Privacy Policy

IRISE ICT is the technology brand of IRISE GLOBAL TECH NETWORK. References in this policy to “IRISE ICT”, “IRISE”, “we”, “us” or “our” mean IRISE GLOBAL TECH NETWORK and the teams that operate its websites, products and contracted technology services.

This policy applies to personal data processed through or in connection with:

• the public website at iriseict.com, including inquiry, quote, contact, payment and recruitment pages;
• client accounts, project scoping, invoicing, support, service delivery and account administration;
• IRISE-operated products, including BestBulkSMS and Zena, where this policy is displayed or incorporated;
• custom software, automation, API integration, cloud and technical advisory engagements; and
• communications sent to or received from our team by email, telephone, messaging applications or other approved channels.

This policy does not automatically govern a third-party website or service merely because it is linked from our website. Please review the privacy notice of each third-party service you use.

The categories depend on how you interact with us and may include:

Please do not submit sensitive personal data unless it is necessary, lawful and specifically requested for the relevant service. Where a project requires health, biometric, financial, child or other sensitive data, additional controls and written terms may be required before processing begins.

• Directly from you when you complete a form, create an account, make a payment, communicate with us, submit a CV or use a service.
• From your organisation when an employer, school, customer, administrator or authorised user creates or manages your account.
• Through product use when systems generate logs, delivery records, security events, support data or transaction history.
• From service providers such as payment processors, telecommunications providers, hosting providers, identity or security services.
• From public or professional sources where lawful, such as a public company website, professional profile or official register.

We process personal data only where we have a recognised legal basis. Depending on the activity, this may include:

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing already carried out lawfully. Where we rely on legitimate interests, we consider the purpose, necessity and potential effect on individuals before processing.

BestBulkSMS and messaging services

Messaging services may process account contacts, sender identifiers, recipient telephone numbers, message content, campaign data, API requests, wallet activity, delivery status, carrier responses, opt-out or restriction information, IP addresses and security logs. Customers are responsible for ensuring that recipient data and message content are collected and used lawfully.

Zena school management platform

Zena may process school identity and subscription data, proprietor and staff accounts, applicant, student, parent or guardian records, classes, attendance, fees, receipts, results, notices and other enabled school modules. The participating school generally controls these records, while IRISE processes them to operate, secure and support the platform under the school’s instructions.

Custom systems, cloud and integration projects

The categories depend on the agreed project. Before production data is processed, the parties may define access controls, environments, retention, sub-processors, security measures, backup duties, permitted users and data-return or deletion procedures in a project agreement or data-processing addendum.

Our website and platforms may use cookies, local storage, server logs and similar technologies to keep sessions active, remember preferences, protect forms, prevent fraud, diagnose faults and understand service performance.

• Strictly necessary technologies support authentication, security, session continuity, load management and requested functionality.
• Security technologies may include Cloudflare Turnstile or similar anti-abuse tools that assess technical signals to distinguish legitimate users from automated traffic.
• Preference or analytics technologies may be used to remember settings or understand aggregate usage. Where consent is legally required, we will request it before using non-essential technologies.

You can control cookies through your browser, but blocking necessary cookies may prevent account, payment, security or form features from operating correctly.

We do not sell personal data. We may disclose it only as reasonably necessary to:

• hosting, infrastructure, security, email, support, analytics, backup and other technology providers;
• payment processors, banks and financial service providers for payment authorisation, reconciliation and fraud prevention;
• telecommunications carriers, messaging aggregators and delivery partners required to transmit and report messages;
• customers, schools or authorised administrators responsible for the relevant account, record or instruction;
• professional advisers, auditors, insurers and contractors bound by confidentiality or professional duties;
• regulators, courts, law-enforcement bodies or other authorities where disclosure is required or lawfully requested;
• a prospective buyer, investor, successor or restructuring adviser in connection with a business transaction, subject to appropriate safeguards; or
• another person where you have directed, authorised or consented to the disclosure.

Service providers are expected to process data only for authorised purposes and to apply suitable confidentiality and security controls. The specific providers used may change as our infrastructure evolves.

Some infrastructure, security, communications, software or support providers may process data outside Nigeria. Where personal data is transferred internationally, we will use a transfer method permitted by applicable law, such as an adequacy decision, contractual safeguards, binding rules, certification mechanisms, your explicit consent where appropriate, or another lawful derogation.

The location and protections applicable to customer-controlled data may also be specified in the relevant project agreement, subscription terms or data-processing addendum.

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including service delivery, account administration, security, backup cycles, dispute resolution, audit, tax, accounting and other legal requirements.

Retention is determined by factors such as:

• the duration of the customer, account, employment, recruitment or supplier relationship;
• the sensitivity, amount and operational importance of the data;
• contractual commitments, product settings and documented customer instructions;
• applicable limitation periods and regulatory recordkeeping obligations;
• fraud, abuse, security or litigation risks; and
• whether the data can be safely anonymised instead of retained in identifiable form.

When retention is no longer justified, data is deleted, anonymised or isolated until secure deletion is completed. Residual copies may remain temporarily in protected backups and be removed through the normal backup lifecycle.

We use technical and organisational measures proportionate to the nature of the data and service. Measures may include access controls, role separation, password hashing, encrypted connections, environment isolation, logging, anti-abuse controls, least-privilege access, protected backups, vendor assessment, secure development practices and incident-response procedures.

No internet service or storage system can be guaranteed completely secure. Users must protect their credentials, API tokens, devices and authorised accounts and must notify us promptly of suspected loss, unauthorised access or misuse.

Where a personal-data breach creates a legally reportable risk, we will assess the incident and make required notifications to affected controllers, individuals or the Nigeria Data Protection Commission within the applicable legal framework.

Subject to applicable law and relevant exemptions, you may have the right to:

• be informed about the processing of your personal data;
• request access to personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request deletion where there is no lawful reason for continued processing;
• restrict or object to certain processing, including direct marketing;
• receive qualifying data in a structured, commonly used and machine-readable format;
• withdraw consent where processing is based on consent;
• request information about safeguards used for an international transfer; and
• complain to the Nigeria Data Protection Commission or another competent authority.

To exercise a right, email info@iriseict.com with the subject Data Rights Request. Describe the data or account involved and the right you wish to exercise. We may request reasonable information to verify your identity and authority.

Where the data is controlled by a customer, school or employer, we may refer the request to that organisation or assist it in responding. We will not discriminate against a person for lawfully exercising a data-protection right.

The general IRISE ICT website and business inquiry services are not directed to children. A person who is not legally able to enter a contract should use an account or submit commercial information only through a parent, guardian or authorised organisation.

Zena and school projects may process information about applicants and students, including minors. In those circumstances, the school is generally responsible for determining the lawful basis, providing notices, obtaining any required parent or guardian authorisation, limiting staff access, maintaining accurate records and responding to school-community requests. IRISE processes such data to provide the contracted platform and support services.

Our services may link to or integrate with payment gateways, telecommunications networks, cloud platforms, social networks, developer tools or customer-selected systems. Those parties may process data under their own terms and privacy notices when they act independently.

A customer that enables an integration is responsible for confirming that it is authorised to send data to that integration and for configuring permissions appropriately. We are not responsible for a third party’s independent processing, security practices or content.

We may update this policy to reflect changes in law, guidance, products, infrastructure or business operations. The revised version will be posted on this page with a new “Last updated” date. Where a change materially affects existing users, we may also provide notice through an account, service or direct communication where appropriate.

Questions, complaints or privacy requests should be sent to info@iriseict.com. Please include enough information for us to identify the relevant website, product, project, account or organisation.