Legal

Privacy notice

Last updated 15 October 2026

This notice explains what personal data ZeraSage Limited collects through zerasage.com, why, who sees it, how long we keep it, and what choices you have. It is written to meet the Nigeria Data Protection Act 2023 (the “NDPA”) and the NDPC’s General Application and Implementation Directive 2025.

Who we are

ZeraSage Limited (“ZeraSage”, “we”) is a private company limited by shares, incorporated in Nigeria on 15 September 2025 under the Companies and Allied Matters Act 2020 (CAC registration number RC 8825240), with its registered office at Gold City Estate, Abuja, FCT, Nigeria. We are the data controller for the personal data described here. You can reach us, and our data protection contact, at info@zerasage.com (put “Data protection” in the subject line).

What we collect

• Consultation form: your name, business name, email, phone or WhatsApp number, the service you are interested in, and your message. We also keep the IP address the form was sent from.
• Checklist form: your email address, the date you confirmed it, and the IP address the form was sent from.
• Booking: the time slot you choose and the contact details above.
• Emails: a record of the emails we send you, whether they were delivered, opened or clicked, and your newsletter status.
• WhatsApp: if you choose to message us on WhatsApp, WhatsApp (Meta) handles that conversation under its own terms, and we see your number and what you write.
• Website analytics (only if you accept analytics): the pages and sections you view, how long you stay, how far you scroll, which buttons you press, the device, browser and language, the website, advert or link that sent you (including any campaign tags and advert click identifiers in the link), and an approximate location (country, region, city) worked out from your IP address using the free IP Geolocation database by DB-IP.
• Advertising measurement (only if you accept): when you send a form, book a consultation, confirm the checklist, or tap WhatsApp after arriving from one of our adverts, we report that action to Google and Meta. See “Advertising measurement” below for exactly what is sent.

What we store on your device

If you accept analytics, we save a random identifier in your browser (local storage) so we can tell a repeat visit from a new one, and another for the current visit (session storage). We also save your choice about analytics. If you decline, we delete the identifiers and save only your choice. Separately, the site remembers in your browser that you closed the announcement bar or already requested the checklist. We do not use advertising or cross-site tracking cookies, and we do not load third-party analytics or advertising scripts.

Forms you start but do not send

If you accept analytics, we record that a form was started and which field people stopped at, so we can make it easier to complete. We do not store what you typed. The one exception is a clearly labelled box on the consultation form that lets you ask us to keep your email address if you do not finish. It is not ticked by default, and we keep the address only if you tick it. We will use it to follow up once.

Linking analytics to your enquiry

If you accepted analytics and then send us a form, we link that visit to your enquiry, so we can see which page or campaign brought you and what you looked at before getting in touch. If you declined analytics, no link is made.

Advertising measurement

We advertise on Google and on Meta (Facebook and Instagram). If you accepted, our server tells them when someone acts on our website, so they can measure which adverts work and show them to businesses more likely to need us. This happens from our server to theirs. We do not put Google or Meta tracking code on our pages.

• What is sent: the action (for example “consultation request”) and when it happened; the advert click identifier from the link you arrived on, if any; your email address and phone number, scrambled with a one-way SHA-256 hash before they leave our server; a scrambled random identifier for your browser; your country and city, also scrambled; and, to Meta only, your IP address and browser details. If you become a client we may report that too, with the value of the work.
• What is never sent: your name, business name, message, the service you asked about, or anything you typed into a form field.
• How they use it: Google and Meta compare the scrambled values with their own users to link the action to an advert, then use the result to report on and improve our adverts, including finding similar audiences. They use it under their own terms and privacy policies: Google, Meta.
• Your choice: nothing is sent if you decline or your browser sends a Global Privacy Control signal. If you withdraw consent using “Cookie settings” in the footer, we cancel anything not yet sent and send nothing more from that browser.

Your IP address

For visitors who accept analytics, we use the IP address once to work out an approximate location and keep only a one-way scrambled version (a hash) to recognise repeat requests. That scrambled value can still single out a device, so we treat it as personal data. If you send us a form, we keep your actual IP address with that submission to prevent abuse and to help us understand where enquiries come from. Our hosting and email providers also keep technical logs that include IP addresses.

Why we use your data, and our legal basis

• To answer your enquiry and arrange your consultation: taking steps at your request before entering a contract (NDPA s.25(1)(b)).
• To email you the checklist, and to keep you on our occasional newsletter after you confirm your email: your consent (s.25(1)(a)). You give it by submitting the checklist form and pressing the confirmation button in our email. You can withdraw it at any time with the unsubscribe link, and withdrawal does not affect what we did before.
• To send our occasional newsletter to people who asked for a consultation: your consent (s.25(1)(a)), given by ticking the unticked-by-default newsletter box on the consultation form. If you do not tick it, we use your details only to answer you and arrange the call. Every newsletter has an unsubscribe link, and you can withdraw consent at any time.
• To measure and improve the website and our advertising, including reporting actions to Google and Meta: your consent. If you decline analytics, we do not run it, and you can change your choice at any time using “Cookie settings” in the footer. Browsers that send a Global Privacy Control signal are treated as declining.
• To keep our systems secure and prevent spam and abuse: our legitimate interest.
• To meet legal and tax obligations: legal obligation, where a contract or law requires us to keep records.

We do not make decisions about you by automated means that have legal or similarly significant effects. We sort visits into traffic sources (for example “WhatsApp” or “paid search”) to understand what works, and we do not use that to make decisions about individuals.

Who receives your data

We do not sell personal data. People who handle it for us, under written agreements that require them to protect it and use it only on our instructions:

• Resend (email delivery and the mailing list), United States.
• Our hosting and database providers, who store the website and the information in our systems.
• Google (Google Ads) and Meta (Facebook and Instagram adverts), only if you accept, as described in “Advertising measurement”. They act under their own terms for the data they match.
• Our staff and contractors who need it to reply to you or run the service, through a password-protected admin system.

We may also share data where a law, court or regulator requires it, or with professional advisers under a duty of confidentiality. Location lookup from IP addresses is done on our own server and does not send your address to anyone.

Transfers outside Nigeria

Some of these providers process data outside Nigeria, including in the United States. We transfer personal data only where the recipient is bound to protect it to a standard comparable to the NDPA, through contract terms or another safeguard the NDPA allows (sections 41 to 43).

How long we keep it

• Website analytics records and scrambled IP values: up to 24 months, then deleted automatically.
• Emails kept after an unfinished form: until we follow up once, and no longer than 90 days.
• Our log of what we reported to Google and Meta: 90 days. The scrambled contact details in it are deleted as soon as the report is sent, or after 7 days if it cannot be sent. Google and Meta keep what they receive under their own policies.
• Enquiries and bookings, including the IP address sent with them: up to 3 years after our last contact, longer if a contract or law requires it.
• Newsletter and checklist subscribers: until you unsubscribe, after which we keep only a record that you opted out, so we do not email you again.
• Email delivery records: up to 3 years.

Children

This website is for businesses and is not aimed at anyone under 18. We do not knowingly collect children’s data. If you think a child has sent us information, email us and we will delete it.

Your rights

Under the NDPA you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it (including for direct marketing), move it to another provider, withdraw consent at any time, and not be subject to solely automated decisions with significant effects. Email info@zerasage.com and we will reply within one month. We may need to confirm who you are first. If you are unhappy with our response, you can complain to the Nigeria Data Protection Commission at ndpc.gov.ng.

Security and breaches

We use encrypted connections, limit access to the admin system to authorised staff, and keep personal links (checklist, booking and unsubscribe) private to the person they were sent to. If a breach puts your rights at risk, we will tell the Nigeria Data Protection Commission within 72 hours and tell you without delay if the risk to you is high.

Changes

If we change this notice we will update the date above, and tell you directly if the change is significant.

Contact

ZeraSage Limited, Abuja, Nigeria. info@zerasage.com