Privacy notice.

This notice explains what personal data AgendaX collects through this website and Triage Engine, why, who else handles it, how long we keep it, and your rights under the Nigeria Data Protection Act 2023.

Who we are

AgendaX runs Triage Engine and this website, and is the data controller for the personal data described here. We are based in Lagos, Nigeria. For anything about your personal data, email hello@agendax.com.ng.

What we collect and why

• Waitlist sign-ups. Your work email and company, plus anything else you choose to add, such as your name, role or a message. We use this only to contact you about access to Triage Engine. Our legal basis is that you asked us to, and we need the details to take the steps you requested before a possible contract (section 25(1)(b)(i) of the Act).
• Client accounts. Your email, your company and your password, which we store only in scrambled (hashed) form. We use these to let you sign in to your triage board, as part of our contract with you (section 25(1)(b)(i)).
• Alert contacts. The email addresses a client asks us to send risk alerts and weekly summaries to, and a record of each email we send (who it went to, when, and whether it was delivered). We use these to deliver the alerts and summaries the client has asked for, as part of our contract with the client (section 25(1)(b)(i)).
• Sign-in security. When someone tries to sign in, we record the IP address, the email entered, the time and whether it worked, so we can block password guessing. Our legal basis is our legitimate interest in keeping accounts secure.
• Cookies. We set one cookie. It protects our forms against forgery and keeps signed-in clients signed in. The site needs it to work. We do not use analytics or advertising cookies, and we do not track you across other sites.
• Public content we monitor for clients. Triage Engine reads publicly published news articles, forum posts and videos that mention our clients' companies. These can include the names of people mentioned in them, or of the people who posted them. We keep the headline, a short extract, the source and a link, so clients can see what is being said publicly about their business. Our legal basis is our clients' legitimate interest, and ours, in knowing what is said publicly about their business.

Who else handles it

We use a small number of service providers, who handle personal data only to provide their service to us:

• Render hosts this website.
• Supabase hosts its database.
• Resend delivers our emails: the notice we receive when someone joins the waitlist, and risk alerts and weekly summaries to AgendaX staff and clients' alert contacts.
• Proton provides our email inbox, where we receive waitlist notifications and your emails to us.
• Google (the Gemini service) helps judge the tone of public headlines we monitor, and drafts holding statements for AgendaX staff to review. It receives public headlines and short extracts only, never waitlist, account or alert-contact details.

We do not sell personal data or share it for advertising.

Transfers outside Nigeria

These providers store and process data outside Nigeria. We transfer personal data abroad only as section 43 of the Act allows, for example where the transfer is needed to take steps you have asked for or to perform our contract with you.

How long we keep it

• Waitlist details: until we offer you access. We then delete them. If you become a client, your account details take their place. You can ask us to delete them sooner at any time.
• Client accounts: while you are a client. We delete them when our contract ends, unless the law requires us to keep something.
• Alert contacts: while the client uses Triage Engine, or until the client removes them.
• Records of emails sent: 12 months.
• Sign-in records: 30 days.
• Monitored public content: while the client it was collected for uses Triage Engine.
• Server logs kept by our hosting provider, which include IP addresses: for the short period its service keeps them.

Your rights

Under Part VI of the Act, you can:

• ask for a copy of the personal data we hold about you, and where it came from;
• have it corrected if it is wrong, or deleted;
• ask us to restrict how we use it, or object to our using it;
• receive it in a format you can take elsewhere;
• withdraw consent, where we rely on it;
• not be subject to decisions made solely by automated means that significantly affect you.

To use any of these rights, email hello@agendax.com.ng. We may ask you to confirm your identity first.

Automated decisions

Triage Engine scores public content automatically so our clients can prioritise it. We do not make decisions about you, by automated means, that have legal or similarly significant effects.

Keeping it secure

The site is served over an encrypted connection. Passwords are stored only in hashed form, repeated failed sign-ins are blocked, and only AgendaX staff with admin accounts can see waitlist details.

Complaints

If you are unhappy with how we handle your personal data, you can complain to the Nigeria Data Protection Commission at ndpc.gov.ng. We would appreciate the chance to put things right first, so please contact us too.

Changes to this notice

If we change how we handle personal data, we will update this page and the effective date at the top.