and/or the applicable EU/UK authority) within 72 hours of becoming aware of the breach
4. Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms
5. Document all breaches, including facts, effects, and remedial action taken, regardless of whether notification was required

Personal data is retained only for as long as necessary. Retention periods are reviewed periodically and are set out in the Privacy Policy, Section 7. Data no longer required is securely deleted or anonymized.

Where personal data is transferred outside Nigeria, or the EEA/UK, EshSpeaks ensures appropriate safeguards are in place, such as standard contractual clauses, adequacy decisions, or equivalent mechanisms recognized under GDPR and the NDPA.

All EshSpeaks staff and contractors with access to personal data are required to:

• Understand and comply with this Policy and the Colouresh Privacy Policy
• Complete data protection awareness training appropriate to their role
• Report any suspected data breach immediately to the Data Protection Contact

This Policy is reviewed at least annually, or sooner if there is a material change in our processing activities, applicable law, or following a significant incident.

Questions about this Policy, or to report a data protection concern, should be directed to:

EshSpeaks LLP: Data Protection Contact
No. 2 Oshigba Street, Karu, Abuja
support@colouresh.com