Privacy Policy

3650HQ TECHNOLOGIES LIMITED (hereinafter "we", "us" or "our") respects the personal data (the "Personal Data") of individuals. We set forth in this privacy policy (the "Policy") how we or companies commissioned by us (data processors) collect, use, process, store, and share the Personal Data that visitors of our website, our clients, or their respective end-customer users (collectively as the "Clients" or "you" or "your" or "yours") provide to us, or that we gather from any use of our website (https://3650hq.com/), software applications, APIs, chatbots, dashboards, or any other products and services provided by us (the "Products and Services").

In line with relevant data protection laws, primarily the Nigeria Data Protection Act, 2023 ("NDPA"), the Nigeria Data Protection Regulation, 2019 ("NDPR"), and where applicable to cross-border data flows, the European General Data Protection Regulation ("GDPR"), and other applicable international data protection laws (collectively known as "Applicable Laws"), we collect, use, process, store, and transfer the Personal Data of our Clients.

Personal Data means any information relating to an identified or identifiable living individual. Different pieces of information, which collectively identify a particular person, also constitute personal data.

You will be asked to consent to the terms of this Policy when making an enquiry, registering an account, integrating third-party communication channels, or interacting with us via our Products and Services. To the extent permitted by Applicable Law, your continued use of our Products and Services constitutes your consent to the Policy.

If you do not agree to this Policy, please do not provide any Personal Data when requested and refrain from using our Products and Services.

A. Legal basis for processing Personal Data

We process Personal Data if one of the following legal bases under the NDPA applies:

• The Client's Consent: We process Personal Data if the Client has given us explicit consent to use their Personal Data for specific operational features. Your consent can be withdrawn at any time.
• Contractual Obligations: We process Personal Data in order to fulfill our contractual obligations under the service contracts and subscriptions we entered into with you.
• For a Legitimate Interest: We process Personal Data where it is necessary for the legitimate interests pursued by us or by a third party, except where such interests are overridden by your fundamental rights and freedoms.
• Under a Legal Obligation: We process Personal Data where it is necessary to do so in compliance with statutory obligations under Nigerian law or orders from regulatory authorities and law enforcement.

B. Collection of personal information

Depending on the type of Products and Services that are used, we may collect the following types of information:

• Identification Information: We collect information to manage your account and workspaces, including but not limited to name, corporate address, business email address, phone number, account passwords, and verification credentials.
• Integrated Channel Data: When you connect external communication APIs (including but not limited to WhatsApp Business API, TikTok Business Messaging API, and Google/Email IMAP/SMTP protocols), we ingest data necessary to run your unified inbox, including message content, user handles, timestamps, media attachments, and thread status.
• Connection and Device Data: We automatically collect technical data when you access our dashboard, including IP addresses, geo-location parameters, browser types, log-in durations, and interface click-stream activities.
• Tracking Technologies: We and our infrastructure providers use cookies and secure cache tokens (such as Redis session states) to remember your login parameters and optimize workspace performance.
• Transactional and Billing Data: Data relating to your subscription tiers and credit/coin bundle purchases, including transaction history, ledger metrics, and partial billing token indicators. Actual card processing is handled securely by our payment gateways.

C. Use of Personal Data

We use and process Personal Data for the following primary business operations:

• To host, maintain, and provide our unified omnichannel messaging dashboard and workspace features;
• To route, centralize, and sync inbound and outbound communication streams from integrated networks (WhatsApp, TikTok, Email) in real-time;
• To supply client-facing analytical insights, coin utilization burn-rates, and team triage performance metrics;
• To provide technical troubleshooting and customer support workflows;
• To investigate, prevent, and mitigate unauthorized access, API abuse, credit fraud, or violations of our terms of use;
• To comply with technical directives from global communications partners and regulatory requirements issued by the Nigeria Data Protection Commission (NDPC).

D. Cookies and caching

We utilize analytic and marketing tools (Google Analytics, PostHog, TikTok Pixel, and Meta Pixel), browser cookies, and fast-access server-side memory engines (such as Redis cache models) to securely maintain active application sessions, evaluate advertising performance, and track data usage on this marketing site. None of these tools set cookies or identify you until you accept the cookie banner shown on your first visit. Until then, Google Analytics operates in a cookieless mode, TikTok Pixel operates in Cookie Consent Mode (cookies withheld), Meta Pixel operates with consent revoked, and PostHog is never started at all. Declining keeps all tools in that state.

If you arrive through a partner's referral link (a link containing ?ref=), we record the visit against that partner using a one-way hash of your IP address, so we can pay them commission if you sign up. With your consent we also set a referral cookie (hq_ref) that remembers the referral for a limited period (currently 60 days); without consent no cookie is set, and the referral is only carried for the current visit in the sign-up link. Withdrawing consent deletes the referral cookie.

You can configure your browser or device settings to block or delete cookies; however, doing so may cause active workspace features or session-validation states within the dashboard to break or function incorrectly.

E. Direct marketing

Only with your explicit opt-in consent will we use your registered contact information to send product updates, promotional offers, or feature releases. You may freely opt out of marketing communications at any exact moment by clicking the "Unsubscribe" links inside our emails or contacting our data office directly. Transactional alerts (e.g., low coin balance notifications, security alerts) will continue to send regardless of your marketing status.

F. Retention of Personal Data

We store Personal Data only for the duration necessary to satisfy the specific collection purposes or as long as your corporate workspace remains active with us.

• Client-Controlled Data: Message streams and synced histories are retained until a Client explicitly deletes a thread or requests an account closure.
• Purging Protocols: Upon termination of a service agreement or explicit workspace deletion request, we initiate automated data-purging scripts to completely delete or anonymize all database logs and operational keys within a standard operational window of thirty (30) days, except where local statutory storage laws require longer retention.

G. Sharing and transfer of Personal Data

We share infrastructure metrics and communication data strictly on a need-to-know basis with trusted partners to keep your service running:

• Downstream Communication APIs: Data is shared dynamically with external communication platforms (e.g., Meta Graph API for WhatsApp, TikTok Developer API, Google API) to transmit your outbound message replies.
• Infrastructure Partners: We utilize highly secure cloud hosting environments, database instances, and caching layers (e.g., AWS, Supabase, Neon, or Upstash) to process database logic.
• Payment Gateways: Billing transactions are handled by accredited, compliant payment institutions (such as Flutterwave or local Nigerian payment processors) to complete your top-ups.
• Cross-Border Transfers: To provide constant uptime, data may be routed through cloud infrastructure servers located globally. In line with the NDPA 2023, we ensure that all offshore sub-processors maintain equivalent strict data privacy baselines through standard contractual clauses and data processing addendums.

H. Security of Personal Data

We employ industry-standard technical controls to defend your data. All communication records and customer details are encrypted at-rest inside our cloud production environments using AES-256-GCM standards and in-transit using TLS 1.2 or higher web transmission security protocols.

We apply strict "least-privilege" access limits internally so only authorized developers can access technical systems under strict confidentiality mandates. In the event of a security anomaly or data breach, we will initiate our security incident response protocols and notify the affected individuals and the NDPC in direct alignment with statutory regulatory timelines.

I. Data subject rights

Under the Nigeria Data Protection Act, 2023, you enjoy complete legal ownership of your information, including:

• The Right to Be Informed: Transparent clarity regarding how your data is tracked and handled (satisfied by this Policy).
• The Right of Access: The right to request an extract of all your personal variables retained on our platform.
• The Right to Rectification: The right to update inaccurate, broken, or outdated profile data inside your workspace.
• The Right to Erasure ("Right to be Forgotten"): The right to request the complete deletion of your data logs from our systems.
• The Right to Object/Restrict Processing: The right to limit or halt how your information is algorithmically processed.
• The Right to Data Portability: The right to receive your personal metrics in a clean, structured, machine-readable digital format.

J. Children

Our Products and Services are built strictly for businesses and corporate enterprises. We do not knowingly collect, solicit, or process information belonging to individuals under the age of 18.

K. Processing on behalf of Clients (data processor clarification)

When you use 3650HQ to manage your customers' WhatsApp, TikTok, or Email DMs, you are the Data Controller and we are the Data Processor. We process your customers' messages strictly to display them on your dashboard as instructed by your API linkages. We will never use your end-customers' personal communications for our own separate operational purposes or advertising layouts.

L. Google Workspace API data and Limited Use disclosure

3650HQ provides an integration with Google Workspace APIs (including the Gmail API) to allow users to connect their business email accounts and manage customer communications directly within the 3650HQ unified inbox.

Compliance with Google User Data Policy: 3650HQ's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Prohibition on AI/ML Model Training: In strict compliance with the Google Workspace API User Data and Developer Policy, raw, aggregated, or derived user data received from Google Workspace APIs (including email message content, headers, and attachments) will not be transferred to third-party services that use that data to train artificial intelligence (AI) or machine learning (ML) models, nor will it be used by 3650HQ or any sub-processor to create, train, fine-tune, or improve foundational or generalized AI/ML models.

Data Access and Minimization: Google user data accessed via the Gmail API is strictly limited to:

• Reading incoming email communications (via gmail.readonly) solely to render conversation threads in the user's unified inbox; and
• Sending user-directed outgoing messages and transaction documents (via gmail.send) initiated directly by authorized workspace team members.

Google user data is never sold, leased, or shared with third parties for advertising, retargeting, or promotional purposes.

M. Third-party links

Our services connect directly with external apps and networks via API integrations. We have no direct administrative jurisdiction over the privacy policies of third-party platforms (like Meta or TikTok). We strongly urge you to review the official developer privacy declarations of those third-party integration providers prior to linking your business accounts to our workspace.

N. Conditions of use

This Privacy Policy is directly incorporated into and forms an inseparable part of our global Terms of Use, which can be reviewed at any time at our Terms of Service.

O. Changes to this Policy

We reserve the right to modify this Policy as software features evolve or as updated mandates are released by the NDPC. We will broadcast updates via system alerts on your dashboard or via direct email notifications. Amendments take effect thirty (30) days following publication, and continued platform usage constitutes acceptance of those variations.

P. Severability

If any specific clause or sentence within this Policy is determined by a competent Nigerian court to be invalid, void, or unenforceable, that independent provision shall be severed without impacting the legality or validity of the remaining text sections.

Q. Governing law and dispute resolution

This Policy shall be governed by, and construed in all respects in accordance with, the laws of the Federal Republic of Nigeria.

Any dispute, controversy, or claim arising out of or relating to this Privacy Policy, including its validity, interpretation, performance, or breach, shall first be subjected to mutual amicable settlement negotiations. If the parties fail to resolve the issue amicably within thirty (30) days, the dispute shall be referred to and finally resolved by Arbitration in accordance with the Arbitration and Mediation Act, 2023.

• The arbitration seat and venue shall be Lagos, Nigeria.
• The proceedings shall be conducted before a sole arbitrator appointed by mutual agreement, or failing agreement, by the Chairman of the Chartered Institute of Arbitrators (UK) Nigeria Branch.
• The language used throughout the arbitration proceedings shall be English.

R. Communicate with us

To exercise your data access rights, file an official inquiry, or communicate directly with our security office, contact our Data Protection Officer at: privacy@3650hq.com.