Privacy notice
This notice explains what personal data Small Sites collects, why, and your rights under the Nigeria Data Protection Act 2023. Small Sites is run by Otuya Web Design, which is the data controller for the data described here. Contact us about anything in this notice at contact@otuyawebdesign.com.ng.
What we collect
- Your account: your name, email address, phone number, business name, chosen web address and password (stored only in scrambled form).
- Your business details: what you send us to design your website — description, products, location, contact details, social media, logo and photos.
- Payments: order numbers, amounts, dates, the name on the account you paid from, and any receipt screenshot you upload. We never see or store your bank login or card details.
- Support: your messages and screenshots when you ask us for help.
- Security: login times, and your IP address when you sign up or log in, to stop abuse. If you switch on two-step login, the setting for it.
- Visits to your website: counts of visits and WhatsApp taps per day. We don’t use cookies on your website and don’t keep visitors’ IP addresses; a one-way code used to avoid counting the same visitor twice is deleted within hours.
Why we use it
- To provide the service you signed up for: designing, hosting and publishing your website and email (performance of our contract with you).
- To take payments, send receipts and renewal reminders, and keep financial records (contract and legal obligation).
- To keep accounts and websites secure and stop spam and fraud (legitimate interest).
- To answer your questions (contract and legitimate interest).
We don’t sell your data, and we don’t use it for advertising.
Your customers’ data
When people send messages through the enquiry form on your website, or email your business addresses, that data belongs to you. We store and deliver it on your behalf, as a data processor, and only use it to provide the service to you. You are responsible for how you use it.
Who we share it with
- Our hosting provider, whose servers store the service, websites and email. Their servers may be outside Nigeria; we only use providers who protect data to a standard comparable to Nigerian law.
- Google, if you switch on the map on your website (the map is loaded from Google), or connect Google Search Console yourself.
- Anyone the law requires us to share it with, such as a court order.
How long we keep it
- Sign-ups that never confirm their email and never send details: removed after 7 days.
- Clients: while your plan is active, and up to 60 days after it ends unpaid, then your website, email and files are deleted.
- A short record of each deleted account (business name, address, email, date) and payment records are kept as long as tax and accounting rules require.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or move it to another provider. You can withdraw any consent you gave. Most details can be changed yourself under Account and My Webpage Details. For anything else, email us and we’ll reply within 30 days. If you’re not satisfied, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
Security
Connections are encrypted, passwords are stored in scrambled form, and two-step login is available for every account. If a breach affects your data, we will tell you and the Commission as the law requires.
Children
Small Sites is for businesses and is not meant for anyone under 18.
Changes
We’ll update this notice when what we do changes, and email you if the change is significant.