Privacy Policy
Draft for legal review. Last updated 3 October 2026. This policy has been prepared for review by a Nigerian lawyer and is not yet final. Text in [square brackets] still needs to be filled in.
This policy explains how Quantum S2 Ltd ("we", "us") uses personal data in connection with Quantum - SalesMaster, the app at app.quantum-salesmaster.com and the website at quantum-salesmaster.com. We follow the Nigeria Data Protection Act 2023 ("NDPA") and the Nigeria Data Protection Commission's General Application and Implementation Directive 2025 ("GAID").
1. Who we are
Quantum S2 Ltd, RC 1806209, No 8, Thomas Salako Street, Agege, Lagos, Nigeria. Quantum - SalesMaster is a product of Quantum S2 Ltd, not a separate company. NDPC registration number: [NDPC REGISTRATION NUMBER]. Website: www.quantums2ltd.com.
Our Data Protection Officer can be reached at [DPO EMAIL].
2. Two different roles
- We are the data controller for the personal data of the people who sign in to Quantum - SalesMaster (company owners, administrators, managers and sales representatives) as account holders, and of people who contact us or visit this website.
- We are a data processor for the business data our Customers put into their workspaces, such as their shop customers' names, phone numbers and addresses, orders, visits and payments. For that data the Customer is the data controller and decides how it is used. We handle it only on the Customer's instructions, under our Data Processing Agreement. If you are a shop or a customer of one of our Customers and have a question about your data, please contact that business first; we will help them answer you.
3. What we collect and why
| Who | Data | Why we use it | Lawful basis (NDPA) |
|---|---|---|---|
| People who sign in | Name, work email, role, company, password (stored only in scrambled form), two-step sign-in settings, sign-in times | To create and secure the account and let the person use the app | Performance of a contract; legitimate interests in keeping the service secure |
| People who sign in | Activity in the app (for example which orders or visits a user recorded and when), device and browser type, IP address, error logs | To run, secure and support the service, investigate problems and prevent misuse | Legitimate interests; contract |
| Sales representatives | Location of the phone when the app asks for it, for example when adding a new shop or recording a visit | So the Customer can see where shops are and that visits took place (processed for the Customer as its processor) | The Customer's lawful basis; the phone asks the user for permission |
| Company owners and billing contacts | Business name, contact name, email, phone, plan and payment records | To set up the workspace, bill for the service and keep tax records | Contract; legal obligation |
| People who contact us | Name, email, company and whatever you write to us | To reply, arrange a demo and keep a record of our conversation | Legitimate interests; steps before a contract |
| Website visitors | Standard web server logs (IP address, browser, pages requested, time) kept by our hosting provider | To deliver the website and protect it from attack | Legitimate interests |
We do not sell personal data, and we do not use it for advertising. The website has no analytics or advertising trackers.
We do not knowingly collect data about children. The service is for businesses and their adult staff.
4. Who we share it with
We use a small number of service providers ("sub-processors") to run Quantum - SalesMaster. They may only use the data to provide their service to us.
| Provider | What they do | Where data is held |
|---|---|---|
| Supabase, Inc. | Database, sign-in and file storage for the app | [REGION, e.g. European Union] |
| Vercel Inc. | Hosting of the app and the website | Global network; United States |
| Resend (Plus Five Five, Inc.) | Sending emails such as invitations and password resets | United States |
| Cloudflare, Inc. | Bot check (Turnstile) on the company sign-up form, when sign-up is open | Global network |
| [PAYMENT PROVIDER] | Taking online payments, when we offer them | [LOCATION] |
We may also share personal data with professional advisers, with a buyer of our business (who must keep to this policy), or where the law, a court or a regulator requires us to.
5. Transfers outside Nigeria
Some of our providers store or handle data outside Nigeria. Under the NDPA we only transfer personal data abroad where the receiving country has adequate protection recognised by the Nigeria Data Protection Commission, or where appropriate safeguards are in place, such as binding contract terms that give at least the protection the NDPA requires, or another basis the NDPA allows. You can ask our Data Protection Officer for more information about these safeguards.
6. How long we keep it
- Account data is kept while the account exists. When a user is removed from a workspace, their sign-in is disabled; their name stays on the records they created (for example orders) because the Customer needs those records.
- Workspace data is kept while the Customer's workspace exists, including while it is read-only after a plan ends. When a Customer closes its workspace or asks us to delete it, we delete it within 90 days, unless the law requires us to keep it.
- Billing and tax records are kept for as long as Nigerian tax and company law requires (normally at least 6 years).
- Enquiries are kept for up to 2 years after our last contact, unless they lead to a contract.
- Server and security logs are kept for up to [12 months].
7. How we protect it
We use appropriate technical and organisational measures, including encryption in transit, keeping each Customer's data separate inside the database itself, limiting who on our side can access data, two-step sign-in for platform administrators, and regular backups. No system is perfectly secure; if a personal data breach is likely to put people at risk, we will notify the Nigeria Data Protection Commission within 72 hours and tell the people affected where the NDPA requires it. Where we act as a processor, we tell the Customer without undue delay so it can do the same.
8. Your rights
Under the NDPA you have the right to:
- be told how your data is used (this policy);
- get a copy of your personal data;
- have inaccurate data corrected;
- have data deleted where there is no good reason to keep it;
- restrict or object to our use of your data, including where we rely on legitimate interests;
- receive your data in a common electronic format and have it sent to someone else;
- withdraw consent at any time, where we rely on consent;
- not be subject to a decision based only on automated processing that significantly affects you (we do not make such decisions).
To use these rights, email [DPO EMAIL]. We will reply within 30 days. If your data is held for a Customer, we will pass your request to that Customer.
If you are not satisfied with our answer, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
9. Cookies
See our Cookie Policy. In short: this website sets no cookies; the app uses only the cookies it needs to keep you signed in.
10. Changes
We may update this policy. We will post the new version here with a new date and, if the change is significant, tell account holders by email or in the app.
11. Contact
Data Protection Officer, Quantum S2 Ltd, No 8, Thomas Salako Street, Agege, Lagos. Email: [DPO EMAIL]. General enquiries: sales@quantum-salesmaster.com.