Colouresh privacy policy

Effective date: 25 September 2026 · Last updated: 25 September 2026

1. Introduction

Colouresh (“we,” “us,” “our”) is a media and storytelling platform operated by EshSpeaks LLP (“EshSpeaks,” the “Company”), a company registered in Nigeria, with its registered address at No. 2 Oshigba Street, Karu, Abuja.

This Privacy Policy explains how we collect, use, store, share, and protect personal data when you visit colouresh.com (the “Site”), interact with our content, subscribe to our newsletters, or otherwise engage with us.

We are committed to protecting your privacy in line with applicable data protection laws, including the Nigeria Data Protection Act 2023 (NDPA) and, where it applies to you (for example, if you are located in the European Economic Area, the UK, or another jurisdiction covered by it), the EU General Data Protection Regulation (GDPR).

By using the Site, you acknowledge that you have read and understood this Policy. If you do not agree with it, please do not use the Site.

2. Who we are: the data controller

EshSpeaks LLP is the data controller responsible for your personal data collected through Colouresh.

Contact details:

Company: EshSpeaks LLP
Address: No. 2 Oshigba Street, Karu, Abuja
Email: support@colouresh.com

If you have any questions about this Policy or how your data is handled, contact us using the details above.

3. What personal data we collect

We collect personal data in the following categories:

3.1 Information you give us directly

Name, email address, and other details you provide when registering, subscribing to a newsletter, commenting, submitting a contact form, or entering a competition or promotion
Content you post, such as comments, replies, or contributions
Correspondence you send us directly

3.2 Information collected automatically

IP address and approximate location
Device and browser type, operating system
Pages visited, time spent on pages, referring/exit pages
Interaction data (clicks, scroll depth, search queries on the Site)
Cookie and tracking technology data (see our separate Cookies Policy)

3.3 Information from third parties

If you log in or interact with us via a third-party service (for example, a social login), we may receive basic profile information from that service, subject to your settings with that provider
Information from analytics and advertising partners

We do not knowingly collect special category data (such as health, religious belief, political opinion, or biometric data) unless you voluntarily provide it, for example within a comment or submission. Please avoid sharing this kind of information with us unless necessary.

4. How and why we use your data (legal basis)

Under GDPR, we must have a valid legal basis for processing personal data. We rely on the following:

Purpose	What we do	Legal basis
Operating and maintaining the Site	Delivering content, ensuring functionality and security	Legitimate interest
Newsletter and subscription delivery	Sending content you've opted in to receive	Consent
Responding to enquiries	Replying to messages, comments, or support requests	Legitimate interest / Contract
Analytics and site improvement	Understanding how the Site is used to improve it	Consent (via cookie preferences) / Legitimate interest
Advertising	Serving relevant, non-intrusive ads	Consent (via cookie preferences)
Legal compliance	Meeting legal or regulatory obligations	Legal obligation
Fraud prevention and security	Protecting the Site and its users	Legitimate interest

You may withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

5. How we share your data

We do not sell your personal data. We may share it with:

Service providers who help us run the Site (hosting, email delivery, analytics, customer support tools), under contractual obligations to protect your data
Advertising and analytics partners, only where you have consented via cookie preferences
Legal and regulatory authorities, where required by law, court order, or to protect our rights, property, or safety, or that of our users
A successor entity, in the event of a merger, acquisition, or sale of all or part of our business, subject to equivalent protections

All third parties are required to respect the security of your data and to treat it in accordance with applicable law.

6. International data transfers

Where your data is transferred outside Nigeria or the European Economic Area (for example, to a hosting or analytics provider based elsewhere), we take steps to ensure an adequate level of protection is applied, including through standard contractual clauses, adequacy decisions, or equivalent safeguards recognized under GDPR and the NDPA.

7. Data retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. As a general guide:

Newsletter subscriber data: retained until you unsubscribe, plus a reasonable period thereafter for record-keeping
Comment and contribution data: retained for as long as the content remains published, unless removal is requested
Analytics data: typically retained in aggregated or anonymized form after 24 months
Enquiry and correspondence data: retained for up to 3 years for reference and legal purposes

When personal data is no longer needed, we securely delete or anonymize it.

8. Your rights

Depending on your location, you have the following rights over your personal data:

Right of access: request a copy of the personal data we hold about you
Right to rectification: request correction of inaccurate or incomplete data
Right to erasure: request deletion of your data, subject to legal exceptions
Right to restrict processing: request that we limit how we use your data
Right to data portability: request your data in a structured, machine-readable format
Right to object: object to processing based on legitimate interest or for direct marketing
Right to withdraw consent: withdraw consent at any time where processing relies on it
Right to lodge a complaint: with a supervisory authority (in Nigeria, the Nigeria Data Protection Commission (NDPC); in the EU/UK, your local data protection authority)

To exercise any of these rights, contact us at support@colouresh.com. We will respond within the timeframe required by applicable law (generally one month under GDPR).

9. Data security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, including encryption in transit, access controls, and regular security review. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Children's privacy

Colouresh is not directed at children under the age of 13 (or the relevant minimum age in your jurisdiction), and we do not knowingly collect personal data from children. If we become aware that we have collected data from a child without appropriate consent, we will take steps to delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be indicated by updating the “Last Updated” date at the top of this Policy, and, where appropriate, through a notice on the Site.

12. Contact us

If you have questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact:

EshSpeaks LLP
No. 2 Oshigba Street, Karu, Abuja
eshspeaks25@gmail.com