Privacy Policy

Who we are

We Dig Creativity Solutions (WDC Solutions) is a creative and digital agency operating from Nigeria. We design brands, build websites, applications and software, and run search and social media work for our clients.

We are registered with the Corporate Affairs Commission (CAC), Nigeria as WDC Solutions Hub, BN 8480926.

For the information described here we are the data controller: we decide why it is held and what happens to it. Where we hold your customers' information on your behalf while building or running something for you, you are the controller and we act on your instructions. You can reach us about anything in this document at info@wedigcreativity.com.ng.

What we collect

What you give us on our forms. The contact form asks for your name, email address, an optional phone number and your message. The onboarding brief asks about you, your business and the work you want: names, phone, email, company, industry, audience, goals, deadlines, who approves the work, and anything you choose to write. You may upload logos, pictures, documents and files. Some questions are optional, and we say which.

Unfinished briefs. While you fill in an onboarding brief, your answers are saved as a draft so you can leave and come back, in your browser and on our server. If you ask us to send you a link to continue later, or one of our team sends you a pre-filled link, the draft is tied to that link.

What we are given to do the work. Delivering a project often means being handed access to something that belongs to you: a domain, a hosting account, an analytics property, an advertising account, a store, a social media profile, a brand archive. These may contain personal data belonging to you, your staff or your customers. We treat all of it as yours, not ours.

Your account. If you sign in to the client portal we hold your name, email address, how you sign in (a password stored only as a salted hash, or your Google account), and a record of what you have viewed, approved and paid.

Payments. When you pay through our payment provider, they collect your card or bank details directly. We receive the result: the amount, the reference, the status, the date and the last digits or channel they report. We never see or store a full card number.

Meetings. Review meetings, calls and the handover meeting are held on Google Meet, Zoom or by phone, and may be recorded. We tell you before recording starts. A recording, the chat and any notes we take are personal information, and they may show your face, your voice, your screen and anything you say or open during the call.

Messages. We keep a record of the emails the system sends you, with the time and whether they were delivered, so that we do not send the same message twice and can answer 'did it reach me?'.

Collected automatically. Our hosting provider records ordinary server information when a page is requested: an IP address, the page, a timestamp, and the browser and device the request reports. This keeps the site running and secure.

We do not ask for, and do not want, payment card numbers, government identity numbers, health information or anything else sensitive. Please do not send them to us by email or in a form.

Why we hold it, and on what basis

To answer you. An enquiry cannot be replied to without a reply address. Our basis is your request, and the legitimate interest both of us have in the conversation happening.

To prepare and deliver an engagement. A brief is used to understand the work, plan it and quote it. Once a project is agreed we process what the work requires under the contract between us.

To remind you, once or twice, to finish something you started. See the Messages and Reminders Policy: we send at most two reminders about an unfinished brief, and every one carries a link that switches reminders off.

To meet obligations. Invoices, records of payment and tax records are kept because the law requires them.

To keep the site and your account safe. Server logs, sign-in checks, rate limits and the screening of throwaway email addresses rest on our legitimate interest in running a service that is available and not being abused. We also check new passwords against lists of passwords that have appeared in known breaches, by sending only a short fragment of a one-way fingerprint of the password, never the password itself.

If we ever want to use your information for something outside these, such as putting your name on a newsletter, we will ask you first and you will be able to say no without it affecting anything else.

Meetings and recordings

We may record review meetings and always offer a recorded handover meeting, so you can watch it again, share it with your own team and learn at your own pace. We tell you before we record and you may say no. If you do, we will give you a written walkthrough instead.

A recording is shared with you by a private link and is kept for the life of the engagement. After that we keep it for as long as we need it to deal with a question about the work, and delete it on your request unless the law requires us to keep it. Do not show or say anything on a recorded call that you do not want recorded, such as passwords or customer personal data.

Anyone you invite to a meeting is your responsibility. Tell them it may be recorded.

When we handle your customers' information for you

If we build, host or run something for you that collects or stores information about your customers, staff or visitors, such as a shop, a booking form, a mailbox or an app, you decide why that information is collected and how it is used. We act only on your instructions, as your processor, and treat it as confidential.

You are responsible for telling your own users what you collect, for having a lawful basis, for the consents and notices they are owed, and for answering their requests. We help where we reasonably can.

We use reasonable measures to keep it safe, we give it only to the suppliers needed to provide the service, and we tell you without undue delay if we learn of a breach that affects it. When the engagement or hosting ends we return it to you or delete it on your instruction, except what the law requires us to keep.

Showing work we have done

We are an agency, so our own marketing includes the work we have delivered. Published case studies, portfolio images and testimonials appear with the client's agreement.

If you would rather your project were not shown, or shown without naming you, tell us and we will take it down or anonymise it. You do not need to give a reason.

Who else sees it

We do not sell personal information, and we do not share it for anyone else's marketing.

Some of it passes through the suppliers who let us operate, and each sees only what its part of the job needs: the company that hosts this website, the database that stores forms and accounts, the storage that holds files you upload, the provider that carries our email, our payment provider, the scheduling tool used for meetings, and the tools we use to write, design and track project work. The chat assistant on the site is run by Jotform and is covered by the Cookie Policy.

Messaging apps. If you ask us to run a WhatsApp group or similar for your project, the app is operated by another company, and everyone in the group can see each other's names and numbers. Only add people who should see them.

Our team members see what they need for the projects they work on. Access is by individual account and is removed when someone leaves or changes role.

A client's own accounts, such as an advertising platform or an analytics property, are reached with access the client controls and can withdraw at any time. We never ask for a password to be sent to us.

We will disclose information where a law, a court or a regulator with proper authority requires it. If that happens and we are permitted to tell you, we will.

If the business were ever sold or merged, client records would pass to the new owner only on the same terms as this policy, and we would tell you first.

Leaving Nigeria

Several of the suppliers above operate outside Nigeria, so some information is stored or processed abroad. Where that happens we use established providers whose terms commit them to protecting the data and to restricting what they may do with it, and we send only what the task needs. By using the site or sending us information you understand this; where the Nigeria Data Protection Act asks for another safeguard or a specific consent, we rely on that instead.

How long we keep it

Unfinished onboarding briefs are deleted, with their resume links, after a set period from the last save. The default is 180 days.

A contact enquiry that does not become a project is kept so a conversation can restart, and is then anonymised: the name, address, phone and message are removed and only the topic and date remain for our records. We keep enquiries until we choose to run that clean-up, and we review the period at least once a year.

A submitted brief and the project records that follow are kept for the life of the engagement and for six years after it ends, the period in which a contractual question could still arise.

Financial records are kept for as long as Nigerian tax and company law requires.

Access we were given to your systems is given up when the engagement ends. If we still hold an access we no longer need, ask and we will remove it.

Invitations that were used, withdrawn or expired are deleted after 90 days. Expired sign-in sessions and security tokens are removed after a day.

Someone who unsubscribes from our messages is kept on a suppression list, because that record is what stops them being added again by mistake. If you ask us to erase your data, we keep only a one-way fingerprint of your address for that purpose.

How it is protected

This site is served over HTTPS. Passwords are never stored in readable form. Forms and sign-in are rate limited and checked on our server, not only in your browser. Links we email you for a draft, a payment or a reset are single purpose and expire. Access to client accounts and project systems is limited to the people working on that engagement.

We will not pretend to be impregnable. No website or company is, and a policy that claims otherwise is not being straight with you. What we can say is that we take reasonable measures, keep the number of people who can reach your data small, and if a breach affects your personal information we will tell you, and the regulator where the Nigeria Data Protection Act requires it, without undue delay.

Your rights

Under the Nigeria Data Protection Act 2023 you may ask us for a copy of the personal information we hold about you, ask us to correct it if it is wrong, ask us to delete it where we have no continuing reason to keep it, ask us to restrict what we do with it while a dispute is resolved, object to processing we carry out on the basis of legitimate interest or for direct marketing, withdraw a consent you gave, and ask for your information in a portable form.

Write to info@wedigcreativity.com.ng and we will respond within thirty days. There is no charge. We may need to confirm it is really you first. If we cannot do what you have asked, we will tell you why rather than simply declining.

If you are not satisfied with how we have handled a request, you can complain to the Nigeria Data Protection Commission. We would rather you came to us first, but that route is yours regardless.

Children

This website and our services are aimed at businesses and organisations, not at children. We do not knowingly collect personal information from anyone under eighteen. If you believe a child has sent us information, tell us and we will delete it.

Changes to this policy

When this policy changes, the date at the top of the page changes with it. If a change materially affects what we do with information we already hold, we will contact the clients affected rather than relying on them to notice.

Contact

Questions, requests and complaints about this policy all go to info@wedigcreativity.com.ng. A real person reads that address.