Privacy Policy

1. Introduction & Legal Framework

Welcome to Esson Software Solutions Limited ("Company", "we", "us", "our"). We build and operate enterprise software platforms for Logistics, Supply Chain Management (SCM), and mobility solutions including SafeRoute (collectively referred to as the "Service").

We are committed to protecting your personal information and respecting your privacy. This Privacy Policy outlines what personal data we collect, why we process it, how we safeguard it, and how you can exercise your statutory rights under the Nigeria Data Protection Act (NDPA) 2023 and the regulatory directives of the Nigeria Data Protection Commission (NDPC).

By accessing or using our websites, client dashboards, or telematics services, you acknowledge that your personal data will be processed in accordance with this policy.

2. Information We Collect

We collect personal and technical information depending on how you interact with our digital platforms and operational transport networks:

3. Lawful Basis & Purpose of Processing

Under Section 25 of the NDPA 2023, we process personal data only when there is an established legal basis:

• Contract Performance: To create and authenticate accounts, manage warehouse/transit dispatches, generate billing invoices, and facilitate logistics software workflows.
• Legitimate Interests: To optimize transit routes, safeguard fleet assets against physical theft, secure system infrastructure, and resolve technical issues.
• Consent: To deliver our optional logistics newsletter, marketing updates, or non-essential analytical cookies. Consent may be withdrawn at any time.
• Legal Obligation: To fulfill statutory tax reporting, regulatory disclosures, and law enforcement directives under Nigerian jurisprudence.

4. Protection of Children's Personal Data (SafeRoute Operations)

In compliance with Section 31 of the Nigeria Data Protection Act (NDPA) 2023, we observe heightened safeguards regarding personal data belonging to children (persons under the age of 18):

• Institutional Role: In delivering the SafeRoute School Transit platform, ESSL acts as a Data Processor on behalf of partnering educational institutions (the Data Controllers).
• Parental/Guardian Consent: Schools are contractually required to verify and maintain explicit parental or legal guardian consent prior to enrolling any student into the SafeRoute tracking system.
• Purpose Limitation: Pupil data (such as student name, designated bus stop, and RFID/QR check-in timestamps) is utilized exclusively for student transit safety and parental arrival notifications. We strictly prohibit the profiling, commercial marketing, or cross-platform tracking of children.

5. Cookies and Automated Tracking Technologies

We use cookies and browser local storage to authenticate sessions, remember your visual interface preferences (such as light or dark theme), and analyze aggregated website performance.

Under NDPC directives, all non-essential cookies require your prior affirmative consent. You have full granular control over non-essential trackers and can modify your choices at any time via the "Cookie Settings" link in the footer.

For a complete inventory of storage items, categories, and lifespans, please consult our dedicated Cookie Policy.

6. Data Sharing & Third-Party Processors

We do not sell, rent, or trade your personal data. We disclose personal data solely under strictly governed parameters:

• Cloud & Infrastructure Providers: Secure hosting and database providers bound by stringent data processing agreements (DPAs) meeting NDPA compliance standards.
• Communication & CRM Tools: Providers such as Brevo for delivering transactional service notices and consented newsletters.
• Enterprise Clients: Aggregated and real-time transit logs are shared strictly with authorized client managers overseeing respective transport corridors.
• Statutory Authorities: Where legally mandated by a competent Nigerian court or regulatory authority.

7. Data Retention & International Transfers

We retain personal data only for as long as necessary to fulfill the specific operational purposes outlined in this policy or as required by applicable Nigerian commercial laws (e.g., financial and audit retention regulations).

Where personal data is transferred across borders (such as when utilizing global cloud infrastructure), we ensure that the recipient country provides an adequate level of data protection in accordance with Section 41 of the NDPA 2023, or that standard contractual clauses approved by the NDPC are in place.

8. Technical & Organizational Security Safeguards

ESSL implements comprehensive, multi-layered security controls to protect your data against unauthorized access, loss, or alteration:

• Encryption: Data in transit is encrypted using modern TLS protocols, and sensitive data at rest is protected with AES-256 standards.
• Access Governance: Role-based access control (RBAC), multi-factor authentication for administrative users, and principle of least privilege across all engineering environments.
• Audit Logs & Monitoring: Continuous monitoring of telematics pipelines and regular vulnerability assessments.

9. Your Statutory Data Protection Rights

Under the Nigeria Data Protection Act (NDPA) 2023, data subjects possess the following statutory rights:

• Right to Access: You may request copies of personal data we hold about you.
• Right to Rectification: You may request the correction of inaccurate or incomplete personal records.
• Right to Erasure: You may request the deletion of your personal data ("Right to be Forgotten") where continued processing is no longer justified.
• Right to Restrict Processing: You may restrict the scope of processing under specific legal conditions.
• Right to Object: You may object to data processing grounded on legitimate interests or direct marketing.
• Right to Data Portability: You may request a structured, machine-readable export of your personal data.
• Right to Withdraw Consent: Where processing is predicated on consent, you may withdraw your authorization at any time without penalty or detriment.

To exercise any of these rights, please contact our Data Protection desk at dpo@essl.com.ng. We will process your request within the statutory one-month timeframe without fee, unless requests are manifestly unfounded or excessive.

10. Contact Us & NDPC Dispute Resolution

If you have questions, inquiries, or grievances regarding our privacy practices, please contact our data governance officers:

If you believe your personal data has been handled unlawfully and our Data Protection desk has not addressed your concerns satisfactorily, you have the statutory right to lodge a formal complaint with the supervisory authority: