Welcome to G-Tateth Limited (referred to as "G-Tateth", "we", "us", or "our"). G-Tateth operates as an enterprise-grade customer experience company providing specialised Business Process Outsourcing (BPO) services to financial service companies, including fintechs, banks, neobanks, and regulated digital financial institutions and operating a multi-tenant cloud-based Customer Support Management software platform (G-Tateth CRM).

This Privacy Policy explains how we collect, use, store, disclose, and safeguard personal data when individuals visit our public website (www.g-tateth.com/https://www.g-tateth.com), subscribe to our CRM software platform, interface with our trial or staging environments, contact our team, or utilize our corporate applications.

This Policy is drafted in compliance with the Nigeria Data Protection Act (NDPA) 2023 and other applicable regional data protection standards. G-Tateth is formally registered with the Nigeria Data Protection Commission (NDPC) as a lawful entity.

To ensure clarity, our data processing obligations are separated into two distinct operational contexts:

G-Tateth as a Data Controller: We act as a Data Controller for personal data belonging to our website visitors, direct corporate subscribers, corporate marketing leads, job applicants, and internal employees. We determine the purpose and means of this data processing.

G-Tateth as a Data Processor: Our BPO arm serves regulated banks, fintechs, and financial entities, and our CRM hosts user databases for third-party business accounts. In these setups, our corporate clients are the Data Controllers, and G-Tateth processes end-consumer data strictly on their behalf, according to documented Data Processing Agreements (DPAs). If you are an end-consumer of a financial service provider using G-Tateth BPO support, your data processing is governed by that financial institution's respective privacy policy.

CRM Metadata Ownership: For clarity, while our CRM subscribers control the direct customer conversation records, G-Tateth acts as a Controller for aggregated, fully anonymized platform usage telemetry and system performance metadata. This data is utilized solely to maintain system security, monitor service levels (SLAs), and optimize core platform performance.

We collect data through direct interactions, automated website tracking, and onboarding workflows:

In strict accordance with Section 25 of the NDPA 2023, G-Tateth relies on the following lawful bases to process your data:

• Performance of a Contract: Processing is necessary to deploy, maintain, and support your active CRM platform subscription, run error diagnostics, optimize platform uptime, or fulfill our BPO corporate services.
• Consent: Where you have explicitly opted in to receive our corporate insight newsletters, marketing materials, or allowed non-essential marketing tracking cookies. Consent may be withdrawn at any time.
• Legal Obligation: Processing required to ensure compliance with financial anti-fraud reporting, tax reporting obligations with relevant agencies, or regulatory mandates issued by the NDPC.
• Legitimate Interests: For the optimization of our infrastructure security, network threat monitoring, internal software debugging, and maintaining system integrity across our multi-tenant cloud architecture.

We utilize the collected personal data exclusively to:

• Provision, run, and host the G-Tateth CRM multi-tenant environment.
• Administer secure user profiles and verify multi-factor identity configurations during client logins.
• Route omnichannel communications across connected API pipelines (Voice, WhatsApp, and DMs).
• Process subscription billings, recurring invoice distributions, and commercial collections.
• Maintain comprehensive security logs to isolate, evaluate, and mitigate malicious network events or unauthorized access attempts.

To ensure high availability, enterprise elasticity, and sub-millisecond retrieval speeds, G-Tateth may route and mirror elements of its core application traffic, managed databases, and metadata across with infrastructure providers in foreign countries.

Cross-Border Safeguards: In compliance with Part VIII of the NDPA 2023, G-Tateth executes formal, legally binding Data Processing Addendums (DPAs) embedded with Standard Contractual Clauses (SCCs) with all infrastructure sub-processors. This legally obligates foreign data centers to enforce technical and organizational security thresholds that meet or exceed Nigerian data protection laws.

G-Tateth retains personal data only for as long as necessary to fulfill the primary collection purposes outlined in this policy, or to satisfy statutory legal, financial, and regulatory retention timelines.

• Active Subscriber Data: Maintained throughout the entire active lifecycle of your G-Tateth CRM corporate contract.
• Deactivated Accounts: Upon termination of service, account data is pushed into a secure, isolated storage state and permanently purged or thoroughly anonymized within ninety (90) days, unless extended retention is dictated by financial litigation, tax requirements, or regulatory mandates.
• Marketing & Leads Tracking: Kept for a maximum period of twelve (12) months following the last documented user engagement before complete deletion.

As an NDPC-registered entity, G-Tateth enforces rigorous physical, technical, and management safeguards to shield personal data from unauthorized destruction, modification, exposure, or theft:

• Data Encryption: All inbound and outbound website and CRM connection endpoints are hardened via Transport Layer Security (TLS 1.3) protocols during transit. Databases are structurally isolated and encrypted at rest using Advanced Encryption Standard (AES-256).
• Access Control Baselines: Internal corporate access to systems is governed strictly by the Principle of Least Privilege (PoLP) and requires multi-factor authentication (MFA) across all management planes.
• Network Perimeter Defense: Continuous logging, automated web application firewalls (WAF), and active endpoint threat tracking are deployed to prevent code injections or infrastructure attacks.

Under Part VI of the NDPA 2023, Nigerian citizens and data subjects hold enforceable statutory rights regarding their personal records. You may contact G-Tateth at any time to exercise your:

• Right to Access: Request comprehensive written verification of whether we hold your personal records and obtain copies of such data in a structured, machine-readable digital format.
• Right to Rectification: Mandate immediate modification or updates to any inaccurate, incomplete, or outdated personal profiles we hold.
• Right to Erasure ("Right to be Forgotten"): Request the total deletion of your personal records from our servers, subject to valid overlapping regulatory retention mandates.
• Right to Restrict or Object to Processing: Request a limitation on how your data is handled or oppose processing activities founded purely on our corporate legitimate interests.
• Right to Data Portability: Request the clean migration of your digital assets directly to alternative service platforms where technically viable.
• Right to Withdraw Consent: Revoke processing permissions at any time without penalization for any workflow operating under prior consent.
• Right to Human Intervention in Automated Processing: The right to object to decisions based purely on automated profiling or AI-driven evaluations. G-Tateth utilizes automated logic for chat-routing, performance scoring, and first-line interaction triage. Data subjects may request human review or intervention if automated routing algorithms or system evaluations impact their operational or transactional status.

G-Tateth’s commercial platforms, BPO procurement services, and CRM software tools are built strictly for business-to-business (B2B) application. We do not intentionally market to, collect, or process data from individuals under eighteen (18) years of age. By creating an account or using this service, you confirm that you are at least 18 years old. We may request your date of birth to verify your eligibility to use the platform. We reserve the right to request additional verification of age and to suspend or delete accounts where age requirements are not met or cannot be verified. Providing false information about your age may result in immediate suspension or termination of your account.

G-Tateth reserves the absolute right to revise or update this Website Privacy Policy from time to time to mirror changes in our code stack, server geography, or evolving interpretations of Nigerian data laws. Any updates will be announced by changing the "Last Updated" timestamp at the crown of this policy document. Continued utilization of our web systems after amendments constitutes acceptance of the modified compliance version.

If you have any clarifications regarding this Website Privacy Policy, wish to file an internal complaint, or want to formally execute any statutory data privacy rights, please use the Data Subject Request or reach out directly to our internal compliance head:

Data Protection Officer (DPO)
G-Tateth Limited
Email: compliance@g-tateth.com
Office Address: Lagos, Nigeria.

If you believe G-Tateth has handled your data inappropriately and failed to resolve your internal escalation within a reasonable timeline, you retain the legal right to escalate the matter directly by filing an administrative complaint with the Nigeria Data Protection Commission (NDPC) at:
Address: No. 12, Dr Clement Isong Street, Asokoro, Abuja, Nigeria.
Email: info@ndpc.gov.ng
Telephone: +234 (0) 916 061 5551