Who we are and what this policy covers
DAC Consulting (“DAC”, “we”, “us” or “our”) provides business consulting across People Management, Process Management, and Product and Brand Management. This Privacy Policy explains how we handle personal information when you browse our website, contact us, request a consultation or apply for Project 120. Personal information means information that identifies you or can reasonably be linked to you. Information about an organisation may also be personal information when it identifies its representatives or other individuals.
DAC is responsible for deciding why and how information collected for its own enquiries and initiative applications is used. Where a separate client engagement involves processing information on a client’s instructions, the engagement agreement and any applicable data processing terms govern that work alongside relevant law. This website policy does not replace an employment notice or a project-specific notice. For privacy questions or requests, use our contact form and enter “Privacy request” as the enquiry topic.
Information we collect and its sources
Our general contact form asks for your name, email address, enquiry topic and message, with an optional phone number. The consultation form asks for your first and last names, email address and organisation, and also allows you to provide a WhatsApp phone number, sector, job title, referral source, service need, proposed event date and additional message. We receive this information directly from you and may receive further information during our correspondence. Required fields are marked in the form or enforced by its validation; without the information needed to identify your request and reply, we may be unable to assist you.
Project 120 applications are collected through a Google Form opened from the Project 120 page. The form’s questions and required-field indicators show the information requested for the application. We use the contact, organisation and application information you supply to assess and administer your request. The Google Form may change independently of this website; check its questions before submitting and provide only information relevant to your application.
Your browser also sends technical information when it requests a page, file or embedded service. Hosting and form providers may process IP addresses, request times, browser and device information, referring pages and security or error records to deliver their services and detect abuse. We do not ask you to create a website account, and the current website does not collect card details or take online payments.
How and why we use information
We use enquiry and consultation information to understand your needs, reply to your message, discuss relevant services, prepare proposals and arrange next steps. A consultation request is an enquiry and does not automatically reserve a calendar appointment. We use Project 120 application information to review applications, communicate about selection, clarify eligibility and scope, and administer support if your organisation is selected.
We also use relevant information to keep necessary correspondence and business records, maintain the website, prevent spam and misuse, handle complaints, protect legal rights and meet applicable legal obligations. We do not treat a contact or consultation submission as permission to send unrelated promotional messages. If we offer optional marketing communications, the purpose and available choice will be explained separately, and you may ask us to stop at any time.
If advertising technologies are enabled, we may use website activity information to understand engagement with our pages, measure campaign performance and deliver relevant advertising. Those activities will be subject to the choices and legal requirements explained in the cookies section.
Legal grounds and your choices
Where a law requires a legal basis, the basis depends on the activity. Responding to an individual’s request to enter a contract may be necessary to take steps at that individual’s request before a contract. Handling an organisation’s business enquiry or initiative application through its representative, managing correspondence and maintaining website security may rely on legitimate interests, subject to the individual’s rights and reasonable expectations. Records required by law rely on the relevant legal obligation. Where consent is required, including for a particular optional use, we will request it for that use and explain how to withdraw it.
Reading this policy or continuing to browse does not by itself give consent to every form of processing. You can choose not to submit optional information or open an embedded form. Withdrawing consent does not affect earlier processing that was lawful, or processing supported by another valid legal ground. You may object to processing based on legitimate interests and may object to direct marketing at any time.
Form delivery, service providers and other recipients
General contact messages are sent to Web3Forms for processing and delivery to DAC’s configured receiving inbox. Web3Forms and its infrastructure, email delivery and anti-spam providers may process the form contents and associated technical information. A delivered message may also remain in the receiving mailbox and subsequent correspondence. Web3Forms is not the delivery route for the consultation form in the current website.
Consultation requests are sent to a Google Apps Script web application that receives the submitted consultation details for DAC. Project 120 applications are handled through Google Forms; responses are accessible through the form owner’s Google account and may be stored in a connected response spreadsheet if the owner configures one. Google processes information under the terms applicable to the account and service, including its Privacy Policy. We do not publish application responses or consultation records on this website.
Information may be made available to DAC personnel or advisers who need it to respond to your request, evaluate an application, deliver agreed work or address legal and operational requirements. Hosting, email and other necessary service providers may process information for their service functions. We may disclose information when lawfully required, to establish or defend legal claims, or as part of a business transfer subject to appropriate confidentiality and applicable law. If we enable Meta Pixel or other advertising technologies, information about website activity may also be disclosed to the relevant advertising provider, as explained in the “Cookies, embedded content and external links” section. These disclosures are separate from the information needed to receive and respond to your enquiry or application.
Sensitive information and other people’s data
Please do not include passwords, payment card details, government identification documents, health information, employee case files or other sensitive or confidential records in ordinary website messages unless DAC has specifically agreed a suitable method and lawful purpose for receiving them. Our website forms are intended for an initial conversation or initiative application, not unrestricted transfers of an organisation’s personnel database.
If you provide information about another person, you must be authorised to do so and ensure that any required notice and legal basis are in place. We may ask you to remove unnecessary information or use a more suitable channel. Any further collection of sensitive information for an engagement requires the applicable additional protections and legal conditions.
Security and encryption
The configured contact and consultation destinations use HTTPS, which uses Transport Layer Security (TLS) to protect information while travelling between your browser and the receiving service. Encryption in transit reduces the risk that someone intercepting that connection can read its contents. It does not prevent the intended recipients or authorised account users from reading a submission, and it does not make an ordinary contact form end-to-end encrypted.
Google describes its Docs and Sheets content as encrypted in transit and at rest. Web3Forms also describes HTTPS transmission and encryption at rest for its service. At-rest encryption protects stored data on the provider’s systems; it is different from restricting who can sign in to an account or open a spreadsheet. These provider protections are described in their published documentation and do not represent a claim that DAC operates its own encryption infrastructure or uses a particular cipher for every copy of a record.
Appropriate protection also depends on account permissions, authorised access, device security and careful handling of exported records and email copies. No internet transmission or storage system is completely secure. If you suspect a privacy or security incident involving information submitted to DAC, contact us promptly without including further sensitive information. Where an incident meets the applicable legal threshold for notification, we will notify the relevant authority and affected individuals as required.
International processing and transfer safeguards
DAC serves organisations in Nigeria and uses external technology providers whose infrastructure and support operations may be outside Nigeria or your country of residence. Google operates internationally, and Web3Forms states that it operates from India with infrastructure in multiple regions. Your information may therefore be processed in countries with different privacy laws and may be subject to lawful access by authorities in those countries.
Where the Nigeria Data Protection Act requires safeguards for an international transfer, the transfer must meet its adequacy requirements or another permitted legal condition. Where the EU or UK GDPR applies, an applicable adequacy decision or appropriate safeguards, such as relevant standard contractual clauses and additional measures where needed, must support a restricted transfer unless a lawful exception applies. Under PIPEDA, where applicable, an organisation remains accountable for information transferred to a processor and must use contractual or other means to provide comparable protection. These mechanisms depend on the actual provider terms, recipient and transfer; they are not created merely by linking to this policy.
You may use our contact form to ask which safeguards apply to your information and request relevant information or a copy, subject to lawful limits and protection of confidential material.
How long information is kept
Retention depends on the purpose and context rather than one period for every record. Enquiry and consultation correspondence is needed while a request is active and for a proportionate period afterwards to manage follow-up, complaints and relevant legal claims. Application information is needed for the selection cycle, communications, administration of any support and resolution of related issues. If an enquiry or application leads to an engagement, relevant information becomes part of the engagement record and may need to be retained for contractual, accounting or legal reasons.
In deciding how long a record is needed, we consider whether the request or programme is still active, the nature and sensitivity of the information, applicable record-keeping duties, relevant limitation periods, and whether the purpose can be met using less or anonymised information. Information should be deleted or irreversibly anonymised when it is no longer needed, unless a legal hold or other lawful reason requires continued retention. You can ask us for the retention criteria and expected period for a particular record.
Copies held by service providers, email systems, exports and backups can have separate deletion cycles. Deleting a spreadsheet row does not necessarily delete a form response or an email copy. Web3Forms’ published policy describes retention of submission data for up to three years, subject to shorter plan settings or earlier deletion; this is its service limit, not a promise that every DAC record is kept for three years. Provider retention must be considered alongside DAC’s own need to retain or delete the information.
Your privacy rights
Depending on the law that applies and the circumstances, you may request confirmation that we hold information about you, access to that information, correction of inaccurate or incomplete information, deletion, or restriction of a particular use. You may be able to receive information you provided in a structured, commonly used, machine-readable format or have it sent to another organisation where technically feasible and where the relevant portability conditions are met. You may withdraw consent where processing depends on it and object to processing based on legitimate interests or to direct marketing.
These rights have conditions and exceptions. For example, we may need to retain a record to comply with a legal obligation or establish or defend a legal claim, and access must respect other people’s rights. Where applicable, you also have protections concerning decisions made solely by automated processing that have legal or similarly significant effects. The website’s own scripts do not make automated eligibility or service decisions; form validation and spam checks are not a substitute for a decision on your application.
How to exercise your rights or raise a concern
Use our contact form, select or enter “Privacy request” as the enquiry topic, and describe the information or activity concerned and the action you want us to take. Include the email address used for the original submission and an approximate submission date if known. Do not send identity documents in the initial request. There is no website account to create in order to make a request. A representative may act for you where permitted; we may ask for evidence of authority and proportionate identity verification where the law allows it.
We will consider requests under the applicable law, explain any lawful refusal or necessary extension, and tell you about available complaint rights. GDPR requests are normally answered within one month; permitted extensions require notice and reasons. PIPEDA access requests generally have a 30-day deadline, subject to lawful extensions. Where the CCPA applies, qualifying access, correction and deletion requests generally have a 45-day deadline, with extensions permitted in specified circumstances. A shorter deadline required by applicable law takes priority. Requests are normally handled without charge; any lawful exception will be explained before a fee is charged.
You can complain directly to the Nigeria Data Protection Commission. Where applicable, you may also complain to your European supervisory authority, the UK Information Commissioner, the Office of the Privacy Commissioner of Canada, the California Privacy Protection Agency or another competent authority. Contacting DAC first may help resolve a concern, but is not a condition of exercising a right to complain.
Regional laws and California information
The Nigeria Data Protection Act 2023 is central to our handling of personal information in Nigeria. The EU GDPR, UK GDPR, California Consumer Privacy Act as amended by the California Privacy Rights Act, PIPEDA and other regional laws apply only where their territorial, activity and other legal requirements are met. This policy describes relevant rights without asserting that every law applies to every visitor or that the existence of a policy alone establishes compliance.
For the website activities described here, the categories of information are identifiers and contact details; professional and business-contact information; information supplied in messages or applications; and internet or device activity information processed in delivering and protecting the site and its forms. Sources are you, your authorised representatives and technical requests from your browser. The purposes and recipient categories are explained above. California residents may, where the CCPA applies, request to know, access, correct or delete qualifying information, obtain a portable copy, and exercise rights concerning sale, sharing and certain uses of sensitive personal information. They also have a right not to receive unlawful discriminatory treatment for exercising those rights.
We plan to use advertising technologies, including Meta Pixel, for advertising measurement and personalised advertising. These technologies are not currently active. Depending on applicable law, sharing information with advertising partners may give you rights to object or opt out, even where no payment is involved. You can contact DAC through our contact form with questions about this planned use.
Age restrictions and children’s privacy
This business website and its consultation and initiative application forms are intended for adults aged 18 or over acting for themselves or an organisation. They are not directed to children, and minors should not submit personal information through these forms. If a parent, guardian or another person believes that a child has provided information, contact DAC so that we can investigate and take appropriate steps, including deletion where required.
If a future service expressly involves children, it will require an appropriate separate process, notices, age-appropriate protections and parental or guardian consent where required by law. This policy does not authorise the collection or use of children’s information merely because an adult has visited the website.
Changes to this policy
We may update this policy when our services, providers or data-handling practices change, or to reflect legal requirements. The date at the top identifies the latest published version. Material changes will be brought to your attention in an appropriate way where required, and a new use that requires consent will not be authorised simply by updating this page. You can revisit this policy or contact DAC if you need clarification.