Data Protection Policy

This Data Protection Policy (“Policy”) sets out the framework, principles, responsibilities, and controls that govern how MARTINO NOIR LIMITED (“the Company”, “we”, “us”, or “our”) collects, processes, stores, and protects personal data in the course of conducting its business as a fashion accessories company.

While our Data Privacy Policy is an external-facing document addressed to our customers and website users, this Data Protection Policy is an internal governance document that establishes how we, as an organisation, manage our data protection obligations and embed a culture of privacy across all our functions and operations.

This Policy is intended to ensure that the Company processes personal data lawfully, fairly, and transparently, and that it upholds the rights of all data subjects in accordance with the Nigeria Data Protection Act 2023 (NDPA), the General Application and Implementation Directive (GAID), the Nigeria Data Protection Regulation 2019 (NDPR), and all applicable international best practices.

This Policy applies to:

• All personal data processed by the Company in whatever format, whether electronic, paper-based, audio, or visual;
• All personal data relating to customers, website visitors, employees, job applicants, contractors, suppliers, and any other data subjects;
• All employees, directors, officers, and members of the Board of MARTINO NOIR LIMITED;
• All contractors, consultants, interns, and temporary staff engaged by or working on behalf of the Company;
• All third-party service providers and data processors who handle personal data on behalf of the Company, to the extent set out in their data processing agreements.

This Policy is grounded in and must be read in conjunction with the following legal instruments and frameworks:

• Nigeria Data Protection Act 2023 (NDPA)
• General Application and Implementation Directive (GAID) issued by the NDPC
• EU General Data Protection Regulation (GDPR), to the extent applicable
• Companies and Allied Matters Act 2020 (CAMA)
• Consumer Protection Framework of the Federal Competition and Consumer Protection Commission (FCCPC)
• National Information Technology Development Agency Act (NITDA Act)
• Any sector-specific guidance issued by the NDPC

The Company is committed to processing all personal data in accordance with the following core data protection principles as enshrined in the NDPA and GAID:

Principle 1: Lawfulness, Fairness, and Transparency

— Personal data must be processed lawfully, fairly, and in a transparent manner. Data subjects must be clearly informed of how their data is used through clear and accessible privacy notices and this Policy.

Principle 2: Purpose Limitation

— Personal data must be collected for specified, explicit, and legitimate purposes and must not be processed in a manner incompatible with those purposes. Once data has served its purpose, it must not continue to be used for unrelated activities without a fresh legal basis.

Principle 3: Data Minimisation

— Only personal data that is adequate, relevant, and limited to what is necessary for the intended purpose must be collected. The Company must not collect data speculatively or in excess of what is required.

Principle 4: Accuracy

— Personal data must be accurate and, where necessary, kept up to date. Inaccurate data must be corrected or deleted without undue delay. The Company must put in place reasonable steps to ensure the accuracy of data it holds.

Principle 5: Storage Limitation

— Personal data must not be retained in an identifiable form for longer than is necessary for the purpose for which it was collected. Data that is no longer required must be securely deleted, anonymised, or destroyed in line with our Data Retention Policy.

Principle 6: Integrity and Confidentiality (Security)

— Personal data must be processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical and organisational measures.

Principle 7: Accountability

— The Company, as Data Controller, is responsible for and must be able to demonstrate compliance with all of the above principles. The Board and senior management bear ultimate responsibility for embedding data protection across the Company.

The Company shall not process any personal data unless a valid lawful basis exists under the NDPA. The lawful bases available to the Company are:

The Company does not ordinarily collect sensitive personal data (also referred to as special categories of data) in the course of its fashion accessories business. However, where sensitive personal data is inadvertently received, or is required in a specific context (such as health information required to accommodate a disability during recruitment), it must be processed with additional care and only where one of the following additional conditions is satisfied:

• The data subject has given explicit consent
• Processing is necessary for carrying out obligations in the field of employment law
• Processing is necessary for reasons of substantial public interest, with appropriate safeguards
• Any other condition specified under the NDPA or GAID

The Company is committed to upholding the rights of all data subjects under the NDPA and GAID. These rights include the right to access, rectify, erase, restrict processing of, and port personal data, as well as the right to object and the right not to be subject to solely automated decisions.

All data subject rights requests must be:

• Logged and acknowledged within 5 working days of receipt
• Responded to fully and substantively within 30 days of receipt
• Escalated to the DPO for supervision and approval of the response
• Documented with records of the request, the response, and any actions taken

Where the Company relies on consent as the legal basis for processing, the following requirements must be met:

• Consent must be sought through a clear, affirmative action by the data subject. Pre-ticked boxes, silence, and inactivity do not constitute valid consent
• The specific purposes for which consent is sought must be clearly described
• Consent must be granular, meaning the data subject should be able to consent separately to different types of processing
• A record of all consents obtained, including the date, the form of consent, and the specific purposes consented to, must be maintained
• Withdrawal of consent must be as easy as giving it. Opt-out mechanisms must be clearly visible and functional
• Where consent is withdrawn, processing must cease promptly unless another lawful basis applies

The Company must actively apply the principles of data minimisation and purpose limitation in its operational processes:

• Before collecting any new category of personal data, staff must confirm that the data is necessary for a defined purpose and that there is no less privacy-intrusive way to achieve the same result
• Data collection forms, both physical and digital, must request only the fields that are strictly necessary
• Personal data must not be retained in emails, spreadsheets, messaging applications, or shared folders beyond what is necessary
• Personal data must not be repurposed for activities that are incompatible with the original collection purpose without a new lawful basis and, where required, a fresh consent

The Company is responsible for ensuring that third parties who process personal data on its behalf do so in accordance with applicable data protection law. The following requirements apply to all third-party data processors:

• No third party may be engaged to process personal data on behalf of the Company without prior review and approval by the DPO
• A written Data Processing Agreement (DPA) must be in place with every data processor before processing begins. The DPA must comply with the requirements of the NDPA and GAID and must include obligations relating to confidentiality, security, sub-processing, data subject rights, and breach notification
• The DPO must conduct periodic due diligence assessments of all data processors to verify their compliance with applicable data protection obligations
• Where a processor engages a sub-processor, the same data protection obligations must be imposed on the sub-processor by contract

The Company must conduct a Data Protection Impact Assessment (DPIA) before commencing any new processing activity that is likely to result in a high risk to the rights and freedoms of data subjects. Circumstances that are likely to require a DPIA include:

• Introducing a new digital product, service, or feature that involves large-scale processing of personal data
• Implementing new profiling or automated decision-making systems
• Processing sensitive personal data on a large scale
• Adopting new surveillance or tracking technology
• Sharing personal data with new third parties or transferring data internationally for the first time

The Company has a documented Incident Response and Data Breach Management Procedure. In summary:

• Any actual or suspected personal data breach must be reported to the DPO immediately and no later than 24 hours after discovery
• The DPO will assess the nature, scope, and risk level of the breach and determine the appropriate response
• Where a breach is likely to result in a risk to the rights and freedoms of data subjects, the DPO must notify the NDPC within 72 hours of the Company becoming aware of the breach
• Where a breach is likely to result in a high risk to affected individuals, those individuals must also be notified without undue delay
• All breaches, including those that do not meet the notification threshold, must be recorded in the Company’s Data Breach Register
• Following each breach, a root cause analysis and lessons-learned review must be conducted, and any necessary remediation measures must be implemented

Where personal data is transferred outside Nigeria in connection with our business operations, the following requirements apply:

• The DPO must be consulted before any new international transfer of personal data is established
• Transfers may only proceed where appropriate safeguards are in place, including adequacy decisions by the NDPC, standard contractual clauses, or other approved mechanisms
• All international transfers must be documented in the ROPA with the applicable safeguard identified

The DPO is responsible for maintaining and keeping current the Company’s Record of Processing Activities (ROPA) in accordance with the NDPA and GAID. The ROPA must include, for each processing activity:

• The name and contact details of the Data Controller and DPO
• The purposes of the processing
• A description of the categories of data subjects and personal data processed
• The categories of recipients to whom the data has been or will be disclosed
• Details of any international transfers
• The retention periods applicable to each category of data
• A description of the security measures in place

Data protection is a shared organisational responsibility. The Company is committed to ensuring that all relevant staff receive appropriate and regular training on their data protection obligations. Specifically:

• All new staff must complete data protection induction training before handling personal data
• All staff must complete refresher data protection training at least once every 12 months
• Specialist training must be provided to staff in roles with heightened data protection responsibilities, such as the DPO, IT staff, marketing staff, and customer service representatives
• Training records must be maintained and are subject to audit

This Policy must be reviewed by the DPO at least once every 12 months, or earlier in the event of:

• A material change in applicable law or regulatory guidance
• A significant change in the Company’s business model, processing activities, or technology
• A significant data protection incident or breach
• A recommendation from an audit, DPIA, or regulatory inspection

All data protection queries, concerns, and incidents must be directed to: