This policy explains how On Orbit Corporate Limited (RC 9646160), trading as On Orbit, uses personal data about people who visit our website, sign up, or use On Orbit as staff of a subscribing business. We follow the Nigeria Data Protection Act 2023 (NDPA) and the NDPC's General Application and Implementation Directive. We are registered with and certified by the Nigeria Data Protection Commission (NDPC).
Who this policy does not cover. Businesses that use On Orbit store data about their own customers and staff. For that data, the business is the data controller and decides how it is used. If you bought from or work for a business that uses On Orbit, read that business's privacy notice and contact them first. We act on their instructions under our Data Processing Agreement.
1. Who we are
Data controller: On Orbit Corporate Limited (RC 9646160). Contact for all privacy questions and requests: info@onorbitinc.com.
2. What we collect and why
| What | Examples | Why we use it | Lawful basis (NDPA s.25) |
|---|---|---|---|
| Account details | Name, business name, email, phone number, role | Create and run your account, verify your email and phone | Contract |
| Billing details | Plan, invoices, Flutterwave payment reference. We never see or store your full card number | Take payment and keep tax records | Contract, legal obligation |
| Usage data | Pages viewed, features used, device and browser, IP address | Keep the service secure, fix errors, improve features | Legitimate interest |
| Support messages | Emails and WhatsApp messages you send us | Answer you and keep a record of the request | Contract, legitimate interest |
| Website enquiries | Name, email, phone, business name from our forms | Reply to you and, if you agree, send product updates | Consent |
| Marketing preferences | Whether you want product emails | Send updates only to people who said yes | Consent |
3. Sensitive data
We do not ask for sensitive personal data about you. Businesses may store sensitive staff data in the HR module, such as health notes on a leave request. That data is under the business's control as described above.
4. Who we share data with
We do not sell personal data. We share it only with service providers who help us run On Orbit, under written contracts that require them to protect it.
| Type of provider | What they do | Where |
|---|---|---|
| Cloud hosting and database | Store your data and run the website and app | Outside Nigeria |
| Email delivery | Send and receive service and marketing emails | Outside Nigeria |
| Payment processor (Flutterwave) | Take subscription payments | Nigeria |
| Messaging platforms (Meta: WhatsApp, Instagram, Messenger) | Deliver messages from accounts a business connects | Global |
| Ad platforms (Google, Meta, Snap) | Share ad performance data from accounts a business connects | Global |
| AI model providers | Power AI replies and read uploaded documents, when used | Outside Nigeria |
| Security and monitoring | Stop abuse, report errors, check uptime | Outside Nigeria |
| Product analytics | Show us how features are used, with your consent | Outside Nigeria |
| Business email | Our own email | Global |
You can ask us for the names of our current providers at info@onorbitinc.com. We may also share data with the police, courts or regulators when the law requires it, and with a buyer if we sell or merge the business. We would tell you first.
5. Transfers outside Nigeria
Most of our providers process data outside Nigeria. We transfer it only under one of the conditions in Part VIII of the NDPA: a country the NDPC recognises as adequate, binding contract clauses that protect the data, or your consent. You can ask us for a copy of the safeguard that applies.
6. How long we keep it
| Data | How long |
|---|---|
| Account details | While your account is open, then 90 days |
| Billing and tax records | 6 years after the transaction |
| Usage and error logs | Up to 12 months |
| Support messages | 2 years after the request closes |
| Website enquiries with no account | 12 months, or until you ask us to delete them |
7. Your rights
Under sections 34 to 38 of the NDPA you can:
- get a copy of your personal data
- correct data that is wrong or incomplete
- ask us to delete your data
- ask us to limit how we use it
- object to processing based on legitimate interest, and to direct marketing at any time
- receive your data in a common machine-readable format, or have it sent to another provider
- withdraw consent at any time, without affecting what we did before
- not be subject to a decision made only by automated means that has a significant effect on you
Email info@onorbitinc.com to use any right. We reply within 30 days. We may ask you to prove who you are. Using your rights is free unless a request is clearly unfounded or excessive.
You can also complain to the Nigeria Data Protection Commission at ndpc.gov.ng.
8. Security
We encrypt data in transit, limit staff access to what each role needs, keep audit logs and back up the database. No system is perfectly secure. If a breach puts your rights at risk, we will tell the NDPC within 72 hours of becoming aware of it and tell you without undue delay.
9. Cookies
We use cookies to keep you signed in and to understand how the site is used. See our Cookie Policy.
10. Children
On Orbit is for businesses. We do not knowingly collect data from anyone under 18.
11. Changes
We will post any change here with a new effective date, and email account owners about material changes.