Privacy Policy

Henry Onyx Limited (RC 9594234), trading as Henry Onyx, with registered office at 001 Airport Road, Emene, Enugu State, Nigeria , is the data controller for personal data processed across henryonyx.com and every division surface. NDPC registration: [OWNER-TO-CONFIRM: NDPC registration reference]. Data Protection Officer: [OWNER-TO-CONFIRM: DPO name + email + phone, or 'External DPO consulted on material changes'].

— In plain English: One Nigerian company runs all the Henry Onyx divisions, and it is the entity legally answerable for how your data is handled.

Every processing activity on this platform rests on one or more lawful bases listed in NDPA 2023 §25. The basis used for each activity is named alongside the data category in the next section. We do not rely on a generic "applicable law" phrasing — each ground is cited.

— In plain English: For every kind of data we touch, we name the legal reason we are allowed to touch it, instead of waving at "the law".

The categories below are concrete. Each row names the data, the purpose it serves, and the lawful basis under NDPA §25. The list replaces the rubric-banned phrasing "information we may collect" — we collect these categories, full stop.

— In plain English: This is the exact list of personal data we hold, paired with the reason we hold it.

Purposes are not stated in abstract — they are paired one-to-one with the data category that serves them in section 3. The categories table is the authoritative reference. If a new purpose is added, the categories table is updated and the policy version is bumped per section 17.

— In plain English: Every purpose maps back to exactly one or two data categories. Nothing is collected for vague "future use".

These are the named sub-processors that receive personal data to help operate the platform. Each is bound by a written data-processing agreement and is selected for capability, security posture, and jurisdictional fit. Changes to this list are announced in advance under section 17.

— In plain English: These specific companies help us run the platform. We name them rather than saying "third-party service providers".

Personal data may leave Nigeria when processed by a sub-processor named in section 5 with infrastructure outside Nigeria. Transfers rely on adequacy decisions where they exist, on Standard Contractual Clauses Module 2 (controller-to-processor) issued by the European Commission, and on the UK International Data Transfer Addendum for UK-origin data subjects. The lawful basis for transfer is set out under the Nigeria Data Protection Act 2023, supported by NDPC's general guidance on cross-border transfers.

— In plain English: When your data is processed outside Nigeria, we use the same standard contracts the EU and UK use to make sure your protections travel with it.

Retention is tied to the statute that drives it, not to vague phrasing. Concrete windows below. Where multiple statutes apply, the longest applicable window controls.

— In plain English: We keep data for a specific number of years tied to a specific Nigerian law, then it is deleted.

Users outside Nigeria retain rights under their home data-protection framework, including (where applicable) the EU/EEA GDPR, UK GDPR, California CCPA/CPRA, Brazil LGPD, South Africa POPIA, Kenya Data Protection Act 2019, Ghana Data Protection Act 2012, Singapore PDPA 2012, Canada PIPEDA, and Australia Privacy Act 1988. The regulator route for each jurisdiction is listed below.

— In plain English: If you live outside Nigeria, your home country's privacy law still protects you, and you can complain to its regulator.

Every data subject has the rights set out under the Nigeria Data Protection Act 2023, including access, rectification, erasure, restriction, portability, objection, and the right not to be subject to a decision based solely on automated processing where it produces legal or similarly significant effects.

— In plain English: You can ask for your data, fix it, delete it, move it, stop us using it, and challenge automated decisions.

Send a written request to privacy@henryonyx.com. The controller acknowledges receipt within 5 working days and responds substantively within 30 days under the Nigeria Data Protection Act 2023. Identity is verified before a request is actioned. Where a request is manifestly unfounded or excessive, a fee may be charged or the request refused with reasons.

— In plain English: Email privacy@henryonyx.com. We acknowledge in 5 working days and answer in 30 days. We verify it is really you before sending data.

Cookies fall into four categories. Strictly necessary cookies operate the site and cannot be disabled. Functional cookies remember preferences (language, theme). Analytics cookies measure usage and require consent. Marketing cookies support targeted campaigns and require consent. A consent banner sets initial preferences; preferences can be changed at any time from the footer.

— In plain English: Some cookies make the site work. Others remember settings, measure usage, or support marketing — you control the last three.

The platform is not directed at children under 18. The controller does not knowingly collect personal data from children under 18 without verifiable parental consent. If a child has provided data without consent, a parent or guardian should write to the privacy inbox; the data will be deleted unless retained under a legal-hold exception in section 7.

— In plain English: Under-18s should not use the site without a parent. If they do, write to us and we delete the data.

A personal-data breach with a risk to the rights and freedoms of data subjects is reported to the Nigeria Data Protection Commission within 72 hours of becoming aware, under the Nigeria Data Protection Act 2023. Affected data subjects are notified without undue delay where the breach is likely to result in high risk. Structured logging plus a tamper-evident audit trail retained for 7 years allow forensic reconstruction.

— In plain English: If something goes wrong, we tell the regulator within 72 hours and tell affected users without delay.

The Data Protection Officer is the contact for any privacy concern, NDPA right exercise, or material complaint about how data is handled. [OWNER-TO-CONFIRM: DPO name + email + phone, or 'External DPO consulted on material changes']

— In plain English: The DPO is the single named person you write to about anything privacy.

If a privacy concern is not resolved by the DPO, a complaint can be lodged with the Nigeria Data Protection Commission at complaints@ndpc.gov.ng. International users may complain to their home regulator named in section 8.

— In plain English: If we cannot solve it, you can complain to the Nigerian regulator (or your country's regulator).

This policy is published in English (canonical) and translated into 11 additional locales. In case of conflict between language versions, the English text controls.

— In plain English: English wins if a translation says something different.

Effective 2026-05-14 · version v1.0. Material changes are emailed to account holders 14 days before they take effect and the version is bumped. Continued use after the effective date is acceptance.

— In plain English: We tell you 14 days before anything important changes, and the version number always goes up.