Privacy Policy • Novelnaija

Effective Date: 03 January 2026
Last Updated: 03 January 2026

Introduction

Novelnaija (“we”, “us”, “our”) operates the website https://novelnaija.com.ng/ (the “Website”). We are deeply committed to protecting your privacy and personal data in full compliance with the General Data Protection Regulation (GDPR), the Nigeria Data Protection Regulation (NDPR) 2019, the South African Protection of Personal Information Act (POPIA), and all other applicable data protection laws and regulations.

This Privacy Policy explains in comprehensive detail how we collect, use, store, share, protect, and manage your personal information when you visit and interact with our Website. We encourage you to read this policy thoroughly to understand our data practices and your rights.

1. Data Controller and Contact Information

Data Controller: Novelnaija
Contact Email: info@novelnaija.com.ng
Website: https://novelnaija.com.ng/

For all enquiries, requests, complaints, or concerns regarding this Privacy Policy, our data protection practices, or your personal data rights, please contact us using the details above.

2. Our Commitment to E-E-A-T and Data Protection

As part of our commitment to Google’s Experience, Expertise, Authoritativeness, and Trustworthiness (E-E-A-T) principles, we:

Operate with complete transparency regarding all data collection and usage practices
Implement robust, industry-standard security measures to protect your information
Respect and honour your privacy rights under all applicable laws
Maintain the highest standards of data governance, integrity, and accountability
Regularly review and update our practices to reflect best practices and legal requirements

3. Information We Collect

3.1 Personal Information You Provide Directly

Contact Forms and Email Communication: When you contact us via email or website forms, we may collect:

Full name (first name and surname)
Email address
Subject line of your message
Message content and any attachments
Any additional personal information you voluntarily include in your communication

Newsletter Subscriptions (if applicable):

Email address
Name or preferred name (if provided)
Subscription date and time
Subscription preferences and interests
Communication preferences

Comments and User Interactions (if enabled via WordPress):

Display name or username
Email address
Website URL (optional field)
Comment content and text
IP address (automatically collected by WordPress)
Date and time of comment submission
Comment moderation status

Biography Suggestions and Submissions:

Information about suggested biographical subjects
Your relationship to the subject (if voluntarily disclosed)
Supporting documentation, sources, or references you provide
Your reasons for suggesting the biography

Survey Participation or Feedback (if applicable):

Survey responses and opinions
Demographic information (if voluntarily provided)
Satisfaction ratings and comments

3.2 Information Automatically Collected

When you visit our Website, we automatically collect certain technical and usage information through cookies, log files, and similar technologies:

Technical and Device Information:

Internet Protocol (IP) address
Browser type, version, and configuration
Operating system and platform (Windows, macOS, Linux, Android, iOS)
Device type (desktop computer, laptop, smartphone, tablet)
Device identifiers and unique device IDs
Screen resolution and display characteristics
Internet Service Provider (ISP)
Mobile network information (if accessing via mobile)
Time zone settings and locale preferences

Usage and Behavioural Data:

Pages viewed and content accessed
Date, time, and duration of each visit
Clickstream data and navigation paths through the website
Referring website or source of traffic (search engine, social media, direct visit)
Search queries performed on our website
Links clicked and interactions with content
Downloads of content or files
Exit pages and drop-off points
Scrolling behaviour and engagement metrics
Error messages or technical issues encountered

Location Information:

Approximate geographical location (country, region, city) derived from IP address
Language preferences and regional settings
Time zone information

3.3 Cookies and Tracking Technologies

We use cookies, web beacons, pixels, and similar tracking technologies to enhance your experience and analyse website usage. Please see Section 7 for comprehensive, detailed information about our cookie practices, types of cookies used, and how to manage them.

4. How We Use Your Information

We process your personal data for specific, legitimate purposes as outlined below:

4.1 Website Operation and Service Delivery

To operate, maintain, administer, and continuously improve our Website functionality
To provide requested services, information, and responses to your enquiries
To deliver content tailored to your interests, location, and browsing behaviour
To enable commenting, user interaction features, and community engagement
To process and respond to biography suggestions and submissions
To manage user accounts (if registration is enabled)
To remember your preferences and settings

4.2 Communication and Correspondence

To respond promptly and thoroughly to your messages, questions, and requests
To send essential administrative emails (service updates, policy changes, security alerts)
To deliver newsletters, content updates, and feature announcements (only with explicit consent)
To notify you of responses to your comments or interactions
To acknowledge and follow up on biography suggestions
To conduct satisfaction surveys or request feedback (with permission)

4.3 Analytics, Research, and Website Improvement

To analyse comprehensively how visitors discover, use, and navigate our Website
To understand user preferences, reading patterns, and content interests
To identify popular biographies, categories, and trending topics
To monitor Website performance, speed, and technical functionality
To identify and diagnose technical issues, bugs, or errors
To conduct A/B testing for content presentation, design, and user experience improvements
To generate statistical reports, aggregate insights, and usage analytics
To inform our editorial strategy and content planning
To evaluate the effectiveness of our biographical coverage

4.4 Security, Fraud Prevention, and Integrity

To protect our Website from security threats, vulnerabilities, and attacks
To detect, prevent, investigate, and respond to fraud, abuse, or illegal activities
To identify and block spam, malicious bots, automated scraping, and abusive behaviour
To enforce our terms of service, policies, and community guidelines
To protect our rights, property, intellectual property, and legitimate business interests
To protect the safety and security of our users and the public
To maintain the integrity and reliability of our Website

4.5 Legal Compliance and Obligations

To comply with applicable laws, regulations, and legal requirements in Nigeria, South Africa, EU, and other jurisdictions
To respond to valid legal requests, court orders, subpoenas, or government demands
To establish, exercise, or defend legal claims and rights
To meet regulatory reporting, audit, and transparency requirements
To cooperate with law enforcement and regulatory authorities when legally obligated

4.6 Marketing and Promotional Communications (with Consent)

To send promotional content about new biographies, features, and special series (only if you explicitly opt-in)
To inform subscribers about content updates and website enhancements
To share special features, anniversary editions, or curated collections
To conduct optional surveys or request voluntary feedback

You can opt-out of marketing communications at any time via unsubscribe links in emails or by contacting us.

5. Legal Basis for Processing (GDPR Compliance)

Under GDPR Article 6, we process your personal data based on the following lawful grounds:

5.1 Consent (Article 6(1)(a) GDPR)

We rely on your explicit, freely given consent for:

Newsletter subscriptions and marketing communications
Non-essential cookies and tracking technologies (analytics, advertising)
Voluntary participation in surveys, polls, or feedback requests
Optional information sharing beyond what’s necessary for service provision

Your Rights: You have the right to withdraw consent at any time, easily and without penalty. Withdrawal does not affect the lawfulness of processing based on consent before withdrawal.

5.2 Legitimate Interests (Article 6(1)(f) GDPR)

We process data based on our legitimate business interests for:

Website analytics, performance monitoring, and improvement
Security measures, fraud detection, and abuse prevention
Improving user experience, content quality, and editorial decisions
Responding to general enquiries and providing customer support
Operating, maintaining, and administering our Website infrastructure
Internal research, analysis, and business intelligence

We carefully balance our legitimate interests against your rights and freedoms, conducting assessments to ensure no overriding negative impact on your privacy or data protection rights.

5.3 Legal Obligation (Article 6(1)(c) GDPR)

We process data to comply with:

Legal requirements under Nigerian, South African, EU, and other applicable laws
Court orders, warrants, subpoenas, or government requests
Regulatory demands from data protection authorities
Tax, accounting, and financial reporting obligations
Data protection, privacy, and consumer protection regulations

5.4 Contractual Necessity (Article 6(1)(b) GDPR)

Where applicable, we process data to:

Provide services you specifically request from us
Fulfil our obligations under agreements, terms, or contracts with you
Take pre-contractual steps at your request

6. WordPress-Specific Data Processing

Our Website is built on WordPress, a widely-used content management system, which involves specific data processing activities:

6.1 Comment System and User Engagement

When you post a comment on Novelnaija:

Your display name (or username), email address, website URL (if provided), and comment content are stored in our WordPress database
Your IP address and browser user agent string are automatically collected for spam detection, moderation, and abuse prevention purposes
An anonymised hash (cryptographic fingerprint) of your email address may be sent to Gravatar, a third-party service operated by Automattic, to retrieve and display your profile picture if you have one associated with that email
Comments and associated metadata are retained indefinitely by default to maintain comment threads, preserve discussions, and enable effective moderation
You can request deletion of your comments at any time by contacting us at info@novelnaija.com.ng

Comment Moderation:

Comments may be held for manual moderation before appearing publicly
We may edit, remove, or refuse to publish comments that violate our policies
Spam comments are automatically filtered using plugins like Akismet

6.2 Media Uploads (if applicable)

If you upload images, photographs, or media files (where such functionality is enabled):

Location data (EXIF GPS coordinates) embedded in uploaded images may be publicly visible to other Website visitors who view or download the images
We strongly recommend removing embedded location data and metadata from images before uploading to protect your privacy

6.3 WordPress Essential Cookies

WordPress sets the following essential cookies for functionality and authenticated users:

wordpress_test_cookie – Checks whether your browser accepts and supports cookies
wordpress_logged_in_[hash] – Maintains login session for authenticated users (if user accounts are enabled)
wp-settings-[user_id] – Stores WordPress interface customisation preferences for logged-in users
wordpress_sec_[hash] – Provides security authentication and protection for logged-in users
comment_author_[hash] – Remembers your name and email when commenting

These cookies are strictly necessary for WordPress functionality and cannot be disabled without significantly affecting your ability to use certain features.

6.4 Contact Forms and Form Submissions

Data submitted through contact forms is:

Sent directly to our email address (info@novelnaija.com.ng) for prompt response
May be temporarily stored in our database depending on contact form plugins used (e.g., Contact Form 7, WPForms)
Retained only as long as necessary to address and respond to your specific enquiry
Not shared with third parties except as necessary to provide the service you requested
Deleted in accordance with our retention schedule (typically 2-3 years after resolution)

7. Cookies and Tracking Technologies

7.1 What Are Cookies?

Cookies are small text files (typically just a few kilobytes) placed on your device (computer, smartphone, tablet) when you visit our Website. They enable us to:

Recognise your device on subsequent visits
Remember your preferences and settings
Analyse how you use our Website
Improve functionality and user experience
Distinguish you from other users

Types of Tracking Technologies:

Cookies: Text files stored by your browser
Web Beacons/Pixels: Small transparent images used to track page views
Local Storage: HTML5 local storage for storing data in your browser
Session Storage: Temporary storage cleared when you close your browser

7.2 Types of Cookies We Use

Strictly Necessary Cookies (Essential): These cookies are absolutely essential for basic Website functionality and security. They cannot be disabled without severely affecting how the Website operates:

Session management and state maintenance
Security and authentication cookies
WordPress administrative and functionality cookies
Load balancing and traffic distribution
CSRF (Cross-Site Request Forgery) protection
Cookie consent preferences

Performance and Analytics Cookies: These help us understand visitor behaviour, measure performance, and improve our Website:

Google Analytics cookies (detailed in Section 8)
Page load performance monitoring
Error tracking and debugging information
User journey and funnel analysis
Heatmap and scroll tracking (if implemented)

Functional Cookies: These enhance your experience by remembering your preferences and choices:

Language and region preferences
Display preferences (font size, contrast settings)
Previously viewed biographies or reading history
Content filter or category preferences
Dark mode or theme preferences (if implemented)

Advertising and Marketing Cookies (if applicable): These may be used for targeted advertising and marketing purposes:

Google AdSense cookies (if we display advertisements)
Retargeting and remarketing cookies
Third-party advertising network cookies
Social media marketing pixels
Conversion tracking for campaigns

7.3 Cookie Duration and Persistence

Session Cookies:

Temporary cookies automatically deleted when you close your browser
Used for essential functionality during your visit
Do not persist between browser sessions

Persistent Cookies:

Remain on your device for a specified period (ranging from days to years)
Duration depends on the cookie’s purpose and configuration
Automatically expire after their set duration

Common Duration Examples:

WordPress authentication: Session or 14 days
Google Analytics _ga: 2 years
Google Analytics _gid: 24 hours
Cookie consent preferences: 12 months

7.4 Managing and Controlling Cookies

You have full control over cookies and can manage them in several ways:

Browser Cookie Settings:

Google Chrome: Settings > Privacy and Security > Cookies and other site data > See all cookies and site data

Mozilla Firefox: Options > Privacy & Security > Cookies and Site Data > Manage Data

Safari (macOS/iOS): Preferences > Privacy > Manage Website Data / Cookies and website data

Microsoft Edge: Settings > Cookies and site permissions > Manage and delete cookies and site data

Cookie Consent Banner and Preference Centre: When you first visit Novelnaija, you’ll encounter a cookie consent banner allowing you to:

Accept all cookies – Consent to all cookie categories
Reject non-essential cookies – Block analytics and advertising cookies
Customise cookie preferences – Select specific cookie categories
Learn more – Access detailed information about each cookie type
Withdraw or change consent – Modify preferences at any time

Browser Privacy Features:

Incognito/Private browsing mode (automatically deletes cookies when closed)
“Do Not Track” (DNT) settings (limited support)
Cookie blocking or third-party cookie restrictions
Privacy-focused browser extensions

Important Considerations:

Disabling strictly necessary cookies will significantly limit Website functionality
Blocking analytics cookies prevents us from improving user experience
Some features may not work properly without functional cookies
You may need to adjust preferences on each device and browser you use

7.5 Do Not Track (DNT) Signals

Some browsers offer “Do Not Track” (DNT) settings that send a signal requesting websites not to track you. However:

There is currently no universal industry standard for how websites should respond to DNT signals
Different browsers and websites interpret DNT differently
Our Website does not currently respond to DNT browser signals

You can still control tracking through:

Our cookie consent banner and preference centre
Browser cookie settings and privacy features
Third-party opt-out tools (e.g., Google Analytics Opt-out Add-on)

8. Google Analytics

We use Google Analytics, a comprehensive web analytics service provided by Google LLC (“Google”), to analyse Website traffic, understand user behaviour, measure content performance, and improve our editorial strategy.

8.1 Data Collected by Google Analytics

Google Analytics collects and processes extensive information about your website usage, including:

Interaction Data:

Pages viewed, content read, and time spent on each page
Navigation paths and user journeys through the website
Scroll depth and content engagement metrics
Internal search queries and search behaviour
Click patterns on links and interactive elements
Bounce rate (visitors who leave after viewing one page)

Technical Data:

Browser type, version, and configuration
Operating system and platform
Device type, model, and screen resolution
JavaScript support and plugin information

Traffic Source Data:

Referring websites and traffic sources (search engines, social media, direct visits)
Search engine keywords (limited due to privacy measures)
Campaign tracking parameters (UTM codes)
Social media referrals and shares

Demographic and Interest Data (anonymised):

Approximate age range (if available and anonymised)
Gender (if available and anonymised)
Interests and affinities (based on browsing patterns)
Geographic location (country, region, city based on IP)

8.2 IP Anonymisation (Privacy Enhancement)

We have enabled IP anonymisation (anonymizeIP feature) in Google Analytics to protect your privacy:

Your full IP address is truncated and anonymised before being processed or stored
The last octet (final segment) of your IP address is removed, making personal identification impossible
For example: 192.168.1.100 becomes 192.168.1.0
This ensures data processing complies with GDPR requirements for anonymisation
Your identity cannot be determined from the anonymised IP address

8.3 Google Analytics Cookies

Google Analytics uses the following cookies on our Website:

Primary Cookies:

_ga – Distinguishes unique visitors and users (expires after 2 years from last activity)
_gid – Distinguishes unique visitors for 24-hour period (expires after 24 hours)
_gat or gat_gtag[property-id] – Throttles request rate to prevent server overload (expires after 1 minute)

Additional Cookies (if enabled):

gac[property-id] – Campaign information from Google Ads (expires after 90 days)
AMP_TOKEN – For AMP (Accelerated Mobile Pages) client ID retrieval (expires after 30 seconds to 1 year)

8.4 Data Retention Period

Google Analytics data collected from our Website is:

Automatically deleted after 26 months from the date of collection
This retention period balances our need for historical analysis with privacy protection
After 26 months, user-level and event-level data is permanently deleted

8.5 Data Sharing with Google

Important Privacy Protection:

We have disabled data sharing with Google for advertising purposes
Your Analytics data is used exclusively for our internal Website improvement and editorial purposes
We do not enable Google Signals (which links Analytics data to Google accounts)
We do not share data with other Google products or services beyond Analytics
Your data is not used to build advertising profiles or target ads

8.6 Opting Out of Google Analytics

You can opt-out of Google Analytics tracking through multiple methods:

Our Cookie Consent Banner:

Reject or disable analytics cookies when prompted
Change preferences at any time through our cookie settings

Google Analytics Opt-out Browser Add-on:

Download and install: https://tools.google.com/dlpage/gaoptout
Available for major desktop browsers (Chrome, Firefox, Safari, Edge, Opera)
Prevents Google Analytics JavaScript from sharing information with Google

Browser Privacy Features:

Use Incognito/Private browsing mode
Enable browser tracking protection features
Block third-party cookies in browser settings
Use privacy-focused browsers (Brave, DuckDuckGo)

Browser Extensions and Ad Blockers:

Install privacy extensions (Privacy Badger, uBlock Origin, Ghostery)
These typically block Google Analytics by default

8.7 Google’s Privacy Policy and Terms

For detailed information about Google’s data practices and your rights:

Google Privacy Policy: https://policies.google.com/privacy
Google Analytics Terms of Service: https://marketingplatform.google.com/about/analytics/terms/
How Google Uses Data: https://policies.google.com/technologies/partner-sites

9. Other Google Services

We may integrate additional Google services on our Website to enhance functionality, performance, and user experience:

9.1 Google Fonts

Purpose: To enhance typography, improve readability, and provide consistent visual presentation across devices

Data Collection: Google may collect your IP address when loading fonts from their Content Delivery Network (CDN)

Implementation Options:

Fonts loaded from Google’s CDN (fonts.googleapis.com)
Fonts may be hosted locally on our servers to enhance privacy

Privacy Policy: https://policies.google.com/privacy

9.2 Google AdSense (if applicable)

Purpose: To display contextual advertisements and generate revenue to support our content creation

Data Collection:

Cookies track your browsing activity across websites
Used to serve personalised advertisements based on your interests
Collects device information, browsing history, and interaction data

Your Control:

Opt-out of personalised advertising: https://www.google.com/settings/ads
Visit Google Ad Settings to manage preferences
Use browser privacy features to block advertising cookies

Privacy Policies:

Google AdSense Privacy: https://policies.google.com/technologies/ads
Google Privacy Policy: https://policies.google.com/privacy

9.3 Google reCAPTCHA (if applicable)

Purpose: To protect forms from spam, automated abuse, and bot submissions

Data Collection:

Hardware and software information (browser, plugins, screen resolution)
IP address and network information
Mouse movements, touch gestures, and interaction patterns
Cookies for fraud detection and risk analysis

Implementation:

We use reCAPTCHA v3 (invisible) where possible for minimal user disruption
Falls back to v2 (checkbox) for higher-risk situations

Subject To:

Google Privacy Policy: https://policies.google.com/privacy
Google reCAPTCHA Terms: https://policies.google.com/terms

9.4 YouTube Embedded Videos (if applicable)

Purpose: To embed biographical videos, documentaries, interviews, or related multimedia content

Data Collection:

YouTube may set cookies when you view embedded videos
Collects viewing data, watch history, and engagement metrics
May track your activity across YouTube and other websites

Privacy-Enhanced Implementation:

We use YouTube’s privacy-enhanced mode (youtube-nocookie.com domain) when embedding videos
Cookies are only set when you play the video, not when the page loads
This reduces tracking compared to standard YouTube embeds

Privacy Policy: https://policies.google.com/privacy

Your Control:

Avoid clicking “play” on embedded videos if you don’t want YouTube cookies
Use browser privacy features to block YouTube cookies
Manage your YouTube privacy settings: https://www.youtube.com/account_privacy

9.5 Google Search Console

Purpose: For internal Website monitoring, search performance analysis, and SEO improvement (not user-facing)

Data: Does not directly collect visitor data; used for aggregate search analytics

10. Third-Party Services and Integrations

Our Website may use additional third-party services, plugins, and integrations to enhance functionality and user experience:

10.1 Email Marketing and Newsletter Services (if applicable)

Examples: Mailchimp, ConvertKit, SendGrid, Sendinblue

Purpose:

Newsletter delivery and subscriber management
Email campaign distribution
Subscriber segmentation and analytics

Data Shared:

Email address
Name or preferred name
Subscription date and preferences
Email open rates and click-through data

Your Control:

Unsubscribe links in every email
Manage subscription preferences
Request complete data deletion

Privacy Policies: Each service has its own privacy policy, which we encourage you to review

10.2 Comment Management and Spam Protection

Examples: Akismet (Automattic), Disqus, CommentLuv

Akismet (if used):

Purpose: Automatic spam detection and filtering for comments
Data Processed: Comment content, email address, IP address, browser user agent, referring URL
Privacy Policy: https://automattic.com/privacy/

Disqus (if used):

Purpose: Enhanced commenting system with social login and moderation features
Data Collected: Extensive tracking of user activity and comments across Disqus-powered websites
Privacy Policy: https://help.disqus.com/en/articles/1717103-disqus-privacy-policy

10.3 Content Delivery Networks (CDN)

Examples: Cloudflare, Amazon CloudFront, StackPath

Purpose:

Fast, reliable content delivery from geographically distributed servers
DDoS (Distributed Denial of Service) attack protection
Performance optimisation and load balancing
Security features (firewall, bot protection)

Data Collected:

IP address and geographic location
Browser and device information
Request data and access logs
Security-related information

Cloudflare (if used):

Privacy Policy: https://www.cloudflare.com/privacypolicy/
Cloudflare may set cookies for security and performance

10.4 Social Media Integration

Social Sharing Buttons:

May allow social networks to track your visit even without clicking
We use privacy-respecting social sharing solutions where possible
Alternative: Use browser extensions to block social media trackers

Social Media Embeds:

Twitter/X, Facebook, Instagram posts may be embedded
These embeds load scripts that can track your activity
Social platforms’ privacy policies apply

Your Control:

Avoid interacting with social embeds if concerned about tracking
Use browser privacy features or extensions to block social trackers
Review and adjust privacy settings on each social media platform

10.5 Hosting and Infrastructure Providers

Purpose: To host our Website, store data, and provide technical infrastructure

Typical Providers: Web hosting companies, cloud infrastructure providers (AWS, Google Cloud, DigitalOcean, etc.)

Data Processed:

Website files, databases, and backups
Server logs and access records
Email communications

Security: Hosting providers implement security measures including encryption, firewalls, and access controls

10.6 Security and Performance Monitoring

Examples: Wordfence, Sucuri, Jetpack

Purpose:

Real-time security monitoring
Malware scanning and removal
Firewall and intrusion detection
Performance optimisation

Data Collected: IP addresses, access logs, security events

Each third-party service operates under its own privacy policy and terms of service. We carefully vet all third-party partners for security and privacy standards, but we encourage you to review their privacy practices independently.

11. Data Sharing and Disclosure

We respect your privacy and do not sell, rent, trade, or otherwise monetise your personal information to third parties for their marketing purposes.

11.1 Service Providers and Data Processors

We share personal data with trusted third-party service providers who assist us in operating our Website and providing services to you:

Categories of Service Providers:

Web Hosting Providers: Store Website files, databases, and backups
Email Services: Deliver communications, newsletters, and transactional emails
Analytics Providers: Process usage data for insights (e.g., Google Analytics)
Security Services: Protect against threats, spam, and malicious activity
CDN Providers: Deliver content quickly and reliably
Payment Processors: Handle financial transactions (if applicable)
Customer Support Tools: Manage enquiries and support tickets

Contractual Obligations: These service providers are contractually obligated to:

Process data only for specified, limited purposes on our behalf
Implement appropriate technical and organisational security measures
Comply with applicable data protection laws (GDPR, NDPR, POPIA)
Not use your data for their own independent purposes
Maintain confidentiality and data security
Return or delete data upon termination of services

11.2 Legal Requirements and Law Enforcement

We may disclose your personal data if required or permitted by law:

Circumstances for Disclosure:

Legal Compliance: To comply with applicable laws, regulations, legal processes, or governmental requests
Court Orders: In response to valid court orders, subpoenas, warrants, or legal proceedings
Government Requests: To respond to lawful requests from public authorities, including national security or law enforcement
Rights Protection: To enforce our terms of service, policies, or user agreements
Safety and Security: To protect our rights, property, safety, or that of our users, employees, or the public
Fraud Prevention: To detect, prevent, investigate, or address fraud, security issues, or technical problems
Legal Claims: To establish, exercise, or defend legal claims and rights

Principles Governing Disclosure:

We will only disclose the minimum necessary information
We will verify the legitimacy of legal requests
We will notify affected users when legally permitted
We will challenge overbroad or improper requests where appropriate

11.3 Business Transfers and Corporate Transactions

In the event of significant business changes:

Circumstances:

Merger with or acquisition by another company
Sale of all or substantially all of our assets
Bankruptcy, liquidation, or similar proceedings
Corporate reorganisation or restructuring

Your Rights:

Your personal data may be transferred to the acquiring entity as part of business assets
The acquiring entity will be bound by this Privacy Policy (or provide equivalent protection)
We will notify you via email and/or prominent Website notice before your data is transferred
You will be informed if the privacy policy changes materially
You may exercise your data rights (including deletion) before the transfer

11.4 Aggregated and Anonymised Data

We may freely share aggregated, anonymised, or statistical data that cannot reasonably identify you personally:

Examples:

Overall Website traffic statistics and trends
Aggregate demographic information (e.g., “60% of visitors are from Nigeria”)
Popular content categories and reading patterns
General user behaviour trends
Industry benchmark reports and analysis

Important: This anonymised data does not constitute personal data under GDPR, NDPR, or POPIA because it cannot identify individuals.

11.5 With Your Consent

We may share your personal data with third parties when you have provided explicit, informed consent for specific purposes beyond those outlined in this policy.

12. International Data Transfers

Your personal data may be transferred to, stored in, and processed in countries outside Nigeria and South Africa, including jurisdictions with different data protection standards:

12.1 Countries and Regions

Typical Transfer Destinations:

European Union/European Economic Area (EEA) – For Google services and European hosting providers (GDPR-compliant)
United States of America – For various service providers, cloud infrastructure, and technology platforms
Other Jurisdictions – Where our service providers, partners, or technical infrastructure operate

12.2 Safeguards for International Transfers

When transferring personal data internationally, we ensure appropriate safeguards are in place to protect your data:

GDPR-Compliant Mechanisms:

Standard Contractual Clauses (SCCs): EU Commission-approved contract terms ensuring GDPR-level protection regardless of destination country
Adequacy Decisions: Transfers to countries deemed to provide adequate data protection by the EU Commission (e.g., UK, Switzerland, Japan)
Binding Corporate Rules (BCRs): For transfers within multinational organisations with approved internal data protection policies
Specific Derogations: Where necessary for contract performance or your explicit consent

Additional Protections:

Due diligence assessments of data importers
Supplementary measures beyond SCCs where necessary (encryption, pseudonymisation)
Regular review of transfer mechanisms and destination country laws
Contractual obligations requiring equivalent protection

12.3 Your Rights Regarding International Transfers

You have the right to:

Request detailed information about international transfers of your specific data
Obtain copies of safeguard documentation (SCCs, BCRs)
Object to transfers that don’t have adequate protections
Request that your data be stored only in specific jurisdictions (where feasible)

13. Data Security

We implement comprehensive, multi-layered technical and organisational security measures to protect your personal data from unauthorised access, loss, misuse, alteration, or destruction:

13.1 Technical Security Measures

Encryption:

SSL/TLS Encryption: All data transmitted between your browser and our servers is encrypted using industry-standard SSL/TLS protocols (HTTPS)
Database Encryption: Sensitive data stored in databases is encrypted at rest
Backup Encryption: All backups are encrypted to prevent unauthorised access

Infrastructure Security:

Secure Hosting: Enterprise-grade servers with robust physical and network security
Firewall Protection: Network-level and application-level firewalls block unauthorised access attempts
DDoS Protection: Measures to prevent and mitigate Distributed Denial of Service attacks
Intrusion Detection Systems (IDS): Automated monitoring systems alert us to suspicious activity, anomalies, or potential breaches
Malware and Virus Scanning: Regular automated scanning and removal of malicious code
Security Patching: Timely installation of WordPress, plugin, and theme security updates and patches

Access Controls:

Authentication: Strong password requirements and multi-factor authentication (MFA) for administrative access
Authorisation: Role-based access controls (RBAC) limiting data access on a need-to-know basis
Least Privilege Principle: Users and systems granted minimum necessary permissions
Access Logging: Comprehensive logs of who accessed what data and when

Data Protection:

Secure Backup Systems: Regular encrypted backups stored in secure, geographically separate locations
Data Minimisation: Collection limited to only what’s necessary for stated purposes
Pseudonymisation: Where appropriate, personal identifiers replaced with pseudonyms
Automatic Logout: Sessions expire after periods of inactivity

13.2 Organisational Security Measures

Policies and Procedures:

Data Protection Policy: Comprehensive internal policies governing data handling
Security Policies: Clear protocols for security incidents, access, and data management
Incident Response Plan: Documented procedures for detecting, reporting, investigating, and responding to data breaches
Business Continuity Plan: Procedures to maintain operations during disruptions

Personnel:

Staff Training: Regular data protection and security awareness training for all personnel
Confidentiality Agreements: All staff, contractors, and partners sign confidentiality and non-disclosure agreements
Background Checks: Appropriate vetting of personnel with access to personal data
Clear Responsibilities: Designated roles for data protection oversight and security management

Vendor Management:

Due Diligence: Security and privacy assessments of all third-party service providers
Contractual Requirements: Data processing agreements requiring adequate security measures
Regular Reviews: Periodic evaluation of vendor security practices and compliance
Limited Access: Third-party access restricted to only what’s necessary for services

Monitoring and Auditing:

Security Monitoring: Continuous monitoring of systems, networks, and activities
Regular Audits: Periodic internal and external security audits and assessments
Penetration Testing: Simulated attacks to identify and address vulnerabilities
Compliance Reviews: Regular evaluation of adherence to data protection laws and policies

13.3 Security Limitations and Your Responsibility

Inherent Limitations: Despite our comprehensive security measures, we must acknowledge:

No method of internet transmission is 100% secure and impervious to attack
No data storage or security system is completely invulnerable to all threats
Sophisticated attackers with sufficient resources may overcome security measures
New vulnerabilities and attack methods are constantly emerging

We Cannot Guarantee:

Absolute security against all conceivable threats
Prevention of all unauthorised access or data breaches
Immediate detection of all security incidents

We Commit To:

Implementing and maintaining industry-standard (and where feasible, above-standard) security measures
Continuously monitoring, reviewing, and updating security practices
Responding promptly and appropriately to identified security incidents
Notifying affected parties of significant breaches as required by law

Your Responsibility: To help protect your own data:

Use strong, unique passwords
Keep your devices and software updated
Be cautious of phishing attempts and suspicious emails
Don’t share your credentials with others
Use secure internet connections (avoid public Wi-Fi for sensitive activities)
Log out after using shared or public devices

13.4 Data Breach Notification

Our Legal Obligations: In the event of a personal data breach that poses a risk to your rights and freedoms:

Notification to Authorities (GDPR Article 33, NDPR, POPIA):

We will notify relevant supervisory authorities (NDPC in Nigeria, Information Regulator in South Africa, EU data protection authorities) within 72 hours of becoming aware of the breach
Notification will include nature of breach, categories and approximate number affected, likely consequences, and measures taken/proposed

Notification to Affected Individuals (GDPR Article 34, NDPR, POPIA):

We will inform affected individuals without undue delay if the breach is likely to result in a high risk to their rights and freedoms
Notification will be in clear, plain language explaining the breach, its likely consequences, and steps you can take to protect yourself
Communication will include our contact details and remedial measures

Transparency:

We maintain internal breach notification procedures
We document all breaches for regulatory compliance
We will be transparent about breaches whilst balancing legal, security, and privacy considerations

14. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements.

14.1 Specific Retention Periods by Data Type

Website Comments:

Retention: Retained indefinitely to maintain comment threads, preserve discussion continuity, and enable effective moderation
Deletion: Deleted upon your explicit request via email to info@novelnaija.com.ng
Rationale: Comments contribute to ongoing discussions and community engagement

Contact Form Submissions and Email Correspondence:

Retention: Retained for up to 3 years from date of submission or until the matter is resolved and correspondence concludes
Early Deletion: Deleted earlier if no longer needed for the original purpose
Rationale: Allows us to reference previous communications and provide continuity in support

Newsletter Subscriptions:

Retention: Retained for the duration of your active subscription
Post-Unsubscribe: Automatically and permanently deleted within 30 days of unsubscription
Exception: Minimal data (email address) may be retained on a suppression list to honour unsubscribe requests and prevent re-subscription

Analytics Data (Google Analytics):

Retention: Automatically deleted after 26 months from date of collection
Configuration: Set in Google Analytics account settings
Rationale: Balances long-term trend analysis with privacy protection

WordPress Access Logs and Technical Data:

Retention: Retained for 90 days for security monitoring, troubleshooting, and abuse prevention
Purpose: Detect security incidents, diagnose technical issues, identify malicious activity
Deletion: Automatically purged after 90 days

Cookie Data:

Duration: Varies by cookie type and purpose (detailed in Section 7.3)
Range: From session-only (deleted when browser closes) to 2 years (e.g., Google Analytics _ga cookie)
Control: You can delete cookies manually at any time through browser settings

Biography Suggestions and User Submissions:

Retention: Retained for 2 years or until acted upon (published or declined)
Purpose: Allows us to track suggestions, follow up, and credit contributors
Deletion: Deleted earlier if you request removal

Legal, Compliance, and Financial Records:

Retention: Retained as required by applicable laws (typically 6-7 years for financial/tax records)
Jurisdictions: Nigerian, South African, and EU legal requirements
Purpose: Tax compliance, audit requirements, legal defence

Marketing Preferences and Consent Records:

Retention: Retained for 3 years after last interaction or consent withdrawal
Purpose: Demonstrate compliance with consent requirements, honour opt-outs
Rationale: Regulatory requirement to prove consent was obtained

14.2 Criteria for Determining Retention Periods

We determine appropriate retention periods based on:

Purpose: How long data is needed for the original collection purpose
Legal Requirements: Statutory retention obligations under Nigerian, South African, and EU laws
Legitimate Interests: Business needs, security, and fraud prevention
Your Requests: Specific deletion requests or consent withdrawal
Best Practices: Industry standards and data minimisation principles

14.3 Deletion After Retention Period

Once the retention period expires, we securely delete or permanently anonymise your personal data, unless:

Legal obligations require longer retention (e.g., tax records, legal holds)
Ongoing legal proceedings or disputes necessitate preservation
You have specifically requested longer retention
Legitimate overriding interests exist (rare and carefully evaluated)

Secure Deletion Methods:

Permanent deletion from active databases
Removal from backup systems (within next backup cycle)
Overwriting or destruction of physical media
Anonymisation making re-identification impossible

15. Your Rights Under GDPR, NDPR, and POPIA

You have comprehensive and enforceable rights regarding your personal data under applicable data protection laws:

15.1 Right to Be Informed

You have the right to clear, transparent information about:

What personal data we collect
How and why we use your data
Who we share data with
How long we retain data
Your rights and how to exercise them

This entire Privacy Policy fulfils this right.

15.2 Right to Access (GDPR Article 15, NDPR Section 8, POPIA Section 23)

You have the right to:

Confirm whether we process your personal data
Obtain a copy of your personal data we hold
Receive information about how and why we process your data
Learn about data recipients and retention periods
Understand your other rights

How to Exercise: Email info@novelnaija.com.ng requesting a copy of your personal data. We may request proof of identity to verify your request and prevent unauthorised disclosure.

15.3 Right to Rectification (GDPR Article 16, NDPR Section 9, POPIA Section 24)

You have the right to:

Request correction of inaccurate or incomplete personal data
Supplement incomplete data with additional accurate information
Update outdated information

How to Exercise: Contact us with the incorrect information and the correct version. We will update our records promptly upon verification.

15.4 Right to Erasure / “Right to be Forgotten” (GDPR Article 17, NDPR Section 10, POPIA)

You have the right to request deletion of your personal data when:

Data is no longer necessary for the purposes for which it was collected
You withdraw consent and there’s no other legal basis for processing
You object to processing and there are no overriding legitimate grounds
Data has been unlawfully processed or used without proper legal basis
Legal obligations require deletion (e.g., child data collected unlawfully)
Data was collected in relation to information society services offered to children

Exceptions (We May Refuse Erasure If Retention Is Necessary For):

Compliance with legal obligations
Establishment, exercise, or defence of legal claims
Exercising freedom of expression and information
Archiving purposes in the public interest, scientific research, or historical research (with appropriate safeguards)

How to Exercise: Contact us specifying what data you want deleted and the reason for your request.

15.5 Right to Restriction of Processing (GDPR Article 18, NDPR, POPIA Section 25)

You have the right to request limitation of how we process your data when:

You contest the accuracy of data (restriction during verification period)
Processing is unlawful, but you prefer restriction over deletion
We no longer need the data, but you need it for legal claims
You’ve objected to processing (restriction pending verification of our legitimate grounds)

Effect of Restriction:

Data is stored but not actively processed (except with your consent or for legal claims)
We will inform you before lifting restriction

How to Exercise: Contact us explaining why you want processing restricted.

15.6 Right to Data Portability (GDPR Article 20)

You have the right to:

Receive your personal data in a structured, commonly used, machine-readable format (e.g., CSV, JSON)
Transmit your data directly to another controller where technically feasible
Move, copy, or transfer data easily from one IT environment to another

Applies Only When:

Processing is based on consent or contract (not legitimate interests or legal obligations)
Processing is carried out by automated means

Does Not Apply To:

Data processed based solely on legitimate interests
Manual or paper-based processing

How to Exercise: Request your data in portable format via email. Specify the format if you have preferences.

15.7 Right to Object (GDPR Article 21, NDPR, POPIA Section 11)

You have the right to object to processing based on:

Legitimate Interests (Article 21(1)):

You can object to processing based on our legitimate interests or public interest
We must demonstrate compelling legitimate grounds that override your interests, or processing is necessary for legal claims
Otherwise, we must stop processing

Direct Marketing (Article 21(2-3)):

You have an absolute right to object to processing for direct marketing purposes at any time
We must stop all marketing processing upon objection, with no exceptions
This includes profiling related to direct marketing

Scientific/Historical Research or Statistics (Article 21(6)):

You can object unless processing is necessary for a public interest task

How to Exercise:

Use unsubscribe links in marketing emails
Adjust preferences in your account settings (if applicable)
Contact us to object to any processing

15.8 Rights Related to Automated Decision-Making and Profiling (GDPR Article 22)

You have the right not to be subject to decisions based solely on automated processing (including profiling) that produce legal effects or similarly significantly affect you.

Our Practice:

We do not currently engage in automated decision-making or profiling that produces legal or similarly significant effects
Analytics and content recommendations do not constitute profiling under Article 22

If We Ever Implement Automated Decision-Making:

We will provide clear notice and information
You will have the right to obtain human intervention
You can express your point of view and contest decisions
We will implement suitable safeguards

15.9 Right to Withdraw Consent (GDPR Article 7(3), NDPR, POPIA)

Where processing is based on your consent:

You have the right to withdraw consent at any time
Withdrawal is as easy as giving consent
Withdrawal does not affect the lawfulness of processing before withdrawal
We will clearly explain the consequences of withdrawal

How to Withdraw:

Click unsubscribe in marketing emails
Adjust cookie preferences in our cookie banner
Contact us directly via email

15.10 Right to Lodge a Complaint with Supervisory Authorities (GDPR Article 77, NDPR, POPIA)

You have the right to file a complaint with data protection supervisory authorities if you believe we’ve violated your privacy rights:

Nigeria:

Authority: Nigeria Data Protection Commission (NDPC)
Website: https://ndpc.gov.ng/
Email: info@ndpc.gov.ng
Address: NDPC Secretariat, Abuja, Nigeria

South Africa:

Authority: Information Regulator South Africa
Website: https://www.justice.gov.za/inforeg/
Email: inforeg@justice.gov.za
Complaint Form: Available on website

European Union (for EU residents):

Contact your national data protection authority
Directory: https://edpb.europa.eu/about-edpb/board/members_en

Our Preference: We encourage you to contact us first so we can address your concerns directly. However, you always have the right to lodge a complaint with authorities.

15.11 How to Exercise Your Rights

Contact Us: Email: info@novelnaija.com.ng
Subject Line: Data Privacy Request – [Specify Right]

Include in Your Request:

Your full name and contact information
Specific right(s) you wish to exercise (access, rectification, erasure, etc.)
Details to help us locate your data (email address, username, dates)
Any relevant context or supporting information
Proof of identity (to prevent unauthorised requests)

Identity Verification: To protect your privacy and security:

We may request government-issued ID or other proof of identity
We verify identity before fulfilling requests involving sensitive personal data
This prevents unauthorised access and protects you from identity theft

Our Response Time:

We will acknowledge your request within 3 business days
We will provide a substantive response within 30 days (1 month) from receiving your request
For complex or numerous requests, we may extend by an additional 60 days (2 months)
We will inform you of any extension and the reasons within the initial 30-day period

Free of Charge:

Exercising your rights is completely free and without charge
We may charge a reasonable fee only for:
- Manifestly unfounded or excessive requests
- Repetitive requests for copies (second and subsequent copies)
If we charge a fee, we will explain why and inform you before proceeding

Right to Appeal: If you’re dissatisfied with our response:

Contact us to discuss your concerns
Lodge a complaint with the relevant supervisory authority
Seek legal advice or remedies under applicable law

16. Children’s Privacy

16.1 Age Restrictions and Minimum Age

Our Website is not directed at, marketed to, or intended for use by children or minors under the age of 16 years (or the applicable age of digital consent in your jurisdiction, which may be 13-16 depending on local laws).

Jurisdictional Age of Digital Consent:

European Union: 13-16 (varies by member state)
Nigeria: 18 (age of majority), but 16 is reasonable for digital consent
South Africa: 18 (age of majority)

Our Position: We use 16 as the minimum age threshold to align with GDPR and provide strong protection for minors.

16.2 No Knowing Collection from Children

We do not knowingly or intentionally:

Collect personal data from children under 16
Target content, advertising, or marketing to children
Encourage children to provide personal information
Maintain profiles or accounts for children

16.3 Parental Notice and Responsibility

If You Are a Parent or Legal Guardian: If you believe your child under 16 has provided us with personal data without your consent:

Contact us immediately at info@novelnaija.com.ng
Provide details to help us identify the child’s data (name, email, date)
We will promptly investigate and delete the child’s information

Our Commitment: Upon notification or discovery that we’ve collected data from a child under 16:

We will verify the child’s age
We will permanently delete all personal data associated with the child
We will take steps to prevent future collection
We will not require the child to provide more information as a condition of deletion

16.4 Age Verification

Current Practice:

We do not implement age verification or age-gate mechanisms
We rely on users’ honesty and truthfulness regarding their age
Our terms assume users represent they are at least 16 years old

User Representation: By using Novelnaija, you represent and warrant that:

You are at least 16 years of age
If you are under 18, you have parental/guardian consent to use our Website
You meet the age requirements for digital consent in your jurisdiction

16.5 Educational Use

Schools and Educational Institutions: If teachers or educational institutions wish to use our biographical content for educational purposes:

They should supervise minors’ use appropriately
They are responsible for obtaining necessary parental consents
They should review content for age-appropriateness
They should disable user interaction features (comments) for minors

17. External Links and Third-Party Websites

17.1 Links to Other Sites and Resources

Our Website may contain hyperlinks to external websites, resources, references, or third-party content not operated, controlled, or affiliated with Novelnaija, including:

Source Citations and References: Links to news articles, academic papers, official records, and documentation used in our research
Related Content: Additional reading materials, biographies, or historical resources
Social Media Platforms: Links to Facebook, Twitter/X, Instagram, LinkedIn, YouTube profiles
Partner Websites: Collaborating organisations or affiliated projects
Archival Resources: Internet Archive, library databases, historical repositories
Multimedia Content: Videos, podcasts, or documentaries hosted on external platforms

17.2 No Responsibility for Third-Party Practices

Important Disclaimers: We explicitly and unequivocally:

Do not control the content, privacy practices, security measures, or operations of third-party websites
Are not responsible for data collection, processing, or usage by external sites
Do not endorse the views, opinions, products, services, or accuracy of third-party content
Cannot guarantee the continued availability, functionality, or stability of external links
Are not liable for any damages, losses, or harm arising from your use of external websites
Do not monitor third-party websites for changes, updates, or compliance

Third Parties’ Independence:

External websites have their own terms of service and privacy policies
They may collect, use, and share data according to their own practices
They may use cookies and tracking technologies independently
They are solely responsible for their content, products, and services

17.3 Review External Privacy Policies

Your Responsibility: Before providing personal information to any external website:

Review their privacy policy carefully to understand their data practices
Read their terms of service to understand your rights and obligations
Understand how they collect, use, and protect your personal data
Make informed decisions about whether to interact with or provide data to them
Exercise caution with unfamiliar or suspicious websites

17.4 Link Removal Requests

Reporting Concerns: If you believe any external link is:

Inappropriate, offensive, or harmful
Broken, outdated, or non-functional
Misleading or fraudulent
Violates copyright or other rights
Contrary to our policies or values

Please contact us at info@novelnaija.com.ng with:

The specific link or page containing the link
The URL of the external website
Your concerns and reasons for removal request
Any relevant context or documentation

We will review and investigate all link removal requests and take appropriate action, which may include removing or replacing the link.

17.5 Social Media Disclaimer

Social Media Links and Embeds:

Links to social media platforms are provided for convenience and information
We do not control social media companies’ data practices
Social networks may track your visit even if you don’t click on links or embeds
Review privacy settings on each platform to control your data

Your Control:

Use browser privacy features to block social media trackers
Avoid clicking on social links if concerned about tracking
Log out of social media accounts before visiting our Website

18. Automated Decision-Making and Profiling

18.1 Current Practices

We do not currently engage in automated decision-making or profiling that produces legal effects or similarly significantly affects you, as defined under GDPR Article 22.

What We Don’t Do:

Automated credit scoring or eligibility determinations
Algorithmic decisions affecting legal rights or contractual terms
Profiling that significantly impacts opportunities, services, or treatment
Automated rejection or approval of applications or requests

18.2 Limited Automated Processing

We do use automated tools and algorithms for:

Website analytics – Understanding aggregate visitor behaviour and trends (Google Analytics)
Content recommendations – Suggesting related biographies or articles based on browsing history
Spam filtering – Protecting comments and forms from automated abuse (Akismet)
Search functionality – Displaying relevant search results based on queries
Performance optimisation – Caching and delivering content efficiently

Important Distinction: These activities do not constitute profiling or automated decision-making under GDPR Article 22 because they:

Do not produce legal effects
Do not similarly significantly affect you
Are ancillary to providing Website functionality
Can be overridden or corrected manually

18.3 Future Implementation

If We Ever Implement Automated Decision-Making: Should we introduce automated decision-making or profiling in the future:

We will provide clear, prominent notice and detailed information
We will update this Privacy Policy accordingly
We will implement appropriate safeguards and protections

Your Rights Would Include:

Right to obtain human intervention and review
Right to express your point of view
Right to contest and challenge decisions
Right to obtain an explanation of decisions
Right to opt-out or request manual decision-making

19. Changes and Updates to This Privacy Policy

19.1 Right to Modify and Update

We reserve the right to update, modify, amend, or replace this Privacy Policy at any time to reflect:

Changes in our data processing practices or Website functionality
New legal or regulatory requirements (GDPR, NDPR, POPIA updates)
Introduction of new features, services, or technologies
Feedback from users, regulators, or supervisory authorities
Industry best practices and evolving privacy standards
Corrections, clarifications, or improvements to policy language

19.2 Notification of Changes

For Material Changes (Significantly Affecting Your Rights): When we make substantial changes that materially impact your privacy rights or data practices:

Update the “Last Updated” date at the top of this policy
Provide prominent notice on our Website homepage or via banner notification
Send email notification to registered users, newsletter subscribers, or known users (where applicable)
Request renewed consent where legally required or appropriate
Provide a reasonable notice period before changes take effect (typically 30 days)

Examples of Material Changes:

Introducing new data collection practices
Changing purposes for data processing
Sharing data with new categories of third parties
Significantly expanding data retention periods
Reducing security protections

For Minor Changes (Non-Material): For minor updates that don’t significantly affect your rights:

Update the “Last Updated” date at the top of this policy
Changes take effect immediately upon posting
No separate notification required

Examples of Minor Changes:

Clarifications or corrections to existing provisions
Formatting, grammar, or typographical corrections
Updated contact information
Reorganisation for better readability
Additional examples or explanations

19.3 Continued Use Constitutes Acceptance

Your Acknowledgement: Your continued use of our Website after changes to this Privacy Policy take effect constitutes your:

Acknowledgement that you have been notified of the changes
Acceptance and agreement to the updated Privacy Policy
Consent to the revised data practices (where consent is the legal basis)

If You Disagree: If you do not agree with any changes:

You should discontinue use of our Website
You may exercise your right to erasure (deletion) of your data
You may object to processing under the new policy
You may withdraw consent where applicable

19.4 Review Periodically

Our Recommendation: We strongly encourage you to:

Review this Privacy Policy periodically (e.g., quarterly or annually)
Check the “Last Updated” date regularly for changes
Read updated versions carefully to understand your rights
Contact us with questions about changes or new practices

Accessibility:

This Privacy Policy is always accessible via footer links on every page
Archived versions may be available upon request

20. Special Provisions for Different Jurisdictions

20.1 European Union (EU) / European Economic Area (EEA) Residents

Full GDPR Compliance: For users located in the EU/EEA:

All GDPR provisions, rights, and protections in this policy apply comprehensively
You have all rights under GDPR Articles 12-23 (outlined in Section 15)
You have the right to lodge complaints with your national supervisory authority
Data transfers outside the EU/EEA are protected by appropriate safeguards (Section 12)
We comply with GDPR principles: lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality, and accountability

Lead Supervisory Authority:

For EU residents, your lead supervisory authority is typically in your country of residence
Directory: https://edpb.europa.eu/about-edpb/board/members_en

20.2 Nigeria

NDPR Compliance: For users located in Nigeria:

We comply fully with the Nigeria Data Protection Regulation (NDPR) 2019
You have rights under NDPR Sections 7-14, including access, rectification, erasure, restriction, portability, and objection
You can file complaints with the Nigeria Data Protection Commission (NDPC)
NDPC Contact: https://ndpc.gov.ng/ | info@ndpc.gov.ng
We adhere to NDPR principles of consent, lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality
Cross-border data transfers comply with NDPR Section 2.9 requirements

NDPR-Specific Provisions:

We conduct data protection impact assessments for high-risk processing
We maintain records of processing activities
We appoint a Data Protection Officer if legally required
We report data breaches to NDPC within 72 hours

20.3 South Africa

POPIA Compliance: For users located in South Africa:

We comply fully with the Protection of Personal Information Act (POPIA)
You have rights under POPIA Sections 23-25, including access, correction, deletion, and objection
You can lodge complaints with the Information Regulator South Africa
Information Regulator Contact: https://www.justice.gov.za/inforeg/ | inforeg@justice.gov.za
We process data lawfully, reasonably, and in a manner that doesn’t infringe your privacy
We comply with POPIA’s eight conditions: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, and data subject participation

POPIA-Specific Provisions:

We ensure responsible parties (data controllers/processors) comply with POPIA
We implement reasonable security measures to protect personal information
We maintain documentation demonstrating POPIA compliance

20.4 Other Jurisdictions

General Approach: For users in other countries:

We apply the strictest applicable data protection standards regardless of location
We respect local privacy laws and regulations to the extent they apply
We implement GDPR-level protections as a baseline globally
Contact us for jurisdiction-specific information or requirements

Country-Specific Laws: If you are subject to specific data protection laws in your jurisdiction (e.g., California Consumer Privacy Act in the USA), please contact us to understand how we comply with those requirements.

21. California Privacy Rights (CCPA/CPRA) – If Applicable

Note: Whilst our primary audience is in Africa (Nigeria, South Africa), we respect California residents’ rights under CCPA/CPRA.

Your Rights Under CCPA/CPRA:

Right to Know: What personal information is collected, sources, purposes, and categories shared
Right to Delete: Request deletion of your personal information
Right to Opt-Out of Sale: We do not sell personal information, so this doesn’t apply
Right to Opt-Out of Sharing: Opt-out of sharing for cross-context behavioural advertising
Right to Correct: Request correction of inaccurate personal information
Right to Limit Use of Sensitive Personal Information: We don’t collect or use sensitive data for purposes requiring opt-out
Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

Our CCPA Compliance:

We do not sell personal information to third parties for monetary or other valuable consideration
We do not share personal information for cross-context behavioural advertising
We provide mechanisms to exercise your rights via email (info@novelnaija.com.ng)

Authorised Agents: California residents may designate an authorised agent to make requests on their behalf. We will require proof of authorisation.

22. Transparency and Accountability

22.1 Our Commitment to Transparency

We are committed to operating with complete transparency regarding our data practices:

Clear Communication: Using plain language, avoiding legalese, and providing concrete examples
Honest Disclosure: Fully disclosing what data we collect, how we use it, and who we share it with
Accessible Information: Making privacy information easily accessible and understandable
Proactive Updates: Notifying you of changes and new practices
Responsive Communication: Answering your questions and addressing concerns promptly

22.2 Accountability Measures

We demonstrate accountability through:

Data Protection Impact Assessments (DPIAs):

Conducting DPIAs for new data processing activities, especially high-risk processing
Evaluating necessity, proportionality, and safeguards
Documenting and addressing identified risks
Reviewing and updating assessments regularly

Records of Processing Activities (GDPR Article 30): We maintain comprehensive records including:

Purposes of processing and legal bases
Categories of data subjects and personal data
Categories of recipients (third parties, processors)
International transfers and safeguards implemented
Data retention periods and deletion procedures
Technical and organisational security measures

Data Protection by Design and Default (GDPR Article 25): We implement data protection principles throughout our systems and practices:

Data Minimisation: Collecting only what’s necessary for stated purposes
Purpose Limitation: Using data only for specified, explicit purposes
Storage Limitation: Retaining data no longer than necessary
Pseudonymisation and Encryption: Where appropriate and feasible
Privacy Settings: Default settings that maximise privacy protection
Regular Reviews: Evaluating and improving practices continually

Data Protection Officer (DPO): If legally required, we will appoint a Data Protection Officer responsible for:

Monitoring compliance with data protection laws
Providing advice on data protection impact assessments
Cooperating with supervisory authorities
Acting as contact point for data subjects and authorities

Training and Awareness:

Regular data protection training for all personnel
Clear policies and procedures accessible to staff
Culture of privacy awareness and responsibility

Audit and Compliance:

Internal audits of data protection practices
External assessments where appropriate
Continuous monitoring and improvement
Documentation of compliance efforts

22.3 Continuous Improvement

We are committed to:

Regularly reviewing and updating our privacy practices
Incorporating feedback from users, regulators, and experts
Adopting emerging best practices and technologies
Responding to evolving threats and regulatory requirements
Investing in privacy-enhancing technologies and training

23. Contact Us and Data Protection Enquiries

For any questions, concerns, requests, complaints, or enquiries regarding this Privacy Policy, our data protection practices, or your personal data rights:

23.1 Contact Information

Email: info@novelnaija.com.ng
Website: https://novelnaija.com.ng/
Subject Line (Recommended): Privacy Enquiry / Data Protection Request / [Specific Right]

23.2 What to Include in Your Message

To help us respond efficiently and effectively:

Your Full Name and Contact Information (email, phone if urgent)
Nature of Your Enquiry or Request (access, deletion, correction, complaint, general question)
Specific Details (dates, emails, pages, transactions, data in question)
Proof of Identity (for requests involving personal data access or modification)
Any Supporting Documentation (screenshots, correspondence, relevant context)
Preferred Method of Response (email, phone)

23.3 Our Response Commitment

Acknowledgement:

We will acknowledge receipt of your enquiry within 2 business days
Acknowledgement confirms we received your message and are reviewing it

Substantive Response:

We will provide a complete, substantive response within 30 days (1 month)
For data subject rights requests, we comply with legal timeframes (30 days under GDPR, 1 month under NDPR/POPIA)
For complex or numerous requests, we may extend by up to 60 days (2 months) with explanation

Ongoing Communication:

We will keep you informed of progress on complex matters
We will request clarification if needed to address your request
We will explain our decisions and reasoning clearly

Confidentiality:

We treat all enquiries, requests, and complaints confidentially
We implement security measures to protect your information
We only share information as necessary to address your request

23.4 Complaints and Dispute Resolution

Our Preference: We encourage you to contact us first if you have concerns about our privacy practices. We are committed to resolving issues fairly, promptly, and amicably.

Our Complaint Process:

Submit your complaint in writing via email
We will acknowledge and investigate thoroughly
We will respond with our findings and proposed resolution
We will implement corrective actions where appropriate
We will follow up to ensure satisfaction

External Remedies: If you are dissatisfied with our response:

Lodge a complaint with relevant supervisory authorities (Section 15.10)
Seek advice from consumer protection agencies
Consult with privacy advocates or legal professionals
Pursue legal remedies under applicable law

23.5 Data Protection Officer (If Applicable)

If we are required by law to appoint a Data Protection Officer: DPO Contact: [To be specified if appointed]

The DPO is responsible for:

Overseeing data protection strategy and compliance
Advising on data protection impact assessments
Cooperating with supervisory authorities
Serving as contact point for data subjects and authorities

24. Consent and Acknowledgement

By accessing, browsing, using, or interacting with Novelnaija, you explicitly acknowledge, understand, accept, and agree that:

✓ Full Reading and Understanding: You have read this Privacy Policy in its entirety, carefully and thoroughly, and you understand its terms, provisions, and implications

✓ Data Processing Awareness: You understand how we collect, use, store, share, protect, and manage your personal data as described in detail throughout this policy

✓ Consent to Processing: You consent to the processing of your personal data as described in this Privacy Policy, where consent is the legal basis for processing

✓ Age Representation: You represent and warrant that you are at least 16 years of age (or have obtained parental/guardian consent if under 18)

✓ Rights Awareness: You understand your comprehensive rights under GDPR, NDPR, POPIA, and other applicable data protection laws, including rights to access, rectification, erasure, restriction, portability, objection, and complaint

✓ Withdrawal Rights: You understand that you can withdraw consent or exercise your rights at any time by contacting us, and that withdrawal doesn’t affect prior lawful processing

✓ Cookies and Tracking: You understand and consent to our use of cookies and tracking technologies as described in this policy, subject to your cookie preferences

✓ Third-Party Services: You understand that third-party services (Google Analytics, hosting providers, etc.) process data according to their own privacy policies

✓ International Transfers: You understand and consent to international transfers of your data with appropriate safeguards as described in Section 12

✓ Policy Changes: You understand that this Privacy Policy may change, and you agree to review it periodically and accept updates by continuing to use our Website

✓ Contact for Questions: You understand that you can contact us at info@novelnaija.com.ng at any time with questions, concerns, or to exercise your rights

✓ Legal Agreement: You understand that this Privacy Policy forms a legal agreement between you and Novelnaija regarding the processing of your personal data

If you do not agree with any part of this Privacy Policy or do not consent to the processing described herein, you must not use or access Novelnaija and should discontinue use immediately.

Thank you for entrusting Novelnaija with your personal information. We are deeply committed to protecting your privacy, respecting your rights, maintaining the highest standards of data protection, and operating with complete transparency and accountability.

Your privacy matters to us, and we will continue to safeguard it with the utmost care, diligence, and responsibility.

For any questions, concerns, or requests, please don’t hesitate to contact us at info@novelnaija.com.ng

This Privacy Policy demonstrates our unwavering commitment to transparency, accountability, compliance with GDPR, NDPR, POPIA, and international data protection standards. It forms part of our broader commitment to E-E-A-T principles (Experience, Expertise, Authoritativeness, Trustworthiness) and responsible, ethical data governance.

Last Updated: 03 January 2026