Before publishing: replace everything in [square brackets] and ask a lawyer to review this page for your business. It is a starting template, not legal advice.
This privacy policy explains how Hills Integrated (“we”, “us”, “our”) collects, uses and protects personal data when you visit [yourdomain.com] (the “website”), contact us, or use our services. We are committed to handling your data in line with the Nigeria Data Protection Act 2023 (NDPA) and, where it applies to you, the EU and UK General Data Protection Regulation (GDPR).
1. Who we are
Hills Integrated is a [business name / registered company, RC number] based at [office address], Nigeria. For any privacy question, contact our data protection contact at [privacy@yourdomain.com] or call [+234 000 000 0000].
2. Data we collect
Information you give us
- Contact and project forms: your name, email address, phone or WhatsApp number, company name, the services you are interested in, budget range, timeline and any message you write.
- Call-back requests: your name, phone number, preferred date and time and the topic you want to discuss.
- Newsletter sign-up: your first name and email address.
- Messages: anything you send us by email, WhatsApp, phone or social media.
- Client projects: information needed to deliver our services, such as account access, content and billing details.
Information collected automatically
- Technical data such as your IP address, browser type, device and pages visited, recorded in server logs and by our form plugin for security and spam prevention.
- Cookies — see our Cookie Policy. Optional analytics cookies are only used if you click “Accept all”.
3. How and why we use your data
| Purpose | Lawful basis |
|---|---|
| Replying to enquiries, call-back requests and quote requests | Your consent and steps taken at your request before entering a contract |
| Delivering projects and support, invoicing and record keeping | Performance of a contract; legal obligation |
| Sending our newsletter | Your consent — you can withdraw it at any time |
| Keeping the website secure and preventing spam or fraud | Legitimate interests |
| Understanding how the website is used (analytics, if accepted) | Your consent |
We do not sell your personal data, and we do not use it for automated decision-making that has legal or similarly significant effects on you.
4. Where your data is stored and who we share it with
Form entries are stored in our website database hosted by [hosting provider] and may be copied to a Google Sheet in our Google Workspace account so our team can respond quickly. We share data only with service providers that help us run our business, such as:
- Web hosting and email providers
- Google (Workspace / Sheets, and Analytics if you accept analytics cookies)
- WhatsApp / Meta, when you choose to contact us on WhatsApp
- Accounting, payment and communication tools used to deliver projects
- Professional advisers and authorities where the law requires it
Some of these providers process data outside Nigeria. Where that happens we rely on adequate protection measures recognised under the NDPA, such as standard contractual clauses or the provider’s own data protection commitments.
5. How long we keep it
- Enquiries that do not become projects: up to 24 months, then deleted.
- Client and contract records: for as long as required by tax and company law (generally six years).
- Newsletter data: until you unsubscribe.
- Server and security logs: up to 12 months.
6. Your rights
Under the NDPA and, where applicable, the GDPR, you have the right to:
- access the personal data we hold about you;
- ask us to correct inaccurate data;
- ask us to delete your data;
- object to or restrict how we use it;
- withdraw consent at any time, without affecting earlier processing;
- receive your data in a portable format; and
- complain to the Nigeria Data Protection Commission (NDPC) or, if you are in the UK or EU, your local data protection authority.
To exercise any of these rights, email [privacy@yourdomain.com]. We will reply within 30 days.
7. Security
We use HTTPS encryption, strong passwords, two-step login, restricted access and regular updates and back-ups to protect your data. No system is perfectly secure, so please contact us immediately if you think your data has been put at risk.
8. Children
Our website and services are intended for businesses and adults. We do not knowingly collect data from anyone under 18.
9. Changes to this policy
We may update this policy from time to time. The latest version will always be on this page with the date it was last updated.
Last updated: October 6, 2026