Privacy Policy

1. Introduction and Scope

This Privacy Policy explains how Sysmax Technologies Limited ("Sysmax", "we", "us" or "our") collects, uses, processes, stores, shares and protects personal data.

It applies to personal data processed through:

• Swift Cloud ERP and its associated modules and services;
• Our corporate website and product websites;
• Customer registration, subscription and account management;
• Our mobile applications and digital platforms;
• Customer support, email, telephone and live chat;
• Marketing campaigns, events, training and business engagements;
• Other services operated or provided by Sysmax.

This policy should be read together with applicable service agreements, subscription terms, Data Processing Agreements and other contractual documents governing our services.

Our privacy practices are guided by the Nigeria Data Protection Act 2023 (NDPA), applicable regulations, NDPC directives and other data protection laws that may apply to particular processing activities.

2. Who We Are

Swift Cloud ERP is a cloud-based enterprise resource planning platform owned and operated by Sysmax Technologies Limited, a Nigerian technology company.

Depending on the nature of the information and the processing activity, Sysmax may act in different capacities:

2.1 As a Data Controller

Sysmax acts as a Data Controller when it determines the purposes and means of processing personal data. This may include personal information collected for our own business operations, customer account administration, billing, marketing, recruitment, customer support and service administration.

2.2 As a Data Processor

Sysmax acts as a Data Processor when it processes personal data on behalf of a customer or another Data Controller through Swift Cloud ERP or related services. In such circumstances, we process the data in accordance with the customer's documented instructions, applicable contractual arrangements and data protection requirements.

Our regulatory certification does not transfer the customer's responsibilities as a Data Controller to Sysmax. Each party remains responsible for the obligations applicable to its role in a particular processing activity.

3. Information We Collect

The categories of personal data we collect depend on how you interact with us and which services you use.

3.1 Personal and Contact Information

• Full names and job titles;
• Email addresses and telephone numbers;
• Business addresses and contact details;
• Company and organisation information;
• Account registration and identification information.

3.2 Account and Subscription Information

• Account usernames and authentication information;
• Subscription plans, renewals and account history;
• Billing and transaction records;
• Service preferences and account configurations;
• Communications relating to subscriptions and support.

3.3 Business and ERP Information

Depending on the modules activated by a customer, Swift Cloud ERP may process information relating to the customer's employees, customers, suppliers, contractors, business partners and other individuals.

Such information may include:

• Employee and human resource records;
• Payroll and compensation information;
• Customer and supplier contact records;
• Accounting, invoicing and transaction records;
• Inventory, procurement and operational records;
• Attendance, leave and performance records;
• Other personal data entered by authorised customer users.

3.4 Technical and Usage Information

• IP addresses and device information;
• Browser type and operating system;
• Login dates, times and activity records;
• System logs, error reports and diagnostic information;
• Website usage and interaction information;
• Security and audit trail information.

3.5 Payment Information

We may receive payment confirmations, transaction references, payment status and related billing information from payment service providers.

Where payments are processed through an external payment gateway, card details are handled in accordance with the gateway provider's processes and applicable security standards. We do not intentionally store full payment card details on our application servers.

4. How We Collect Information

We may collect personal data through:

• Online account registration and subscription forms;
• Customer onboarding and implementation activities;
• Orders, purchases and payment transactions;
• Website enquiries, contact forms and feedback;
• Email, telephone, live chat and customer support;
• Surveys, events, training and marketing activities;
• Use of our applications and ERP services;
• Authorised third-party integrations and service providers;
• Information supplied by customers and authorised users.

Where we receive personal data from another person or organisation, we expect that the information has been collected and disclosed lawfully.

5. How We Use Information

We may use personal data for the following purposes:

• To create and administer customer accounts;
• To provide, operate and maintain Swift Cloud ERP;
• To configure and deliver subscribed modules and services;
• To process subscriptions, invoices and payments;
• To provide customer support and respond to enquiries;
• To authenticate users and protect accounts;
• To monitor service performance and troubleshoot errors;
• To maintain security, audit and compliance records;
• To communicate important service announcements;
• To improve our products, features and user experience;
• To conduct research, analytics and service development;
• To meet legal, regulatory and contractual obligations;
• To send marketing communications where legally permitted;
• To protect our rights, property, customers and systems.

We will not use personal data for purposes that are incompatible with the original purpose of collection unless we have an appropriate lawful basis or are otherwise permitted by law.

6. Lawful Basis for Processing

We process personal data only where an appropriate lawful basis exists under the Nigeria Data Protection Act 2023 and other applicable data protection requirements.

Depending on the processing activity, the lawful basis may include:

6.1 Consent

Where required, we obtain consent before processing personal data for the relevant purpose. Individuals may withdraw consent, subject to applicable legal requirements and the consequences of withdrawal.

6.2 Performance of a Contract

Processing may be necessary to provide services, administer subscriptions or fulfil contractual obligations.

6.3 Legal Obligations

We may process information where necessary to comply with applicable laws, regulatory requirements, court orders or lawful government requests.

6.4 Legitimate Interests

We may process information where necessary for legitimate business interests, provided those interests do not override the rights and freedoms of the affected individuals.

6.5 Vital Interests and Public Interest

Where applicable, processing may be necessary to protect vital interests or perform a task carried out in the public interest or under an official authority.

The applicable lawful basis is determined according to the nature, purpose and circumstances of each processing activity.

7. Customer and Business Data

Swift Cloud ERP enables organisations to manage business operations and maintain records relating to their employees, customers, suppliers and other individuals.

In these circumstances, the customer organisation will generally determine why and how such information is collected and used. The customer will ordinarily act as the Data Controller, while Sysmax acts as the Data Processor when processing the information on the customer's behalf.

7.1 Responsibilities of Sysmax as Data Processor

Subject to the applicable agreement and documented instructions, Sysmax will:

• Process customer personal data only for authorised purposes;
• Maintain appropriate technical and organisational safeguards;
• Restrict access to authorised personnel and systems;
• Maintain appropriate confidentiality obligations;
• Provide reasonable assistance with applicable data subject requests;
• Assist with security and breach management as required;
• Engage sub-processors subject to applicable contractual and legal requirements;
• Support customer compliance obligations where contractually required.

7.2 Responsibilities of Customer Organisations

Customers using Swift Cloud ERP are responsible for:

• Establishing an appropriate lawful basis for collecting and processing personal data;
• Providing required privacy notices to their employees, customers and other data subjects;
• Ensuring that personal data entered into the platform is collected lawfully;
• Managing user permissions and access rights within their organisation;
• Ensuring that authorised users handle information appropriately;
• Responding to data subject requests where they act as the Data Controller;
• Maintaining appropriate agreements and instructions with Sysmax;
• Ensuring that sensitive or special-category information is handled lawfully.

7.3 Data Processing Agreements

Where required by applicable law or the nature of the engagement, Sysmax may enter into a separate Data Processing Agreement (DPA) with customers. The DPA may specify the subject matter, duration, purpose and nature of processing, categories of personal data, data subject categories and responsibilities of each party.

8. Cookies and Tracking Technologies

Our websites and applications may use cookies, pixels, analytics tools and similar technologies to improve functionality, understand website usage and support marketing activities.

These technologies may be used to:

• Maintain sessions and remember user preferences;
• Support authentication and account security;
• Understand website traffic and user interactions;
• Measure the effectiveness of marketing campaigns;
• Improve website performance and user experience.

8.1 Third-Party Tracking Services

Depending on the services currently enabled on our websites, third-party technologies may include:

• Google Analytics and related Google services;
• Microsoft Clarity;
• Meta/Facebook Pixel;
• LinkedIn Insight Tag;
• Tawk.to live chat and support tools.

These providers may collect technical and usage information in accordance with their own privacy policies and service terms.

8.2 Managing Cookies

You may manage or disable cookies through your browser settings. However, disabling certain cookies may affect the availability or functionality of some website features.

Where consent is required by applicable law, we will seek appropriate consent before placing or activating non-essential cookies and tracking technologies.

9. Third-Party Services and Disclosure

We may share personal data with third parties where necessary to provide our services, fulfil contractual obligations, comply with legal requirements or support legitimate business operations.

These third parties may include:

• Cloud hosting and infrastructure providers;
• Payment processors and financial service providers;
• Email, SMS and communication service providers;
• Analytics and website performance providers;
• Technical support and software service providers;
• Professional advisers, auditors and legal representatives;
• Government authorities and regulatory agencies where legally required.

Where a third party processes personal data on our behalf, we take appropriate steps to ensure that suitable contractual, confidentiality and security obligations apply.

We do not sell personal data to third parties. We may disclose information where required by law, necessary to protect our rights or necessary to provide services requested by the user.

Non-personally identifiable or properly anonymised information may be used for statistical analysis, product improvement and business reporting.

10. International Data Transfers

Some of our hosting infrastructure, technology providers or service providers may operate outside Nigeria. As a result, personal data may be transferred to or accessed from other countries when necessary to provide our services.

Where personal data is transferred outside Nigeria, we will take steps required by the Nigeria Data Protection Act 2023 and applicable NDPC requirements to ensure that the transfer has a valid legal basis and appropriate safeguards.

Such safeguards may include applicable contractual protections, recognised transfer mechanisms, adequacy arrangements or other legally permitted safeguards.

We will also take reasonable steps to ensure that relevant service providers maintain appropriate confidentiality and security protections.

11. Data Security

We take the security of personal data seriously. As an NDPC-certified Data Controller and Data Processor of Major Importance, Sysmax recognises its responsibility to maintain appropriate organisational and technical measures to protect personal data against unauthorised access, disclosure, alteration, loss, misuse or destruction.

Depending on the system and service involved, security measures may include:

• Access controls and user authentication;
• Role-based permissions and restricted administrative access;
• Secure transmission of information using encryption technologies;
• System monitoring, logging and audit trails;
• Backup and recovery procedures;
• Malware protection and vulnerability management;
• Security updates and system maintenance;
• Confidentiality obligations for personnel and service providers;
• Incident detection, investigation and response procedures.

We periodically review our security measures in light of technological developments, operational risks and applicable regulatory requirements.

No internet transmission, electronic storage system or software platform can be guaranteed to be completely secure. We therefore cannot promise absolute security, but we remain committed to implementing and maintaining appropriate safeguards.

Customers are also responsible for protecting their login credentials, managing user access and promptly reporting suspected unauthorised access to their accounts.

12. Data Retention

We retain personal data only for as long as reasonably necessary to fulfil the purpose for which it was collected, provide contracted services, meet legal and regulatory obligations, resolve disputes and enforce agreements.

Retention periods may vary depending on:

• The type and sensitivity of the information;
• The purpose for which the information is processed;
• Applicable statutory and regulatory retention requirements;
• Contractual obligations and legitimate business requirements;
• Security, audit and dispute-resolution requirements.

When personal data is no longer required, we will take appropriate steps to delete, anonymise or securely dispose of it, subject to applicable legal requirements and legitimate retention obligations.

Data contained in backups, archives or disaster-recovery systems may remain for a limited period in accordance with our applicable backup and recovery procedures.

13. Data Subject Rights

Subject to applicable law and any lawful limitations, individuals whose personal data we process may have rights including:

• Right to be informed: To receive information about how personal data is processed.
• Right of access: To request access to personal data held about them.
• Right to rectification: To request correction of inaccurate or incomplete information.
• Right to erasure: To request deletion of personal data in circumstances permitted by law.
• Right to restrict processing: To request restriction of certain processing activities.
• Right to data portability: To request personal data in a commonly used and machine-readable format where applicable.
• Right to object: To object to certain processing activities, including direct marketing.
• Rights relating to automated decision-making: To exercise applicable rights where decisions are made solely through automated processing and produce legal or similarly significant effects.
• Right to withdraw consent: To withdraw consent where processing is based on consent.

13.1 How to Exercise Your Rights

Requests may be submitted using the contact details provided in Section 19 of this policy.

We may request reasonable information to verify the identity and authority of the person submitting a request. We will respond in accordance with applicable legal requirements.

Where Sysmax acts only as a Data Processor for a customer, we may refer the request to the relevant customer Data Controller or assist that customer in responding, as required by our contractual and legal obligations.

If you are dissatisfied with our handling of a request, you may also have the right to lodge a complaint with the Nigeria Data Protection Commission.

14. Marketing and Communications

We may use contact information to send service announcements, product updates, newsletters, promotional offers, event invitations and other relevant business communications, subject to applicable legal requirements.

Where required, we will obtain consent before sending marketing communications.

You may opt out of promotional emails by using the unsubscribe instructions provided in the message or contacting us directly. Opting out of marketing communications will not prevent us from sending essential service, account, security, billing or legally required notices.

15. Children's Privacy

Our services are primarily designed for organisations, businesses and authorised adult users. We do not knowingly collect personal data from children in circumstances prohibited by applicable law.

Where a service or customer deployment involves the personal data of children, the relevant processing must comply with applicable data protection requirements, including any additional safeguards, parental or guardian consent requirements where applicable.

If you believe that personal data relating to a child has been submitted to us unlawfully, please contact us so that the matter can be reviewed.

16. Data Breach Management and Incident Response

We maintain procedures for identifying, assessing, investigating, containing and responding to suspected personal data breaches and information security incidents.

Where a personal data breach occurs, we will assess its nature, scope, likely consequences and potential risks to affected individuals.

16.1 Regulatory Notification

Where required under the Nigeria Data Protection Act 2023 and applicable NDPC requirements, Sysmax will notify the Nigeria Data Protection Commission of a qualifying personal data breach within the applicable statutory timeframe.

16.2 Notification to Affected Individuals

Where a breach is likely to result in a high risk to the rights and freedoms of affected individuals, we will communicate the relevant information to those individuals as required by applicable law.

16.3 Incidents Involving Customer Data

Where Sysmax acts as a Data Processor and a personal data breach affects customer data, we will notify the relevant customer Data Controller without undue delay in accordance with applicable law and the relevant Data Processing Agreement or service contract.

We will provide reasonable assistance and relevant information to support the customer's assessment, regulatory notification and communication obligations.

17. Third-Party Websites and External Links

Our websites and applications may contain links to external websites, applications or services operated by third parties.

We do not control the privacy practices, content or security of external websites. Visiting those websites is subject to their own privacy policies and terms.

We encourage users to review the privacy policies of third-party services before providing personal information.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, business operations, technology, applicable laws or regulatory requirements.

The latest version will be published on this page with an updated revision date.

Where changes materially affect the way we process personal data or where notification is required by law, we will take appropriate steps to notify affected individuals or customers.

We encourage users to review this page periodically.