Summary: Citichoice Technology Ltd ("Citichoice", "we", "us", "our") is committed to protecting your personal data. This policy explains what data we collect, why we collect it, how we use it, and what rights you have. We comply with the UK General Data Protection Regulation (UK GDPR), the Nigeria Data Protection Regulation (NDPR), and applicable United States privacy laws including California Consumer Privacy Act (CCPA) where applicable.
1. Who We Are
Citichoice Technology Ltd is a global technology company incorporated in England and Wales (UK), the Federal Republic of Nigeria, and the United States of America. We operate an integrated ecosystem of digital platforms under the Citichoice brand, including:
- Citichoice Institute (institute.citichoice.net) — tech education and training
- Citichoice Developer (developer.citichoice.net) — digital solutions
- Citichoice Agent (agent.citichoice.net) — business services
- Citichoice Host (host.citichoice.net) — web infrastructure
- Citichoice News (news.citichoice.net) — news and media
- Citichoice Store (store.citichoice.net) — e-commerce
- Citichoice (citichoice.net) — our main corporate website
For the purposes of UK GDPR, Citichoice Technology Ltd is the data controller for personal data collected through citichoice.net and all sub-platforms listed above.
Our registered address for data protection matters is available on request. Our Data Protection contact is: privacy@citichoice.net
2. Data We Collect
2.1 Data You Provide Directly
- Account registration: name, email address, phone number, username, and password (stored as a hash — we never store plain text passwords)
- Profile information: profile photo, biography, professional experience, and preferences
- Course enrolment: payment details (processed via third-party payment providers — we do not store card numbers), billing address, and course preferences
- Business registration (Citichoice Agent): company name, directors' details, address, CAC-required documents, and identification documents
- Hosting orders (Citichoice Host): domain name, billing information, and technical configuration preferences
- E-commerce orders (Citichoice Store): delivery address, order history, and payment information
- Communications: messages sent to support, feedback, survey responses, and newsletter subscriptions
2.2 Data Collected Automatically
- Usage data: pages visited, features used, time spent, click patterns, and search queries
- Device and technical data: IP address, browser type, operating system, device type, screen resolution, and referral URL
- Cookies and similar technologies: session cookies, persistent cookies, and local storage (see Section 9)
- Log files: server access logs, error logs, and security event logs
2.3 Data From Third Parties
- Social sign-in (Google): if you use Google Sign-In, we receive your name, email address, and profile photo from Google
- Payment processors: transaction confirmations, refund status, and payment method type (not full card details)
- Analytics providers: aggregated and anonymised usage statistics
3. How We Use Your Data
We use your personal data for the following purposes:
- Providing our services: creating and managing your account, processing enrolments, delivering courses, processing orders, and providing customer support
- Communication: sending order confirmations, course updates, support responses, and system notifications
- Marketing (with consent): sending you newsletters, product announcements, and promotional offers about Citichoice products — you can unsubscribe at any time
- Personalisation: recommending courses, products, or services based on your history and preferences
- Security and fraud prevention: monitoring for suspicious activity, verifying identity, and protecting our users and systems
- Legal compliance: meeting our obligations under UK, Nigerian, and US law, including tax obligations, regulatory reporting, and responding to lawful requests
- Improvement: analysing usage patterns to improve our platforms, fix bugs, and develop new features
- Research: conducting anonymised research to understand how our platforms are used
We do not sell your personal data to third parties. We do not allow third-party advertisers to target you based on your personal data collected through Citichoice platforms.
4. Legal Basis for Processing (UK GDPR)
For users in the United Kingdom and European Economic Area, we process your personal data under the following legal bases:
- Contract performance (Article 6(1)(b)): to fulfil our obligations to you when you purchase a course, place an order, or use our services
- Legitimate interests (Article 6(1)(f)): to improve our services, prevent fraud, ensure security, and conduct analytics — where our interests do not override your rights
- Consent (Article 6(1)(a)): for marketing communications and the use of non-essential cookies
- Legal obligation (Article 6(1)(c)): to comply with applicable laws, including tax and regulatory requirements
For users in Nigeria, we process your data in accordance with the Nigeria Data Protection Regulation (NDPR) and the Nigeria Data Protection Act (NDPA) 2023.
For users in the United States, we comply with applicable state privacy laws including the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) for California residents.
5. Sharing Your Data
We may share your personal data with:
- Service providers: companies that help us operate our platforms, including hosting providers, payment processors, email service providers, and analytics tools — all bound by data processing agreements
- Payment processors: Paystack, Flutterwave, Stripe, or similar providers process payments on our behalf — they are independently PCI-DSS compliant
- Google: if you use Google Sign-In, data is shared with Google under their privacy policy
- Legal authorities: where required by law, court order, or regulatory request in the UK, Nigeria, or the US
- Business transfers: in the event of a merger, acquisition, or sale of all or part of our business — you will be notified before your data is transferred
- Citichoice Foundation: anonymised and aggregated data may be shared for impact reporting purposes only — no personally identifiable information is shared
We do not share your data with any other third parties without your explicit consent.
6. Data Retention
We retain your personal data for as long as necessary to provide our services and meet our legal obligations:
- Active accounts: retained for the duration of your account and for 3 years after your last activity
- Course completion records and certificates: retained indefinitely to verify your qualifications
- Financial records: retained for 7 years to meet tax and accounting obligations in the UK and Nigeria
- Marketing data: retained until you unsubscribe or withdraw consent
- Security logs: retained for 12 months
- Support communications: retained for 3 years
When your data is no longer required, we securely delete or anonymise it.
7. Data Security
We implement appropriate technical and organisational measures to protect your personal data, including:
- All data in transit is encrypted using TLS 1.2 or higher (HTTPS)
- Passwords are hashed using bcrypt — we never store or access your plain text password
- Access to personal data is restricted to authorised personnel on a need-to-know basis
- We conduct regular security assessments and keep our systems patched
- Payment processing is handled by PCI-DSS compliant third-party providers — we do not store card details
- We maintain an incident response plan and will notify you and relevant authorities of a data breach in accordance with UK GDPR requirements (within 72 hours) and NDPR requirements
While we take all reasonable steps to protect your data, no system is completely secure. If you believe your Citichoice account has been compromised, please contact us immediately at security@citichoice.net.
8. Your Rights
Depending on your jurisdiction, you have the following rights regarding your personal data:
UK & EEA (UK GDPR)
- Right of access: request a copy of the personal data we hold about you
- Right to rectification: request correction of inaccurate or incomplete data
- Right to erasure: request deletion of your data where there is no legitimate reason for us to retain it
- Right to restrict processing: request that we limit how we use your data
- Right to data portability: receive your data in a structured, machine-readable format
- Right to object: object to processing based on legitimate interests or for direct marketing purposes
- Rights related to automated decision-making: not be subject to solely automated decisions that significantly affect you
- Right to withdraw consent: withdraw consent at any time where processing is based on consent
Nigeria (NDPR / NDPA)
- Right to be informed about how your data is used
- Right to access your personal data
- Right to correction of inaccurate data
- Right to deletion of your data
- Right to object to processing
California, USA (CCPA / CPRA)
- Right to know what personal information we collect, use, disclose, or sell
- Right to delete personal information
- Right to opt out of the sale of personal information (we do not sell personal information)
- Right to non-discrimination for exercising your rights
- Right to correct inaccurate personal information
- Right to limit use and disclosure of sensitive personal information
To exercise any of these rights, please contact us at privacy@citichoice.net. We will respond within 30 days (UK GDPR: 1 month). We may need to verify your identity before processing your request.
If you are in the UK and are unhappy with how we have handled your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk. If you are in Nigeria, you may contact the Nigeria Data Protection Commission (NDPC).
9. Cookies & Tracking
We use cookies and similar technologies to make our platforms work and to improve your experience. Our cookies fall into the following categories:
- Strictly necessary cookies: required for login, session management, and security — these cannot be disabled
- Functional cookies: remember your preferences such as language and display settings
- Analytics cookies: help us understand how visitors use our platforms (e.g. pages viewed, traffic sources) — these are only set with your consent
- Marketing cookies: used to show relevant content — only set with your explicit consent
You can manage your cookie preferences through our cookie consent banner when you first visit any Citichoice platform, or through your browser settings. Note that disabling strictly necessary cookies will affect the functionality of our services.
10. Children's Privacy
Our commercial platforms (Institute, Developer, Agent, Host, Store) are intended for users aged 18 and over. We do not knowingly collect personal data from children under 18 through these platforms.
Citichoice Foundation operates programmes that involve children. Any data collected in connection with Foundation programmes is handled with the highest level of care, with appropriate parental consent obtained, and is kept strictly separate from commercial platform data.
The planned Citichoice Academy will have its own dedicated privacy policy appropriate for an educational institution serving minors, in compliance with UK, Nigerian, and US education data protection laws (including FERPA in the US).
If you believe we have inadvertently collected data from a child under 18 through a commercial platform, please contact us at privacy@citichoice.net and we will delete it immediately.
11. International Data Transfers
As a company incorporated in the UK, Nigeria, and the US, your data may be transferred between these jurisdictions. We ensure that all cross-border data transfers are protected by appropriate safeguards:
- UK to Nigeria / US: transfers are made under UK GDPR Article 46 mechanisms including Standard Contractual Clauses (SCCs)
- Nigeria to UK / US: transfers comply with NDPR requirements including Data Transfer Agreements
- All third-party service providers who receive data from us are bound by data processing agreements that include appropriate transfer safeguards
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make significant changes, we will:
- Update the "Last updated" date at the top of this policy
- Notify registered users by email where the changes materially affect how we use their data
- Display a notice on our websites for a period following the change
Your continued use of Citichoice platforms after the effective date of any updated policy constitutes your acceptance of the changes.
If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:
We take all privacy enquiries seriously and aim to respond within 5 business days.