Overview
This Privacy Notice explains how Terratora Limited collects and processes your personal data when you visit our website and related platforms (the “Site”). It sets out what we do with your personal data, how we keep it secure and the rights you have in relation to it.
Who we are
Terratora Limited (“Terratora” or “the Company”) is an Environmental, Social and Governance advisory firm helping organisations in Nigeria and globally navigate evolving regulatory mandates, transform operations and create long-term stakeholder value. We may use your details strictly to evaluate business requirements, address enquiries and deliver strategic sustainability and corporate-transformation services.
Personal data we collect and process
We limit collection to what is necessary to fulfil your request.
Data you provide directly
- Contact and professional identifiers: Full name, corporate email address, phone number, job title or designation, and organisation name.
- Enquiry details: The content of your message, project brief or service request.
- Communication and marketing preferences: Your explicit preference about receiving regulatory briefs, industry insights or other promotional material.
Data collected automatically
- Usage and behavioural data: Pages viewed, resources downloaded, search queries and duration of visit.
- Technical and device identifiers: IP address, browser type, operating system, device characteristics and approximate geographic region.
Cookies
Cookies help us distinguish you from other users and provide an improved browsing experience. Read our Cookie Policy for further information.
Use of your personal data
We may use personal data collected on our Site to:
- Respond to enquiries, service requests or consultative briefs submitted through forms or email links.
- Manage and maintain our professional relationship with your organisation, including proposals, briefings and service delivery.
- Improve website functionality, service offerings and overall user experience.
- Send ESG industry insights, regulatory updates and corporate publications where you have explicitly opted in.
- Comply with legal, regulatory and reporting obligations under Nigerian law, including NDPA requirements, or relevant international standards.
Legal basis for processing
- Contractual necessity: Processing necessary to take pre-contractual steps at your request or execute an advisory agreement.
- Legitimate interests: Processing necessary to operate, secure and optimise the website, respond to business enquiries and conduct B2B communications, provided your rights do not override these interests.
- Explicit consent: Where required, including subscriptions to regulatory briefs or acceptance of optional cookies. You may withdraw consent at any time without penalty.
- Legal and regulatory obligations: Processing necessary to comply with legal, tax or regulatory duties under Nigerian law or international professional standards.
Sharing of your personal data
Terratora does not sell, rent or trade your personal data for marketing. We share information only under appropriate confidentiality arrangements and in compliance with the NDPA for the following purposes:
- Third-party service providers and sub-processors: Vetted technical vendors such as cloud hosting, IT infrastructure, web analytics and client-management tools, acting only on our instructions.
- Professional advisers and affiliates: Legal advisers, auditors or technical co-consultants where needed for specialised or multi-jurisdictional engagements.
- Legal and regulatory compliance: Nigerian or international regulators, government authorities, law enforcement agencies or courts where required by law or official mandate.
- Corporate restructuring: A merger, acquisition, joint venture or sale of assets, subject to confidentiality commitments.
- Protection of rights and system integrity: Enforcing terms, protecting intellectual property, defending claims or safeguarding systems against cyber threats.
International transfers
As a global ESG advisory firm, Terratora may transfer, store or process personal data outside your country of residence, including through secure cloud infrastructure in Europe, the United Kingdom or North America. We ensure transfers comply with the Nigeria Data Protection Act 2023, the Nigeria Data Protection Commission’s General Application and Implementation Directive 2025 and the GDPR where applicable.
- Adequacy and safeguards: We use approved jurisdictions or appropriate safeguards such as Data Processing Agreements and Standard Contractual Clauses.
- Transfers to other jurisdictions: Where no adequacy designation exists, we apply supplementary technical measures, such as end-to-end encryption, or rely on explicit informed consent where appropriate.
Data retention and security
We retain personal data only as long as necessary for the purpose collected or to satisfy legal, statutory, accounting or regulatory requirements. We consider the amount, nature and sensitivity of the data; the potential risk from unauthorised use; the duration of the business relationship; statutory retention periods; and limitation periods for legal or professional claims.
When data is no longer required, it is securely deleted, overwritten or irreversibly anonymised. Our organisational, technical and physical controls include secure servers, firewalls, multi-factor authentication, encryption, anonymisation or pseudonymisation where appropriate, and need-to-know access controls.
Your rights as a data subject
Under the NDPA and applicable international laws, you may exercise the following rights:
- Access and information about how your data is processed.
- Rectification of inaccurate or incomplete personal data.
- Erasure where no legal or statutory retention duty applies.
- Withdrawal of consent at any time where processing is consent-based.
- Restriction of processing in qualifying circumstances.
- Data portability in a machine-readable format where technically feasible.
- Objection to direct marketing or processing based on legitimate interests.
- Protection from decisions based solely on automated processing or profiling that significantly affect you.
- A complaint to the Nigeria Data Protection Commission at info@ndpc.gov.ng, or to your local data-protection authority.
How to exercise your rights
Contact our Data Protection Officer at privacy@terratoraconsulting.com. We will respond within 30 calendar days in accordance with NDPA guidelines and may need to verify your identity before fulfilling a request.
Changes to this Privacy Notice
Terratora may update this notice to reflect changes in the Nigeria Data Protection Act, other regulations, international standards such as GDPR, or our operations and technology. Material changes will be highlighted on the website, reflected in an updated effective date or communicated by email where appropriate. Where a change significantly affects consent-based processing, we will seek fresh consent before it takes effect.
Contact our Data Protection Officer
Questions about our collection and processing of personal data or the exercise of your rights under the NDPA or GAID can be sent to privacy@terratoraconsulting.com.
Terratora Limited
