Privacy Policy

Winlium Limited ("Winlium", "we", "us", "our") is a private company incorporated in Nigeria with RC No. 9867443, whose office is at Endless Home, Beside Landwey Building, Off Lekki-Epe Road, Sangotedo, Lagos. We develop and provide Winlium ERP, an enterprise resource planning platform, together with the Winlium Microsite, mobile and web apps, and related implementation and support services (together, the "Services").

This Privacy Policy explains how we collect, use, share and protect personal data, and the rights you have. It is issued in line with the Nigeria Data Protection Act 2023 ("NDPA"), the General Application and Implementation Directive ("GAID") issued by the Nigeria Data Protection Commission ("NDPC"), and other applicable Nigerian laws.

This Policy applies from 1 December 2026 to personal data we handle through www.winlium.com (the "Website"), our sales, marketing and support activities, our pilot and partner programmes, and the Services.

When we act as data controller. We decide how and why personal data is used when it relates to visitors to our Website, people who contact us or request a demo, pilot applicants, our customers' account and billing contacts, our partners and their staff, and suppliers. This Policy describes that processing in full.

When we act as data processor. When our customers use Winlium ERP, they enter data about their own employees, customers, suppliers and other people (for example payroll and HR records, attendance records, sales and delivery details, and biometric data used for login or time and attendance). For that data, our customer is the data controller and we process it only on their instructions, under our Software Licence and Subscription Agreement. If your data is held in Winlium ERP by a business you deal with (for example your employer, or a shop you order from through a Winlium Microsite), that business's privacy notice applies, and you should contact that business first to exercise your rights. We will assist them in responding.

We collect personal data that you give us, that is generated when you use our Website or the Services, or that we receive from others:

We may also receive personal data from our customers (for example when they create user accounts for their staff), from Deployment Partners and referral partners who introduce customers to us, from event organisers, and from publicly available business sources.

We do not intentionally collect sensitive personal data (such as health, religious, ethnic or biometric data) as controller. Where sensitive personal data is entered into Winlium ERP by a customer, we process it only as that customer's processor.

Under the NDPA we must have a lawful basis for each use of personal data. We use personal data as follows:

Where we rely on legitimate interests, we have considered that our interests are not overridden by your rights. Where we rely on consent, you may withdraw it at any time, without affecting processing that took place before withdrawal.

We do not sell personal data, and we do not make decisions that produce legal or similarly significant effects on you based solely on automated processing.

We share personal data only where necessary, and only with:

Some of our hosting and service providers store or process data outside Nigeria. For security reasons we do not publish the names of our hosting providers or the location of our data centres, but we will disclose them to a customer or regulator where reasonably required for regulatory, audit or legal compliance purposes.

Any transfer of personal data outside Nigeria is made in line with Part VIII of the NDPA and the GAID: to a country or organisation that provides an adequate level of protection, or on another lawful basis they recognise, such as appropriate contractual safeguards.

Winlium ERP supports password login, two-factor authentication, facial recognition and fingerprint authentication, along with role-based permissions, approval workflows and audit trails.

Facial and fingerprint data are sensitive personal data. Where our customer enables these features, the customer, as controller, is responsible for informing its users and obtaining any consent the law requires. We process biometric data only to provide the authentication or time and attendance function, protect it with enhanced security measures, do not use it for any other purpose, and delete it when the customer deletes the user or when the customer's subscription ends, in line with Clause 9.

Users are responsible for keeping their passwords, devices and one-time codes confidential. Customers that connect Winlium ERP to banks or payment services should enable the security features already provided, including two-factor or biometric authentication, to protect access.

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure, including encryption in transit and at rest, access controls based on the least privilege needed, multi-factor authentication for our staff, monitoring and logging, daily backups kept for 30 days, periodic restoration testing, staff confidentiality obligations and training, and regular review of our security practices.

No system is completely secure. If a personal data breach occurs that is likely to result in a risk to people's rights and freedoms, we will notify the NDPC within 72 hours of becoming aware of it where we are the controller, and will inform affected individuals without undue delay where the breach is likely to result in a high risk to them. Where we are a processor, we will notify the affected customer without undue delay, and in any event within 48 hours, and help it meet its own obligations.

We keep personal data only for as long as needed for the purposes in this Policy, including to meet legal, tax, accounting and reporting requirements:

Under the NDPA you have the right to:

To exercise any right, contact us using the details in Clause 14. We may need to verify your identity before acting on a request. We will respond within thirty (30) days, free of charge, unless a request is clearly unfounded or excessive. If your data is held in Winlium ERP by one of our customers, we will refer your request to that customer.

If you are not satisfied with our response, you may lodge a complaint with the Nigeria Data Protection Commission (www.ndpc.gov.ng).

Our Website and the Services use cookies and similar technologies. Essential cookies keep you logged in, remember security settings and make the Services work; they cannot be switched off. Analytics cookies help us understand how the Website is used so we can improve it, and are used only with your consent where the law requires it.

You can manage cookies through the cookie banner on our Website and through your browser settings. Blocking essential cookies may stop parts of the Services from working.

We may send you news, product updates, offers and event invitations where you have agreed to receive them or where you are an existing business contact and have not opted out. Every marketing message includes a simple way to opt out, and you can also opt out at any time by contacting us. Opting out of marketing does not stop service messages about your account, security or billing.

Our Website and Services are intended for businesses and are not directed at children under 18. We do not knowingly collect personal data from children as controller. If you believe a child has given us personal data, please contact us and we will delete it.

For any question about this Policy or to exercise your rights, contact our Data Protection Officer:

We may update this Policy from time to time. The latest version will always be published on our Website with its effective date. Where changes are significant, we will notify customers by email or through the Services before they take effect.