Legal
Privacy Policy
Last updated 14 September 2026
This policy explains what personal data Zarachtech collects through this website, why we collect it, how long we keep it, and the rights you have over it. We have written it to describe what this site actually does rather than to cover every hypothetical.
Who we are
Zarachtech (RC: BN3256942) is a web, mobile and VoIP development practice based in Lagos, Nigeria. For the purposes of the Nigeria Data Protection Act 2023 (NDPA), we are the data controller for personal data collected through this website.
Zarachtech (RC: BN3256942)
Lagos, Nigeria
Email: zarachtech@gmail.com
Phone: +234 706 236 8847
What we collect, and when
We only collect personal data when you give it to us, plus a small amount of technical data that is unavoidable when running a website securely.
When you use the contact form
- Your name, email address, subject and message.
- Your IP address and browser user-agent string, recorded with the message.
When you subscribe to the newsletter
- Your email address, and the date you subscribed.
Automatically, on every visit
- A session cookie, so the site can protect forms against cross-site request forgery.
- A short-lived, irreversibly hashed record of your IP address, used only to rate-limit form submissions and blocked login attempts.
- Standard web server logs kept by our hosting provider.
We do not ask for, and this site has no facility to accept, payment card details, government identification numbers or any special category data.
The AI voice assistant
The site offers an optional voice assistant (“Talk to my AI”). It only activates when you press Start call — that action is your consent. While the call is live, your microphone audio is streamed to OpenAI, which processes it to understand you and generate the assistant's spoken replies. Audio passes through OpenAI under its own privacy terms; we do not record or store call audio ourselves.
If you choose to leave your details with the assistant, we store only what you give it — your name, a contact address or number, and a short project description — alongside ordinary contact-form messages, under the same 24-month retention rule. Ending the call stops all audio processing immediately. The assistant is an AI: it can make mistakes, and nothing it says is a binding quote — please don't share payment details, identification numbers or other sensitive data with it.
Why we use it, and our lawful basis
| Purpose | Data used | Lawful basis (NDPA s.25) |
|---|---|---|
| Replying to your enquiry | Name, email, subject, message | Steps taken at your request prior to entering a contract |
| Sending the newsletter | Email address | Your consent, withdrawable at any time |
| Preventing spam and abuse of our forms | Hashed IP, user-agent | Our legitimate interest in keeping the site available and free of abuse |
| Securing the administrative area | IP, user-agent, timestamps of sign-in attempts | Our legitimate interest in protecting the site, and our legal obligation to secure personal data |
| Understanding how the site is used | Analytics data, where enabled | Your consent |
How long we keep it
- Enquiries — retained for up to 24 months after our last correspondence, so we can pick up an earlier conversation, then deleted.
- Newsletter subscriptions — retained until you unsubscribe.
- Rate-limiting records — automatically discarded within an hour.
- Security logs — retained for up to 12 months.
Who we share it with
We do not sell personal data, and we do not share it for anyone else's marketing. Data is disclosed only to:
- Our hosting provider, which stores the site and its database on our behalf.
- OpenAI, which processes voice-assistant call audio while a call you started is live.
- Google, where Google Analytics or reCAPTCHA is enabled — see our Cookie Policy.
- A public authority, where we are required to by Nigerian law.
Where a provider processes data outside Nigeria, we rely on the transfer conditions in Part IX of the NDPA and satisfy ourselves that an adequate level of protection applies.
How we protect it
The site is served over HTTPS with HTTP Strict Transport Security. Administrative access requires a password stored only as a one-way hash, and is protected by session-timeout and rate-limited sign-in. Form submissions carry CSRF tokens, database queries use prepared statements, and a Content Security Policy restricts what the browser will load. Databases, configuration and logs sit outside the publicly reachable path.
No system is perfectly secure, and we do not claim otherwise. If we become aware of a breach that is likely to result in a risk to your rights, we will notify the Nigeria Data Protection Commission and, where required, you directly.
Your rights
Under the NDPA you may ask us to:
- confirm whether we hold personal data about you, and give you a copy;
- correct data that is inaccurate or incomplete;
- delete data where we no longer have grounds to keep it;
- restrict or object to how we use it;
- provide it in a portable, machine-readable form; or
- withdraw consent, where consent is the basis we rely on.
Email zarachtech@gmail.com and we will respond within 30 days. There is no charge. If you are not satisfied with our response, you may complain to the Nigeria Data Protection Commission.
Children
This site is intended for business use and is not directed at children under 18. We do not knowingly collect their data. If you believe a child has provided us with personal data, contact us and we will delete it.
Changes to this policy
If we change how we handle personal data we will update this page and the date shown at the top. Where a change materially affects your rights, we will say so prominently.