PRIVACY POLICY

NOVABRIDGE INTERNATIONAL ALLIANCE LTD
Global Data Protection & Privacy Policy (2026 Edition)

1. Introduction & Scope
   Novabridge International Alliance Ltd (RC NO. 8742901) is committed to safeguarding the privacy and digital rights of our clients, partners, and employees. This policy governs how we collect, process, and secure personal data across our IT, Media, Renewable Energy, and Trading verticals.
   • Jurisdictional Compliance: This policy adheres to the NDPA 2023 (Nigeria), the AU Malabo Convention (Africa), and the GDPR (Global/EU).
   • Applicability: This applies to all data processed within Nigeria and during international import/export or AI-driven cross-border operations.
2. Core Data Protection Principles
   We adhere to the seven “Gaskiya” (Truth/Integrity) principles of data processing:
3. Lawfulness & Transparency: Data is processed only with a valid legal basis (Consent, Contract, or Legal Obligation).
4. Purpose Limitation: Data collected for trading logistics will not be repurposed for media marketing without fresh consent.
5. Data Minimization: We collect only the minimum necessary data (e.g., we do not ask for a client’s date of birth if only a shipping address is required).
6. Accuracy: We maintain rigorous “Data Hygiene” to ensure all records are up-to-date.
7. Storage Limitation: Data is deleted or anonymized once the business purpose (e.g., a trade transaction or a media project) is completed.
8. Integrity & Confidentiality: We employ AES-256 encryption and multi-factor authentication (MFA) to prevent unauthorized access.
9. Accountability: We document every processing activity and conduct annual audits as required by the NDPC.
10. Specialized Data Handling
    • Artificial Intelligence (AI): Our AI models are built with “Privacy by Design.” We do not use sensitive personal data for training models without explicit, high-level authorization.
    • Renewable Energy: Customer energy consumption patterns are treated as sensitive financial data and protected against third-party exploitation.
    • Mass Media: While we respect the “Journalistic Exception” for public interest, we protect the identity of sources and the privacy of non-public figures as per global ethics.
11. Cross-Border Data Transfers (Africa & Global)
    As an international alliance, we often move data across borders.
    • Intra-Africa: We prioritize data flow to countries that have ratified the Malabo Convention or have an “Adequacy Decision” from the NDPC.
    • International: Transfers to the EU or Americas are protected by Standard Contractual Clauses (SCCs) to ensure Nigerian data enjoys the same protection abroad as it does at home.
12. Data Subject Rights
    Every individual has the following rights under our “Novabridge Alliance”:
    • Right to Access: You can request a copy of the data we hold on you.
    • Right to Rectification: You can correct inaccurate trade or contact details.
    • Right to Erasure: The “Right to be Forgotten” once a contract is closed.
    • Right to Object: The right to opt-out of automated AI decision-making.
13. Breach Response Protocol
    In the event of a data breach, our Cybersecurity Team (led by our internal experts) will:
14. Contain & Assess: Within the first hour of discovery.
15. Notify NDPC: Within 72 hours of becoming aware of a high-risk breach.
16. Notify Subjects: Inform affected individuals immediately if their rights or financial security are at risk.
17. Governance
    The Data Protection Officer (DPO) of Novabridge is responsible for the oversight of this policy. This policy is reviewed annually to adapt to evolving AI policies and cybersecurity threats in Africa.