Privacy policy
Amaya & Co. Technologies (“Amaya & Co.”, “we”, “us”) respects your privacy. This policy explains what personal data we collect through this website, why, how long we keep it, who we share it with, and the rights you have. It applies to this website only; our products (such as KudiAI Track) have their own privacy notices.
Who is responsible for your data
Amaya & Co. Technologies is the data controller for personal data collected through this website. You can contact us about privacy at any time via our contact form.
What we collect and why
| When you… | We collect | We use it to | Lawful basis |
|---|---|---|---|
| Send a contact message | Name, email, organisation and phone (optional), message, the page you sent it from | Reply to you and route your message to the right team | Legitimate interest in responding to enquiries |
| Request a demo | Name, email, phone, organisation, business type, team size, notes | Arrange and prepare your demo | Steps taken at your request before a contract |
| Subscribe to our newsletter | Email address, when and where you subscribed, confirmation status | Send the insights you asked for | Consent, confirmed by email (double opt-in); withdraw at any time |
| Apply for a job | Name, email, phone, CV, cover note | Assess your application and contact you about it | Steps taken at your request before a contract |
| Accept analytics cookies | Pages visited, device and browser information, approximate location, anonymised session recordings | Understand how the site is used and improve it | Consent — nothing loads until you accept |
To protect our forms from abuse we also process a one-way, salted hash of your IP address (never the address itself) to limit repeated submissions, and use Cloudflare Turnstile to check that a submission comes from a person. These are legitimate interests in keeping the service secure.
How long we keep it
- Contact messages and demo requests: up to 24 months after our last correspondence, then deleted.
- Job applications: up to 12 months after the role closes, unless you ask us to keep your CV on file longer.
- Newsletter subscriptions: until you unsubscribe. We keep a record of the unsubscribe so we do not email you again.
- Analytics data: according to the retention settings of Google Analytics (14 months) and Microsoft Clarity.
Who we share it with
We do not sell personal data. We share it only with service providers who process it on our behalf:
- Supabase — database and file storage
- Vercel — website hosting
- Resend — sending transactional emails
- Cloudflare — bot protection on our forms
- Google (Analytics) and Microsoft (Clarity) — website analytics, only with your consent
Some of these providers process data outside Nigeria. Where they do, we rely on appropriate safeguards recognised under the Nigeria Data Protection Act 2023, such as contractual commitments to protect your data.
How we protect it
Personal data is encrypted in transit, access is restricted to the people who need it, and database access is controlled row by row. CVs are stored in a private location and can only be opened by authorised staff through links that expire after an hour.
Cookies and analytics
This site uses only strictly necessary storage by default. With your permission we use Google Analytics and Microsoft Clarity. Clarity does not load at all, and Google Analytics does not set cookies, until you accept. You can change your choice at any time using “Cookie settings” in the footer.
Your rights
Under the Nigeria Data Protection Act 2023 and, where it applies, the EU/UK GDPR, you have the right to:
- be informed about how your data is used;
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to processing;
- receive your data in a portable format;
- withdraw consent at any time, without affecting earlier processing.
To exercise any of these rights, contact us via our contact form. We will respond within the time the law requires. If you are not satisfied, you can complain to the Nigeria Data Protection Commission (NDPC).
Children
This website is intended for adults and businesses. We do not knowingly collect data from children.
Changes to this policy
We will update this page if our practices change, and revise the date at the top. Significant changes will be highlighted on the site.