What personal data Emvert collects through this website and the platform, why, how long it is kept, who it is shared with, and the rights you have over it under the Nigeria Data Protection Act 2023.
Emvert Technologies Limited (“Emvert”, “we”, “us”) provides sustainability reporting and carbon accounting software to companies in Nigeria. We are based in Lagos, Nigeria.
For personal data collected through this website and through our own business operations, Emvert is the data controller — we decide why and how it is processed.
For personal data held inside a customer’s account in the platform, the customer is the controller and Emvert is a processor acting on their instructions. That relationship is governed by our data processing agreement rather than by this notice.
Questions about this notice, or about any personal data we hold, go to privacy@emvert.com.
| Data | Where from | Why | Lawful basis |
|---|---|---|---|
|
Name, work email, company, role, phone |
Demo and contact forms |
To respond to your enquiry and, where you asked, to follow up about your reporting cycle |
Legitimate interest; consent where you ticked the follow-up box |
|
Email address and calculator inputs |
The free tools |
To send you the result you asked for |
Performance of a request you made |
|
Account details and activity logs |
Platform use |
To operate the service, support you, and maintain the audit record the product exists to provide |
Contract |
|
Usage analytics |
This website |
To understand which pages are useful and where people get stuck |
Consent |
|
Billing and contracting details |
Commercial relationship |
To invoice, collect payment and meet our own accounting and tax obligations |
Contract; legal obligation |
We do not collect special categories of personal data through this website, and we do not buy contact lists.
Stated explicitly because these are the questions people actually have.
Not to data brokers, not to partners, not in any form. There is no arrangement under which your details are transferred for anyone else's commercial use.
Using a calculator sends you that result. It does not subscribe you to anything. Marketing email requires a separate, specific opt-in.
Customer emissions data is not aggregated into market research, benchmarking products or anything else without a separate written agreement.
No advertising pixels, no cross-site identifiers, no retargeting.
We use a small number of service providers to run the business, and they process personal data on our instructions only. They include hosting and infrastructure providers, an email delivery provider for transactional messages, an analytics provider where you have consented, and standard professional advisers — accountants, auditors and lawyers.
The current list of sub-processors used to deliver the platform is set out in the data processing agreement, and we notify customers of changes to it in advance.
We may also disclose personal data where we are legally required to — for example in response to a valid order from a court or regulator. Where we are permitted to tell you that has happened, we will.
Some of our service providers operate outside Nigeria, which means personal data may be transferred outside the country. Where that happens we rely on the transfer mechanisms permitted under the Nigeria Data Protection Act 2023 and put appropriate contractual protections in place with the recipient.
Customers with specific data residency requirements should raise them before contracting. We would rather tell you plainly what is and is not possible than discover the mismatch during a security review.
| Data | Retention | Why |
|---|---|---|
|
Enquiry and demo form submissions |
24 months from last contact |
So we can pick up a conversation where it left off |
|
Tool result requests |
12 months |
To resend a result if you ask |
|
Customer account data |
Term of the agreement, then per the DPA |
Contractual |
|
Activity and access logs |
As set out in the DPA |
The audit record is part of what the product provides |
|
Billing records |
As required by Nigerian tax and company law |
Legal obligation |
|
Analytics |
26 months |
Aggregated after that point |
Under the Nigeria Data Protection Act 2023. Exercise any of them by writing to privacy@emvert.com; we respond within one month.
A copy of the personal data we hold about you, and information about how it is processed.
Correction of personal data that is inaccurate or incomplete.
Deletion, where we no longer have a lawful reason to hold it. Some records — billing, for instance — we are legally required to retain.
To limit how we process your data, or to object to processing carried out on the basis of legitimate interest.
To receive your personal data in a structured, commonly used, machine-readable format.
At any time, where processing is based on consent. Withdrawing it does not affect processing carried out beforehand.
To the Nigeria Data Protection Commission. We would rather you raised it with us first so we can fix it, but that is your choice and not a precondition.
Traffic to the platform is encrypted in transit and stored data and uploaded evidence documents are encrypted at rest. Access is role-based and logged. Each organisation’s data is logically separated, and a firm-tier account holds each client in its own workspace.
Our security position is set out in more detail on the security page, including what we do not yet claim. If your procurement process requires a specific certification or a completed questionnaire, ask and you will get a straight answer about what is in place today.
We will update this notice when our processing changes. Where a change is material we will tell customers directly rather than relying on you noticing a revised date.
This version was prepared in September 2026 and is pending legal review.
Four questions, and you get the year you first file, the framework, and what to collect first.
Plain-language explainers of the FRC and SEC rules, ISSB S1 & S2, and what each asks you to disclose.
What a consultant-led reporting cycle costs against an annual licence, in Naira.
