Last updated: 19 October 2026
1. Who we are
IOTech Global Hub Limited ("IOTECH", "we", "us") is an internet service provider licensed by the Nigerian Communications Commission (NCC), with its office at 20 Okotie Eboh Close, Off Awolowo Road, S.W. Ikoyi, Lagos, Nigeria. We are the data controller for the personal data described in this policy.
This policy applies to our website (iotech.to), our customer portal, and the connectivity and managed network services we provide. It is written to meet the Nigeria Data Protection Act 2023 (NDPA), the regulations and directives of the Nigeria Data Protection Commission (NDPC), and the consumer information obligations in the NCC Consumer Code of Practice Regulations, our NCC-approved Consumer Code of Practice and the NCC Internet Code of Practice.
2. Personal data we collect
- Enquiries: name, company, email address, phone number, the service you are interested in and your message, when you contact us or use our website form.
- Customer and account data: name, contact details, service and billing address, identification and company registration details where required, account and plan information, and billing and payment records.
- Service and network data: data needed to deliver and support your connection, such as equipment identifiers, assigned IP addresses, connection and session records, usage volumes, and fault and support records.
- Website technical data: IP address, browser and device information, and the security signals used by our bot protection. See our Cookie policy.
We do not knowingly collect special categories of personal data (sensitive personal data), and we do not monitor the content of your communications except where required by law.
3. Why we use it, and our lawful basis
- To provide and support our services (installation, connectivity, monitoring, fault resolution, billing): performance of our contract with you.
- To respond to enquiries and send quotes: steps taken at your request before a contract, or our legitimate interests.
- To protect our network, customers and website (security, fraud and abuse prevention, spam protection): our legitimate interests.
- To meet legal and regulatory obligations, including NCC licence conditions, record keeping, tax and accounting, and lawful requests from authorities: legal obligation.
- To send you service updates and, only where you have agreed, marketing messages: consent, which you can withdraw at any time.
Marketing by SMS, phone or email is sent only with your consent. You can opt out at any time by replying to the message, using the opt-out link, or contacting our support team. We respect Do-Not-Disturb (DND) preferences, and all our messages are sent from one central platform so you are not contacted repeatedly. Telemarketing is carried out only with prior consent, and lead information is stored securely.
4. Who we share it with
We do not sell your personal data. We share it only where necessary, with:
- Service providers acting on our behalf under contract, such as hosting and security (Cloudflare), email delivery (Brevo), payment processors and network equipment and installation partners.
- Regulators and authorities, including the NCC, the NDPC and law enforcement agencies, where we are required to do so by Nigerian law or a valid legal process.
- Professional advisers and, in the event of a merger or sale of our business, the parties involved, subject to confidentiality.
5. International transfers
Some of our service providers process data outside Nigeria. Where this happens, we make sure the transfer is permitted under Part VIII of the NDPA, for example because the destination provides adequate protection or appropriate safeguards are in place.
6. How long we keep it
We keep personal data only for as long as needed for the purposes above, and then delete or anonymise it:
- Customer and billing records: 5 to 7 years after they are created, to meet legal, tax and operational requirements.
- Payment receipts: archived for up to 12 months, and you can ask us for a copy during that time.
- Complaint records: at least 2 years, as required by the NCC.
- Enquiries that do not lead to a service: deleted within 24 months.
We may keep data for longer where the law, the NCC or another authority requires it, or where it is needed to establish or defend legal claims.
7. How we protect it
We use appropriate technical and organisational measures to protect personal data, including encrypted connections, daily encrypted backups, access controls limited to authorised staff who need the data, regular audits of access logs, monitoring of our network by our Network Operations Centre, and confidentiality obligations for staff and suppliers.
If a personal data breach affects your data, we will notify you and the Nigerian Communications Commission within 48 hours of becoming aware of it, as required by the NCC Internet Code of Practice, and the Nigeria Data Protection Commission within 72 hours, as required by the NDPA. We will tell you what happened, what data was involved, what we are doing about it, and what you can do to protect yourself.
8. Your rights
Under the NDPA you have the right to:
- Be informed about how your data is used
- Access a copy of your data
- Correct inaccurate data
- Have your data erased
- Restrict or object to processing
- Data portability
- Withdraw consent at any time
- Not be subject to solely automated decisions
To exercise any of these rights, email info@iotech.to with the subject "Data protection request". We may need to verify your identity, and we will respond within the time required by law. Some rights are limited where we must keep data to meet a legal obligation.
9. Complaints
If you have a concern about how we handle your personal data or about our service, please contact us first so we can resolve it. We will acknowledge your complaint within 24 hours and handle it under our Complaints procedure.
If you are not satisfied with our response, you may escalate:
- Data protection: to the Nigeria Data Protection Commission (NDPC), ndpc.gov.ng.
- Telecommunications services: to the Nigerian Communications Commission Consumer Affairs Bureau, by calling the NCC toll-free line 622 or via ncc.gov.ng.
10. Children
Our services are intended for businesses and adults. We do not knowingly collect personal data from children under 18 without the consent of a parent or guardian.
11. Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated. Material changes affecting customers will also be communicated directly.
12. Contact us
IOTech Global Hub Limited, 20 Okotie Eboh Close, Off Awolowo Road, S.W. Ikoyi, Lagos, Nigeria
Email: info@iotech.to · Phone: +234 704 700 0226