Privacy Policy
This policy explains how PrivexLabs Limited, the company that builds and owns Hali (“Hali”, “we”, “us”), RC 8917932, 10 Mogbonjubola Street, Bajulaiye, Lagos, Nigeria, handles personal data when you visit our website, use the Hali service, or interact with an agency that uses Hali. We follow the Nigeria Data Protection Act 2023 (NDPA) and the NDPC's General Application and Implementation Directive (GAID) 2025.
1. Who is responsible for your data
- Hali is the data controller for data about our website visitors, people who sign up for the pilot, and agency team members' account data.
- Agencies are the data controllers for data about their own clients and prospects (enquiries, projects, feedback, approvals). Hali processes that data on the agency's instructions as a data processor, under our Data Processing Agreement. If you're an agency's client, contact that agency first about your data. We'll help them respond.
2. What we collect
| Who you are | Data | Source |
|---|---|---|
| Website visitor | Device and browser information, pages viewed, approximate location from IP, cookie choices | Your browser (see Cookie Policy) |
| Pilot applicant | Name, agency name, work email, team size, what you tell us about your workflow | You |
| Agency member | Name, email, role, password hash or sign-in links, two-factor settings, activity in the product, support messages; if you connect Canva: account email, plan and access tokens | You, your agency, Canva |
| Agency client or prospect | Name, email, company, enquiry answers and files, feedback, requests, approvals and decisions (with time and verification method), files you download | You, or the agency |
| Everyone using Hali | Security logs: IP address, device, time and outcome of sign-ins and consequential actions | Our systems |
We do not ask for sensitive personal data (for example health, religion or biometrics). Please don't include it in enquiries or files. We do not collect or process payment card data: Hali records that a payment happened but never takes payments.
3. Why we use it (lawful bases under NDPA section 25)
| Purpose | Lawful basis |
|---|---|
| Providing the Hali service to agencies and their clients | Contract with the agency; agency's instructions for client data |
| Verifying identity for approvals (email codes) and keeping an audit trail of decisions | Contract; legitimate interest in reliable commercial records |
| Security, fraud and abuse prevention | Legitimate interest; legal obligation |
| Service emails (invitations, decisions, reminders) | Contract |
| Responding to pilot applications and support requests | Steps at your request before a contract; legitimate interest |
| Product analytics on our marketing site | Consent (opt-in), withdrawable at any time |
| Marketing emails | Consent, with an unsubscribe link in every email |
| Compliance with tax, accounting and regulatory duties | Legal obligation |
Where we rely on legitimate interests, we've assessed that they don't override your rights; you can ask us for that assessment. AI features: Hali may compare an agency's requests with its agreed scope to suggest a reading. These suggestions are shown only to the agency and never make decisions about you. You will not be subject to decisions based solely on automated processing.
4. Who we share it with
We don't sell personal data. We share it only with:
- Service providers (sub-processors) who host, store, email and monitor the service under written contracts. The current list is in the Data Processing Agreement.
- Google (Google Forms), which stores pilot applications submitted on this website.
- Integrations an agency member chooses to connect, such as Canva, only for what that feature needs.
- The agency you work with: if you're a client, the agency sees what you submit.
- Authorities when the law requires it, or to protect rights and safety.
- A successor business, under the same protections, if Hali is reorganised or acquired.
5. Transfers outside Nigeria
Hali is hosted on Vercel, its database runs on Neon, and pilot applications are stored in Google Forms. These providers store and process data outside Nigeria. Where personal data is transferred outside Nigeria, we do so only under NDPA Part VIII. That means a destination with an adequate level of protection, or appropriate safeguards such as contractual clauses approved or recognised by the NDPC, or another basis permitted by section 43. We record each transfer and its basis and will share the details on request.
6. How long we keep it
| Data | Retention |
|---|---|
| Agency account and project records | For the life of the subscription; deleted 30 days after the workspace is deleted, except where law requires longer (for example tax records for 6 years) |
| Enquiries declined or not progressed | 12 months, then deleted unless the agency keeps them longer for a stated reason |
| Approval and decision records | For the life of the engagement plus 6 years, as commercial evidence for the agency |
| Security logs | 12 months |
| Backups | Overwritten within 35 days |
| Pilot applications not progressed | 12 months |
7. How we protect it
Encryption in transit (TLS) and at rest; separation of each agency's data, enforced in the application and the database; least-privilege staff access with audit logging; verified email codes for consequential decisions; malware scanning of uploads; regular backups and restore tests; and staff training. If a breach is likely to put your rights at risk, we will notify the NDPC within 72 hours of becoming aware, and notify you without undue delay where required.
8. Your rights (NDPA sections 34–38)
- Be informed, and access a copy of your data
- Correct inaccurate data
- Erase data (subject to legal and commercial-record obligations)
- Restrict or object to processing, including direct marketing
- Data portability, in a commonly used format
- Withdraw consent at any time, without affecting earlier processing
- Not be subject to solely automated decisions with significant effects
- Complain to the Nigeria Data Protection Commission
Email privacy@gethali.xyz. We respond within 30 days and may need to verify your identity. If your data is held for an agency, we'll pass your request to them and support their response.
9. Children
Hali is a business service and is not intended for anyone under 18. We don't knowingly collect children's data.
10. Changes to this policy
We'll post updates here with a new effective date. For material changes we'll notify agency owners by email at least 30 days in advance.
11. Contact and complaints
Data Protection Officer: PrivexLabs Limited, 10 Mogbonjubola Street, Bajulaiye, Lagos, Nigeria · privacy@gethali.xyz.
You can also complain to the Nigeria Data Protection Commission (ndpc.gov.ng).