Privacy Policy

Who we are

This policy explains how HBC Professional Consulting Services (trading as HBC Business Help) collects and uses personal data through Nigeria 2.0 Nigerian Leadership Business Summit 2026 (www.nlbs.com.ng). We decide why and how your data is used, so we are the data controller under the Nigeria Data Protection Act 2023 (NDPA) and the General Application and Implementation Directive 2025 (GAID).

• Address: No 5, Oremeji Bus-Stop, Oyo Road, Mokola, Ibadan, Oyo State, Nigeria
• Phone: +234 813 320 5522
• General enquiries: info@nlbs.com.ng
• Data Protection Officer: dpo@nlbs.com.ng

Questions about this policy or your data go to our Data Protection Officer at dpo@nlbs.com.ng.

What we collect, why, and our lawful basis

We only collect what each form needs. For each way you deal with us:

Summit registration (invitation request)

• What: Full name, email, phone and WhatsApp number, organisation, job title, sector, country, delegate type, who nominated you, and any dietary or access needs you choose to tell us.
• Why: To review your request, send your invitation and event information, plan seating and catering, and run security and accreditation at the venue.
• Lawful basis: Steps you ask us to take before attending (contract), and our legitimate interest in running a safe event. Dietary and access needs can reveal health information, so we only use them with your explicit consent, given when you tick the box under that field.
• How long we keep it: 2 years from registration, then deleted. This lets us invite past delegates to the next edition; ask us and we delete it sooner.

Contact and enquiry form

• What: Full name, email, organisation, topic and your message.
• Why: To answer your enquiry and follow up on partnership, exhibition, pitch, media or general questions.
• Lawful basis: Our legitimate interest in responding to people who contact us.
• How long we keep it: 2 years after your last message, then deleted.

Partner and sponsorship request

• What: Organisation details, contact person's name, email, phone and role, the package requested, and the names and emails of the people you nominate for VIP passes.
• Why: To prepare and manage the partnership agreement and issue passes.
• Lawful basis: Steps towards a contract with your organisation. For pass holders: our legitimate interest in issuing the passes your organisation asked for. If you name pass holders, tell them you are sharing their details with us and point them to this policy.
• How long we keep it: 2 years from the request, then deleted. A signed partnership agreement is kept for as long as the law requires us to keep contracts.

Talent Fund application

• What: Full name, WhatsApp number, email, state of residence, age band, who referred you, chosen track, skills and experience, problem statement, video link, CV (PDF), portfolio, business details and revenue band (if any), availability, previous support, device access, your pitch, and your book pre-order reference.
• Why: To check eligibility, score and shortlist applications, plan training hubs by state, contact shortlisted applicants, and introduce selected applicants to partners.
• Lawful basis: Your consent, given when you tick the consent box, and steps you ask us to take before joining the programme.
• How long we keep it: 2 years from your application, then deleted. Uploaded CVs are deleted after 1 year. Selected applicants' records are kept for the length of the programme.

Privacy request form

• What: Full name, email, phone (optional), the right you want to use and the details you give us.
• Why: To verify who you are and answer your request.
• Lawful basis: Our legal obligation under the NDPA.
• How long we keep it: 3 years from our answer, as proof that we handled your request.

At the summit

• What: Your name badge details, attendance check-in, and photographs or video of the summit in which you may appear.
• Why: Accreditation, venue security, and reporting on and promoting the summit.
• Lawful basis: Our legitimate interest in running and reporting on the event. Tell the photographer or the registration desk if you do not want to be photographed, and ask us to remove any photo of you we publish.
• How long we keep it: Only as long as needed for that purpose.

We do not sell your personal data, and we do not use it for advertising profiles.

Information collected automatically

• Our server keeps standard access logs (IP address, browser type, page requested, time) for 30 days to keep the site secure and fix faults.
• When you submit a form we store your browser type and a scrambled (one-way, keyed) version of your IP address to spot abuse and repeat spam. We do not store your raw IP address with your submission.
• We do not use analytics, advertising or tracking cookies. What the site keeps in your browser is listed in our Cookie Policy.

Sensitive personal data

Dietary or access needs can reveal information about your health or religion, which the NDPA treats as sensitive personal data. That field is optional. If you fill it in, we ask for your explicit consent and use it only to arrange catering and access for you at the summit. Only the event team sees it. You can withdraw your consent at any time and we will delete it.

We do not ask for your religion, ethnicity, political opinions or biometric data.

Automated decisions

Talent Fund application

Applications from people aged 36 or over, or who say they cannot commit the time, are declined automatically because they do not meet the published eligibility rules. Some points (video, partner referral, age and availability) are added automatically; a person reviews every eligible application before anyone is shortlisted. You can ask for a person to review any automatic decision.

To ask for a person to review an automatic decision, to explain your point of view or to contest it, use the privacy request form and choose "Review an automated decision".

Who receives your data

Only the people and organisations below, and only what they need:

• Our web hosting provider. Stores the websites and the information you send us through them, and sends our emails, under a hosting contract.
• WhatsApp (Meta). We contact shortlisted Talent Fund applicants and some delegates on the WhatsApp number they gave us. Their privacy policy.
• Talent Fund training and hiring partners. Receive the profiles of shortlisted applicants they select for training, internships or jobs. Only shortlisted applicants, only the partners who select them.
• Public authorities. Only where Nigerian law requires it, for example a court order, the NDPC or tax authorities.

Inside our organisation, staff see only the forms of the website they work on. Every service provider that handles personal data for us must keep it confidential and secure and use it only on our instructions.

Transfers outside Nigeria

Some of the recipients above may store or process data outside Nigeria: Our web hosting provider; WhatsApp (Meta). We only transfer personal data abroad where the NDPA allows it: to a country the NDPC recognises as giving adequate protection, under contractual safeguards that give your data the same level of protection it has in Nigeria, or on another ground the NDPA permits. Ask our Data Protection Officer for details of the safeguards that apply.

How long we keep it

Server logs are kept for 30 days. When a period ends, our system deletes the personal data automatically or keeps only anonymous totals (for example, how many people registered).

How we protect it

• All pages and forms use encrypted connections (HTTPS).
• Submissions are stored in a private database. Uploaded files are kept in private storage that is not reachable from the web.
• Staff sign in to a password-protected dashboard and see only the websites assigned to them.
• Payments are handled by Paystack. We never receive or store card or bank details.
• If a personal data breach puts your rights at risk, we notify the NDPC within 72 hours of becoming aware of it, and we tell you directly, without undue delay, if the risk to you is high, with advice on how to protect yourself.

Your rights

Under the NDPA you have the right to:

• Be informed about how we use your data (this policy).
• Access your data and get a copy of it.
• Correct data that is wrong or incomplete.
• Delete your data when we no longer need it, when you withdraw consent, or when it was processed unlawfully.
• Restrict our use of your data while a complaint or correction is being looked at.
• Data portability: receive your data in a common machine-readable format (JSON or CSV) or have us send it to another organisation.
• Object to processing based on our legitimate interests, and to direct marketing at any time.
• Withdraw consent at any time, where we rely on consent. This does not affect what we did before you withdrew it.
• Not be subject to a decision based only on automated processing that significantly affects you, and to ask for a person to review it.
• Complain to the Nigeria Data Protection Commission (see "Complaints" below).

How to use your rights

• Fill in our privacy request form, or email dpo@nlbs.com.ng.
• It is free. We may ask you to confirm your identity first, usually by replying from the email address you used with us, so we never give your data to someone else.
• We answer within 30 days. If a request is complex we will tell you within that time why we need longer.
• If we cannot do what you ask (for example, we must keep sales records by law), we explain why.

Children

Our websites and forms are for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18 without the consent of a parent or guardian. If you believe a child has sent us personal data, email dpo@nlbs.com.ng and we will delete it.

Complaints

Please contact us first at dpo@nlbs.com.ng so we can put things right. You also have the right to complain to the regulator at any time:

• Nigeria Data Protection Commission (NDPC)
• Email: dpo@ndpc.gov.ng
• Website: ndpc.gov.ng

Changes to this policy

This policy took effect on 1 October 2026 (version 2026-10-01). If we change how we use your data, we update this page and its date, and where the change matters to you we tell you before it applies. Each form records the version of this policy that was shown when you submitted it.