Privacy Policy

FAJIMI & CO. Chartered Accountants ("we", "us", "our") is committed to protecting the privacy of all individuals who visit our website or use our AI compliance assistant. This Privacy Policy explains what personal data we collect, why we collect it, and your rights under the Nigeria Data Protection Act 2023 (NDPA) and applicable Nigerian regulations.

By using our website or AI assistant, you agree to the practices described in this Policy. If you do not agree, please discontinue use of our services.

Information We Collect

1.1 Information You Provide Directly

• Contact & Enquiry Forms: Name, email address, phone number, company name, business type, and the nature of your enquiry when you submit our strategy session request form.
• Communication Records: Emails, WhatsApp messages, or phone call notes when you contact us directly.
• Client Onboarding: For professional engagements, we collect additional information required by ICAN, FIRS, and CAC regulations (e.g., BVN, TIN, CAC registration numbers). This is governed by a separate client engagement letter.

1.2 Information Collected Automatically

• Usage Data: Pages visited, time on site, referring URL, browser type, device type, and approximate location (country/city level via IP address).
• AI Chat Interactions: Questions you submit to our AI Compliance Assistant are processed in real-time. See Section 3 for full details.
• Browser Local Storage: We use browser localStorage for chat history (auto-cleared after 30 minutes). See Section 8.

1.3 Information We Do Not Collect

• We do not collect payment card numbers or bank account details through this website.
• We do not build user profiles or track individuals across third-party websites.
• We do not use biometric data.

How We Use Your Information

We use collected information for the following purposes:

• Service Delivery: Respond to strategy session requests, provide quotes, and onboard clients.
• AI Assistant Operation: Process your questions to retrieve relevant answers from our official tax document knowledge base.
• Communications: Send appointment confirmations, regulatory updates, and newsletters (only with your explicit consent).
• Legal & Compliance Obligations: Retain records as required by ICAN, FIRS, and Nigerian law.
• Service Improvement: Analyse aggregated, anonymised usage data to improve our website and AI assistant.
• Security: Detect and prevent fraud, abuse, and unauthorised access.

We will never sell, rent, or trade your personal information to third parties for their own marketing purposes.

AI Compliance Assistant. Special Notice

3.1 How the AI Works

Our AI Compliance Assistant uses Retrieval-Augmented Generation (RAG) technology. When you submit a question:

1. Your question is sent to our secure backend server via encrypted HTTPS.
2. The system searches our knowledge base of official Nigerian tax documents.
3. Relevant document excerpts are retrieved and used to generate a response.
4. The response is returned to your browser.

3.2 Data Handling for AI Queries

• No persistent server-side storage: Individual AI chat messages are not stored in a database linked to your identity after the session ends.
• Browser-only history: Chat history is stored exclusively in your browser's localStorage and automatically deleted after 30 minutes. Clearing your browser data removes it immediately.
• Third-party AI providers: Our AI backend may use third-party large language model APIs (such as Anthropic Claude or Google Gemini). These providers process your query text under their own privacy policies. We do not share your name, email, or identifying information only the text of your question.
• No training on your data: Your queries are not used to train or fine-tune any AI model.

3.3 What the AI Cannot Do

The AI assistant cannot access your personal tax records, FIRS account, CAC filings, or any external databases. It only references documents our team has explicitly uploaded.

Legal Basis for Processing

Under the NDPA 2023, we process your personal data on the following legal grounds:

• Consent: For newsletter subscriptions and non-essential cookies (where applicable).
• Contract Performance: To deliver professional services you have engaged us for.
• Legitimate Interests: For website security, fraud prevention, and service improvement where these interests do not override your fundamental rights.
• Legal Obligation: To comply with ICAN professional standards, FIRS requirements, FCCPC regulations, and other applicable Nigerian law.

Data Sharing & Disclosure

We do not sell your data. We may share information only in these limited circumstances:

• Service Providers: Trusted third-party processors who help us operate our website (e.g., cloud hosting, email delivery, AI API providers). All such processors are bound by data processing agreements.
• Google Sheets: Strategy session form submissions are stored in a Google Sheets document accessible only to authorised FAJIMI & CO. staff.
• Professional Partners: With your explicit consent, we may share information with legal counsel or co-advisors involved in your engagement.
• Legal Requirements: If required by a valid Nigerian court order, law enforcement request, or regulatory authority (e.g., EFCC, FIRS, CAC) with proper legal process.
• Business Transfers: In the event of a merger or acquisition, your data would be transferred subject to equivalent protections.

Data Retention

• Strategy Session Enquiries: Retained for 12 months from submission, or for the duration of any subsequent engagement.
• Client Engagement Records: Retained for a minimum of 7 years as required by ICAN professional standards and Nigerian tax law.
• AI Chat History: Stored only in your browser localStorage; automatically purged after 30 minutes. No server-side retention.
• Website Usage Data: Retained in anonymised form for up to 24 months.

When data is no longer required, it is securely deleted or anonymised.

Your Rights Under the NDPA 2023

As a data subject under Nigerian law, you have the following rights:

• Right to Information: Know what personal data we hold about you.
• Right of Access: Request a copy of your personal data.
• Right to Rectification: Request correction of inaccurate data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your data, subject to our legal retention obligations.
• Right to Restrict Processing: Ask us to limit how we use your data in certain circumstances.
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests or for direct marketing.
• Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting prior processing.
• Right to Lodge a Complaint: File a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

To exercise any of these rights, contact us at fajimiandco@yahoo.com. We will respond within 30 days.

Cookies & Local Storage

8.1 What We Use

• Browser localStorage: We store your AI chat history locally under the key fajimi_chat_history. This data never leaves your device and is automatically cleared after 30 minutes.
• Session-level data: Standard browser session data for navigation and form state.

8.2 What We Do Not Use

We do not currently use third-party tracking cookies, advertising cookies, or cross-site tracking technologies. If this changes, we will update this policy and seek appropriate consents.

Security

We implement industry-standard technical and organisational measures to protect your personal data:

• All data transmission is encrypted via HTTPS/TLS.
• Our backend API uses rate limiting, request validation, and security headers (X-Content-Type-Options, X-Frame-Options).
• Admin access to documents and data is protected by authentication and JWT-based authorisation.
• Access to personal data is restricted to authorised personnel only.
• We conduct periodic security reviews of our systems.

In the event of a data breach affecting your rights, we will notify affected individuals and the NDPC as required by the NDPA 2023.

Children's Privacy

Our services are intended for business owners, professionals, and adults aged 18 and over. We do not knowingly collect personal data from children under 18. If you believe a child has submitted information to us, please contact us immediately and we will delete it.

Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last Updated" date at the top of this page. We encourage you to review this policy periodically.