Legal

Privacy Policy

Last updated: 16 October 2026

Onalto Limited ("Onalto", "we", "us"), RC 9932200, respects your privacy. This policy explains what personal data we collect when you visit onalto.com, contact us or buy our services, and how we handle it in line with the Nigeria Data Protection Act 2023 (NDPA).

1. Data we collect

• Contact details you send us, such as your name, email address, phone number and company name.
• Project information you share when you describe what you need.
• Billing details, such as invoice and billing contact information. Card and bank details are collected and processed by our payment provider, Paystack. We do not see or store your full card number.
• Technical data collected automatically by our hosting provider, such as IP address, browser type and pages visited. This is used for security and performance.

This website does not use advertising or tracking cookies.

2. How we use it

• To reply to enquiries and prepare proposals (to take steps at your request before a contract).
• To deliver the services you buy, send invoices and take payment (to perform our contract with you).
• To meet tax, accounting and other legal obligations.
• To keep our website and systems secure (our legitimate interests).

We do not sell your personal data, and we do not use it for marketing without your consent.

3. Who we share it with

We only share data with service providers that help us run our business, and only as much as they need:

• Paystack, for payment processing.
• Hosting and cloud providers, such as Vercel, which host our website and project systems.
• Email and productivity tools we use to communicate with you.
• Regulators or law enforcement, where the law requires it.

Some of these providers may store data outside Nigeria. Where they do, we rely on safeguards permitted under the NDPA.

4. Client data in projects

When we build or run systems for you, we may handle data that belongs to you or your users. We process that data only on your instructions and for the purpose of the engagement, keep it confidential, and return or delete it when the engagement ends.

5. How long we keep it

Enquiries that do not become projects are deleted within 24 months. Client and billing records are kept for six years to meet tax and accounting rules, then deleted.

6. Security

We protect personal data with access controls, encryption in transit and reputable infrastructure providers. No system is perfectly secure. If a breach affects your data, we will notify you and the Nigeria Data Protection Commission as the law requires.

7. Your rights

Under the NDPA you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or move it to another provider. You can also withdraw consent at any time. To make a request, email us. We reply within 30 days. If you are not satisfied, you can complain to the Nigeria Data Protection Commission.

8. Changes

We may update this policy. The date at the top shows when it last changed.

9. Contact

See also our Terms of Service.