01
Introduction
FortressPoint Consulting Ltd ("FortressPoint", "we", "us", "our") is committed to protecting the privacy and security of personal data we process in the course of our business activities. This policy explains what personal data we collect, why we collect it, how we use it, who we share it with, how long we keep it, and what rights you have over your data.
This policy applies to:
- Visitors to our website at fortresspointconsulting.com
- Clients and prospective clients
- Job applicants
- Newsletter subscribers
- Business contacts
Last reviewed: June 2026. This policy is reviewed at least annually and whenever there is a material change to our data processing activities.
02
Who We Are
FortressPoint Consulting Ltd is a cybersecurity and governance consultancy registered in England and Wales, operating across UK and Nigerian enterprise markets.
Data Controller (UK)
FortressPoint Consulting Ltd
15 Grange Road, Shepshed,
Loughborough, Leicestershire,
England, LE12 9LJ
info@fortresspointconsulting.com
+44 7487 887247
Data Controller (Nigeria)
FortressPoint Consulting Ltd
H152, Road 3, Ikota Complex,
Lekki, Lagos State, Nigeria
info@fortresspointconsulting.com
+234 806 789 0430
03
What Data We Collect
A — Website Visitors
- IP address and browser information (via Vercel hosting — anonymised)
- Pages visited and time on site
- Referral source
B — Contact Form Enquiries
- Full name
- Email address
- Phone number (if provided)
- Company name (if provided)
- Service of interest
- Message content
C — Newsletter Subscribers
- Email address
- Subscription date and source
- Email engagement data (opens, clicks) via Mailchimp
D — Job Applicants
- Full name, email, phone, address
- Nationality and right to work status
- Employment history and achievements
- Educational qualifications
- Professional certifications and memberships
- CV and cover letter
- Equal opportunities monitoring data (collected anonymously — not seen by hiring managers)
- Expected salary and notice period
E — Client Engagements
- Contact details of client personnel
- Information provided in the course of delivering consultancy services
- Invoice and payment details
04
Why We Collect It — Lawful Basis
| Purpose | Data Collected | Lawful Basis |
|---|---|---|
| Responding to enquiries | Contact form data | Legitimate interests (UK GDPR Art. 6(1)(f)) / Legitimate interests (NDPA s.25) |
| Sending our newsletter | Email address | Consent (UK GDPR Art. 6(1)(a)) / Consent (NDPA s.25(1)(a)) |
| Processing job applications | Application form data | Pre-contractual necessity (UK GDPR Art. 6(1)(b)) / Contract performance (NDPA s.25) |
| Delivering client services | Client contact and project data | Contract performance (UK GDPR Art. 6(1)(b)) / Contract performance (NDPA s.25) |
| Legal and regulatory compliance | As required | Legal obligation (UK GDPR Art. 6(1)(c)) / Legal obligation (NDPA s.25) |
| Improving our website | Usage analytics | Legitimate interests / Legitimate interests |
Special Category Data
Equal opportunities data (racial or ethnic origin, sexual orientation, religious beliefs) is collected voluntarily for statistical monitoring purposes only under explicit consent (UK GDPR Art. 9(2)(a)) and is never used in hiring decisions.
05
How Long We Keep Your Data
| Category | Retention Period | Reason |
|---|---|---|
| Contact enquiries | 2 years | Business relationship management |
| Newsletter subscriber data | Until unsubscribe + 30 days | Consent-based — deleted on withdrawal |
| Job applications (unsuccessful) | 6 months from decision | Recruitment administration |
| Job applications (successful) | Duration of employment + 7 years | Employment law obligations (UK) / Labour Act obligations (Nigeria) |
| Client engagement records | 7 years from end of engagement | Legal and regulatory obligations |
| Website analytics | 90 days (anonymised thereafter) | Service improvement |
| Equal opportunities data | 12 months (anonymised aggregate only) | Statistical monitoring |
Nigeria — NDPA GAID 2025 Note
Under the NDPA GAID 2025 (Article 49), personal data must be deleted or anonymised no later than 6 months after the purpose of processing has been fulfilled, subject to any statutory retention obligation.
06
Who We Share Your Data With
We do not sell personal data. We share data only with:
1. Service providers (data processors)
| Provider | Purpose | Safeguard |
|---|---|---|
| Vercel Inc (USA) | Website hosting | Standard Contractual Clauses |
| Resend Inc (USA) | Email delivery | Standard Contractual Clauses |
| Mailchimp / Intuit Inc (USA) | Newsletter management | Standard Contractual Clauses |
| Sanity.io (Norway/USA) | Content management | Standard Contractual Clauses |
- Professional advisors — legal, accounting, and audit firms — under confidentiality obligations
- Regulatory authorities — when required by law (ICO in the UK, NDPC in Nigeria)
- Prospective buyers — in the event of a business sale or merger, subject to confidentiality obligations
All third-party processors are required to process data in accordance with our instructions and applicable data protection law.
07
International Data Transfers
Some of our service providers are based outside the UK and Nigeria. We ensure appropriate safeguards are in place:
🇬🇧 United Kingdom
International transfers are governed by UK GDPR Chapter V and the Data (Use and Access) Act 2025. We rely on Standard Contractual Clauses (UK Addendum) or adequacy decisions where available.
🇳🇬 Nigeria
Cross-border data transfers are governed by NDPA 2023 Part VI and GAID 2025 Article 46. Transfers outside Nigeria are made only where adequate protection is confirmed or appropriate safeguards are in place.
08
Your Rights — United Kingdom
Your Rights Under UK GDPR and the Data (Use and Access) Act 2025
Right of Access (Article 15)
You may request a copy of the personal data we hold about you. We will respond within one calendar month.
Right to Rectification (Article 16)
You may request correction of inaccurate or incomplete data.
Right to Erasure (Article 17)
You may request deletion of your personal data where there is no compelling reason for us to continue processing it.
Right to Restrict Processing (Article 18)
You may request that we limit how we use your data in certain circumstances.
Right to Data Portability (Article 20)
Where processing is based on consent or contract, you may request your data in a structured, commonly used, machine-readable format.
Right to Object (Article 21)
You may object to processing based on legitimate interests or for direct marketing purposes.
Right not to be Subject to Automated Decision-Making (Article 22)
We do not make solely automated decisions with significant legal effects.
Right to Withdraw Consent
Where processing is based on consent you may withdraw it at any time without affecting the lawfulness of prior processing.
Supervisory Authority
Information Commissioner's Office (ICO)
ico.org.uk | 0303 123 1113 — You have the right to lodge a complaint with the ICO at any time.
09
Your Rights — Nigeria
Your Rights Under the Nigeria Data Protection Act 2023 and GAID 2025
Right to be Informed (Section 24)
You have the right to know how your personal data is being processed before or at the time of collection.
Right of Access (Section 34)
You may request details of the personal data we hold about you and how it is being processed.
Right to Rectification (Section 35)
You may request correction of inaccurate or outdated personal data.
Right to Deletion / Erasure (Section 36)
You may request deletion of your personal data where processing is no longer justified.
Right to Object (Section 37)
You may object to processing of your personal data in certain circumstances, including processing for direct marketing.
Right to Withdraw Consent (Section 30)
Where we process your data on the basis of consent, you may withdraw it at any time. Withdrawal will not affect the lawfulness of processing prior to withdrawal.
Right to Data Portability (Section 38)
You may request your data in a structured, commonly used format where technically feasible.
Right to Lodge a Complaint
You have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).
Supervisory Authority
Nigeria Data Protection Commission (NDPC)
ndpc.gov.ng | info@ndpc.gov.ng
10
How to Exercise Your Rights
To exercise any of your rights, contact us at:
Email: info@fortresspointconsulting.com
Subject line: Data Subject Request
Post: 15 Grange Road, Shepshed, Loughborough, LE12 9LJ, England
We will respond within:
- UK: One calendar month (extendable by two months for complex requests)
- Nigeria: A reasonable time as directed by the NDPC
We may need to verify your identity before processing your request. We will not charge a fee for reasonable requests.
11
Data Security
We implement appropriate technical and organisational measures to protect personal data, including:
- TLS encryption for all data in transit via our website
- Access controls limiting data access to authorised personnel
- Secure cloud hosting with Vercel on infrastructure with SOC 2 compliance
- Regular security assessments as part of our own cybersecurity practice
- Staff awareness of data protection obligations
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within:
- UK: 72 hours (UK GDPR Article 33)
- Nigeria: As required by NDPA 2023 and GAID 2025 Article 34
Where the breach is likely to result in a high risk to your rights, we will also notify you directly without undue delay.
13
Children's Data
Our website and services are not directed at children under 18. We do not knowingly collect personal data from individuals under 18. If we become aware that we have inadvertently collected data from a child, we will delete it promptly.
14
Changes to This Policy
We may update this policy from time to time to reflect changes in our data processing activities or regulatory requirements. When we make material changes we will update the "Last reviewed" date at the top of this page.
We encourage you to review this policy periodically. Continued use of our website and services after changes are published constitutes acceptance of the updated policy.
15
Contact Us
For any questions about this policy or our data protection practices:
Email: info@fortresspointconsulting.com
UK: +44 7487 887247
Nigeria: +234 806 789 0430
FortressPoint Consulting Ltd
15 Grange Road, Shepshed,
Loughborough, LE12 9LJ
England