NDPR Compliance Statement

NICOTAWINES Limited recognises that the protection of personal data is a fundamental right. We are committed to processing personal data lawfully, fairly, and transparently. We do not use personal data in ways that are incompatible with the purpose for which it was collected, and we take all reasonable steps to ensure data is accurate, secure, and retained only as long as necessary.

We are committed to:

• Processing personal data only in accordance with the seven data protection principles enshrined in the NDPR and NDPA
• Implementing appropriate technical and organisational security measures
• Respecting and facilitating the exercise of data subject rights
• Ensuring our third-party data processors operate under equivalent standards
• Reporting data breaches to the NDPB within the required timelines

Our data protection practices are governed by the following legislation and regulatory instruments:

• Nigeria Data Protection Regulation (NDPR) 2019 -- issued by NITDA
• NDPR Implementation Framework 2020
• Nigeria Data Protection Act (NDPA) 2023 -- signed into law by the Federal Government of Nigeria
• Nigeria Cybercrime (Prohibition, Prevention, etc.) Act 2015
• Consumer Protection Council Act

Where applicable, we also observe the General Data Protection Regulation (GDPR) for data subjects in the European Economic Area who interact with our services.

In accordance with the NDPR and NDPA, we adhere to the following principles when processing personal data:

• Lawfulness, fairness, and transparency: We process data on a legitimate legal basis and are transparent about how and why we use it
• Purpose limitation: Data is collected for specified, explicit, and legitimate purposes and not processed in a manner incompatible with those purposes
• Data minimisation: We collect only the data that is adequate, relevant, and necessary for the stated purpose
• Accuracy: We take reasonable steps to ensure personal data is accurate and kept up to date
• Storage limitation: Data is retained only for as long as necessary for the purpose it was collected, or as required by law
• Integrity and confidentiality: We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or destruction
• Accountability: We are responsible for and can demonstrate compliance with these principles

Under the NDPR and NDPA, we rely on the following lawful bases for processing personal data:

• Consent (Section 2.2, NDPR): Where you have given clear, informed, and unambiguous consent for us to process your data for a specific purpose, such as subscribing to our newsletter or accepting cookies
• Contract performance: Where processing is necessary for the performance of a contract to which you are a party, such as processing your order or managing your account
• Legal obligation: Where processing is necessary to comply with a legal obligation, including tax filings, customs documentation, and regulatory reporting
• Legitimate interests: Where processing is necessary for our legitimate business interests, such as fraud prevention, IT security, and improving our services, provided these interests do not override your fundamental rights and freedoms

Where we rely on consent as our lawful basis, we ensure that:

• Consent is obtained freely, specifically, informedly, and unambiguously
• Consent requests are presented clearly and separately from other terms
• You can withdraw consent at any time, as easily as it was given
• Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal
• We maintain records of when and how consent was obtained

To withdraw consent for marketing communications, you may use the unsubscribe link in any marketing email or contact us directly at info@nicotawines.com.

As a data subject, you have the following rights which we are committed to honouring:

• Right to be informed: You have the right to know what personal data we collect, how we use it, and with whom we share it
• Right of access (Subject Access Request): You may request a copy of all personal data we hold about you. We will respond within 30 days
• Right to rectification: You may request correction of any inaccurate or incomplete personal data
• Right to erasure (“right to be forgotten”): You may request deletion of your personal data where there is no compelling legal reason for continued processing
• Right to restrict processing: You may request that we temporarily stop processing your data while a complaint or dispute is being resolved
• Right to data portability: You may request that we provide your data in a structured, commonly used, and machine-readable format
• Right to object: You may object to processing based on legitimate interests or for direct marketing purposes at any time
• Rights related to automated decision-making: You have the right not to be subject to a decision based solely on automated processing that produces significant legal or similarly significant effects on you

To exercise any of these rights, please submit your request in writing to info@nicotawines.com. We will verify your identity before processing your request and respond within the statutory timeframe.

As part of our operations, we may transfer personal data to third-party service providers located outside Nigeria, including cloud infrastructure providers and email service platforms. Where such transfers occur, we ensure:

• The recipient country or organisation provides an adequate level of data protection
• Appropriate contractual safeguards are in place, including data processing agreements that bind recipients to NDPR-equivalent standards
• Such transfers are documented and subject to periodic review

We do not transfer personal data to countries without adequate data protection frameworks without first implementing appropriate safeguards.

We engage the following categories of third-party processors who may access your personal data as necessary to provide their services:

• Cloud database and hosting providers (Supabase, Vercel)
• Email delivery services (Resend)
• Payment processing partners
• Logistics and delivery partners
• Analytics providers

All processors are engaged under written data processing agreements that require them to process data only on our documented instructions, implement appropriate security measures, and comply with applicable data protection law. We conduct due diligence on all processors before engagement.

We have implemented a Data Breach Response Policy that sets out our procedures for detecting, investigating, and managing personal data breaches. In the event of a breach that is likely to result in a risk to the rights and freedoms of data subjects, we will:

• Notify the Nigeria Data Protection Bureau (NDPB) within 72 hours of becoming aware of the breach
• Notify affected data subjects without undue delay where the breach is likely to result in a high risk to their rights
• Document all breaches, including those that are not notifiable, in our internal breach register
• Take immediate remedial action to contain and mitigate the breach

In accordance with our obligations under the NDPR and NDPA, NICOTAWINES has designated a responsible officer to oversee data protection compliance. All data protection queries, subject access requests, and complaints should be directed to:

• Email: info@nicotawines.com
• Subject line: “Data Protection Enquiry”
• Address: 200 Ikotun-Idimu Road, Alimosho, Lagos, Nigeria

If you believe that your data protection rights have been violated, you have the right to lodge a complaint with the Nigeria Data Protection Bureau (NDPB), the regulatory authority responsible for overseeing compliance with the NDPA in Nigeria.

Nigeria Data Protection Bureau (NDPB):

• Website: ndpb.gov.ng
• Email: info@ndpb.gov.ng

We encourage you to contact us first so we can attempt to resolve your concern directly before escalating to the regulatory authority.

In compliance with Article 4.1(5) of the NDPR, NICOTAWINES commits to conducting an annual data protection audit to assess our compliance with data protection obligations, identify risks, and implement remedial measures where necessary. The results of these audits are reviewed by senior management and inform our ongoing data protection programme.

This NDPR Compliance Statement is reviewed annually or whenever there are significant changes to our data processing activities, applicable law, or regulatory guidance. The most current version is always available on our website.