Carolus Services Ltd.

Privacy Policy

Effective Date: 21 August 2026

Carolus Services Ltd. (“Carolus Services,” “we,” “us,” or “our”) is committed to protecting the privacy of visitors to www.carolusservices.com (the “Site”) and clients who engage our compliance and data analysis consultancy services (the “Services”). This Privacy Policy explains how we collect, use, disclose, and protect Personal Data, and your rights under the Nigeria Data Protection Act 2023 (“NDPA”) and applicable regulations issued by the Nigeria Data Protection Commission (“NDPC”).

1. Who We Are

Carolus Services Ltd. is the data controller responsible for Personal Data collected through the Site and in the course of client engagements, unless otherwise specified in a client-specific data processing agreement.

2. Personal Data We Collect

• Contact details: name, email address, phone number, job title, and organisation, submitted via contact forms, email, or during onboarding.
• Engagement data: information you or your organisation provide in the course of a compliance or data analysis engagement, which may include business records, policies, or data sets you share with us.
• Technical data: IP address, browser type, device information, and usage data collected automatically via cookies or similar technologies when you visit the Site.
• Communications: records of correspondence, meeting notes, and enquiries.

3. How We Use Personal Data

• To respond to enquiries and provide requested information about our Services.
• To perform and manage client engagements, including compliance assessments, data protection advisory work, and data analytics services.
• To send administrative communications, invoices, and, where consented to, marketing or newsletter content.
• To maintain, secure, and improve the Site.
• To comply with legal, regulatory, and contractual obligations.

4. Legal Basis for Processing

We process Personal Data on one or more of the following bases under the NDPA: your consent; performance of a contract with you or your organisation; compliance with a legal obligation; or our legitimate interests in operating and promoting our business, provided these interests are not overridden by your rights and freedoms.

5. Cookies

The Site may use cookies and similar technologies to support functionality and analyse traffic. You can control cookies through your browser settings; disabling cookies may affect some features of the Site.

6. Sharing of Personal Data

We do not sell Personal Data. We may share Personal Data with:

• Service providers who support our operations (e.g., IT hosting, email, and analytics providers), under confidentiality and data protection obligations.
• Professional advisers, auditors, or regulators, where required by law or to establish, exercise, or defend legal claims.
• A successor entity in connection with a merger, acquisition, or sale of business assets, subject to equivalent protections.

7. International Transfers

Where Personal Data is transferred outside Nigeria (for example, to cloud service providers), we take steps required under the NDPA to ensure an adequate level of protection, including contractual safeguards, before making such transfers. Where we transfer Personal Data originating from the EEA, UK, or Switzerland to a country not deemed adequate by the relevant authority, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or the UK International Data Transfer Addendum, as applicable.

8. Data Retention

We retain Personal Data only for as long as necessary to fulfil the purposes described in this Policy, including to satisfy legal, accounting, or reporting requirements, after which it is securely deleted or anonymised.

9. Data Security

We implement appropriate technical and organisational measures to protect Personal Data against unauthorised access, loss, misuse, or alteration. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Your Rights

Subject to applicable law, you may have the right to:

• Access the Personal Data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion or restriction of processing of your data.
• Object to processing based on legitimate interests or for direct marketing.
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with the Nigeria Data Protection Commission.

To exercise these rights, contact us using the details in Section 15.

11. Additional Terms for EU, UK, and EEA Individuals (GDPR / UK GDPR)

Where we process Personal Data of individuals located in the European Economic Area or the United Kingdom, we do so in accordance with the EU General Data Protection Regulation (“GDPR”) and/or the UK GDPR, as applicable, in addition to the NDPA.

• Controller and legal basis: Carolus Services acts as controller for Personal Data collected via the Site and, where specified in an engagement, as processor on behalf of EU/UK clients. We rely on the legal bases described in Section 4, interpreted consistently with Article 6 GDPR (and, for special category data, Article 9).
• Your rights: in addition to the rights in Section 10, you have the right to data portability and the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects.
• EU/UK representative: where required by Article 27 GDPR or Article 27 UK GDPR because we do not have an establishment in the EEA or UK, we will appoint a representative and publish their contact details here: [insert EU/UK representative name and contact details, if applicable].
• Supervisory authority: you may lodge a complaint with your local data protection supervisory authority, such as the Information Commissioner’s Office (ICO) in the UK, or the relevant authority in your EU member state, in addition to or instead of the NDPC.

12. Additional Terms for California Residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”), gives you additional rights over Personal Data (referred to under that law as “personal information”).

• Right to know the categories and specific pieces of personal information we have collected about you, and the categories of sources, purposes, and third parties involved.
• Right to delete personal information we have collected from you, subject to certain exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information. Carolus Services does not sell personal information and does not share it for cross-context behavioural advertising.
• Right to non-discrimination for exercising your CCPA/CPRA rights.

To exercise these rights, contact us using the details in Section 15. We will verify your request using information reasonably necessary to confirm your identity before responding.

13. Children’s Privacy

The Site and Services are not directed at children, and we do not knowingly collect Personal Data from individuals under the age of 18 without appropriate consent as required by the NDPA.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The updated version will be posted on the Site with a revised Effective Date.

15. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, contact: