Privacy Policy

ITSA Global Technologies Limited ("ITSA", "we", "our", or "us") is a technology company registered and operating in Nigeria. We develop and operate a suite of Software-as-a-Service (SaaS) platforms for businesses across Africa, including the ITSA Business Platform, ITSA EduClass, and ITSA CliniqPro.

This Privacy Policy applies to all visitors, users, and businesses ("you") that access our website at itsaglobal.tech or use any of our products and services, including our WhatsApp Business messaging services.

We use collected information for the following purposes:

WhatsApp Business Messaging: We use the Meta WhatsApp Business API, facilitated through Twilio, to send transactional and informational messages to users who have opted in. These include booking confirmations, payment receipts, appointment reminders, and platform alerts. By providing your WhatsApp number and opting in, you consent to receiving these messages. You may opt out at any time by replying STOP or contacting us directly.

We do not sell your personal data to third parties. We share information only in the following circumstances:

We retain your personal data for as long as necessary to:

• Maintain your active account and provide contracted services
• Comply with legal, tax, and regulatory obligations (typically 6 years under Nigerian law)
• Resolve disputes and enforce our agreements

When you close your account, we will delete or anonymise your personal data within 90 days, except where retention is required by law or legitimate business interest. Client data you have uploaded to the platform will be deleted within 30 days of account closure unless you request an earlier deletion.

We implement comprehensive technical and organisational security measures:

• Encryption: All data transmitted over HTTPS/TLS. Database encryption at rest via Supabase.
• Access Controls: Role-based access control (RBAC) with principle of least privilege. Multi-factor authentication available.
• Row-Level Security: Database-level policies ensuring tenant data isolation.
• CSRF Protection: All state-changing API endpoints protected against cross-site request forgery.
• Webhook Security: HMAC-SHA512 verification for all incoming webhooks.
• Rate Limiting: API rate limiting to prevent brute force and abuse.
• Security Audits: Regular security assessments and vulnerability management. Our platform holds a 9/10 security rating.
• Incident Response: We have procedures to detect, report, and investigate data breaches. We will notify affected users within 72 hours of becoming aware of a breach.

You have the following rights regarding your personal data:

To exercise any of these rights, contact us at privacy@itsaglobal.tech. We will respond within 30 days. We may need to verify your identity before processing your request. There is no charge for most requests, but we may charge a reasonable fee for manifestly unfounded or excessive requests.

Our use of WhatsApp Business API complies with the Meta WhatsApp Business Policy and Meta Commerce Policy. Specifically:

• We only send messages to users who have provided explicit opt-in consent.
• Every WhatsApp message from us includes a clear way to opt out.
• We do not use WhatsApp to send unsolicited bulk marketing messages.
• We do not use WhatsApp to send prohibited content including spam, misleading information, or content that violates Meta's policies.
• Message templates are pre-approved by Meta before use.
• We maintain records of all opt-ins as required by Meta's policies.
• Users can opt out at any time by replying STOP to any of our WhatsApp messages or contacting us directly.

We use the following types of cookies:

You can control cookies through your browser settings. Disabling essential cookies will affect your ability to log in and use the platform. Analytics and marketing cookies can be disabled without affecting core functionality.

Our services are intended for businesses and individuals aged 18 years and above. We do not knowingly collect personal data from children under 18. If we become aware that a child under 18 has provided us with personal data, we will delete such data promptly. If you believe a child has provided their data to us, please contact us immediately at privacy@itsaglobal.tech.

Your data may be transferred to and processed in countries outside Nigeria, including the United States and the European Union, by our service providers listed in Section 4.1. We ensure that such transfers are protected by appropriate safeguards, including standard contractual clauses and data processing agreements with our service providers.

Our platform may contain links to third-party websites or services. This Privacy Policy applies only to ITSA Global Technologies' platforms. We are not responsible for the privacy practices of third-party sites. We encourage you to review the privacy policies of any third-party services you access.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Send an email notification to all registered account holders
• Display a prominent notice on our platform for 30 days

Your continued use of our services after any changes constitutes your acceptance of the updated Privacy Policy.

This Privacy Policy is governed by the laws of the Federal Republic of Nigeria, including the Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act (NDPA) 2023. Any disputes will be resolved in the courts of Oyo State, Nigeria.

For any privacy-related questions, requests, or complaints, please contact us:

If you are not satisfied with our response, you have the right to lodge a complaint with the Nigerian Data Protection Commission (NDPC) at ndpc.gov.ng.