Privacy Policy

Hexagon Engineering Privacy Policy

Hexagon Engineering Ltd. is committed to protecting the privacy, confidentiality, and security of all personal data entrusted to us. This policy outlines our data processing standards in strict adherence to the Nigeria Data Protection Act (NDPA) 2023, the Nigeria Data Protection Regulation (NDPR) 2019, and regulatory directives issued by the Nigeria Data Protection Commission (NDPC).

01

Scope & Legal Authority

Hexagon Engineering Ltd. (“Hexagon”, “we”, “us”, or “our”) is an indigenous engineering, procurement, construction (EPC), instrumentation, control, and process automation solutions provider operating in Nigeria and across the West African energy and manufacturing sectors.

This Privacy Policy applies to all personal data collected or processed through our website (including hexagoneng.com and related digital domains), client project consultations, technical training academy registrations, vendor pre-qualification submissions, and job applications.

Statutory Authority: This Policy is formulated and enforced pursuant to the Nigeria Data Protection Act (NDPA) 2023 enacted by the National Assembly of the Federal Republic of Nigeria, the Nigeria Data Protection Regulation (NDPR) 2019, and in recognition of the fundamental right to privacy guaranteed under Section 37 of the 1999 Constitution of the Federal Republic of Nigeria (as amended).

02

NDPA Principles of Data Processing

Under Section 24 of the Nigeria Data Protection Act 2023, Hexagon adheres strictly to the fundamental principles governing lawful personal data processing:

Lawfulness, Fairness & Transparency

Personal data is processed fairly, lawfully, and in a transparent manner without prejudicing the rights of the data subject.

Purpose Limitation

Data is collected only for specified, explicit, and legitimate commercial or statutory purposes, and not processed incompatibly.

Data Minimization

Processing is adequate, relevant, and strictly limited to what is necessary for the stated engineering or operational objectives.

Accuracy & Timeliness

Every reasonable step is taken to ensure that inaccurate personal data is erased or rectified promptly without delay.

Storage Limitation

Data is kept in a form which permits identification of data subjects for no longer than is necessary for the purposes processed.

Integrity & Confidentiality

Processed with appropriate technical and organizational security against unauthorized access, loss, destruction, or damage.

03

Information We Collect

Depending on how you interact with our engineering operations and digital services, we may collect and process the following categories of personal data:

  • Contact & Project Inquiry Data: Full name, professional title, business email address, telephone numbers, organization or company name, and project specifications submitted through our contact forms or service quotation requests.
  • Training & Academy Records: Trainee name, employer or corporate sponsor, professional qualifications, course selections (e.g. PLC, SCADA, DCS, SIS), attendance logs, evaluation scores, and accreditation/certification records.
  • Recruitment & Career Applications: Curriculum vitae (CV), resume, employment background, educational history, professional certifications (e.g., COREN, CSIA, OGTAN), and contact information of professional referees.
  • Vendor & Procurement Information: Sole proprietor or corporate representative contact information, tax identification numbers, bank verification details for commercial payments, and statutory compliance documentation.
  • Technical & Electronic Telemetry: Internet Protocol (IP) address, browser type and version, device operating system, referring URL, pages accessed, timestamps, and interaction logs collected automatically when browsing our website.
04

Lawful Bases for Processing (NDPA Section 25)

Hexagon only processes personal data where an explicit lawful basis exists under Section 25 of the Nigeria Data Protection Act 2023:

1. Consent of the Data Subject: Where you have given clear, informed, and unambiguous consent, such as opting in to newsletter updates, training webinars, or submitting spontaneous inquiries.
2. Contractual Necessity: Where processing is required for the execution or performance of a contract to which you or your employer are party (e.g., EPC contracts, automation system supply, service-level agreements, or technical training enrollment).
3. Compliance with Legal & Statutory Obligations: Where processing is mandated by Nigerian statutory authorities, including the Nigerian Upstream Petroleum Regulatory Commission (NUPRC), the Nigerian Midstream and Downstream Petroleum Regulatory Authority (NMDPRA), Federal Inland Revenue Service (FIRS), or court orders.
4. Legitimate Commercial & Operational Interests: Where processing is necessary for our legitimate interests, such as securing our engineering network against cyber threats, auditing facilities, and improving services, provided these interests do not override your fundamental rights.
05

How We Use Personal Data

We use the data collected strictly for legitimate business and industrial engineering purposes:

  • Providing industrial automation, EPC contracting, electrical system design, and well intervention services.
  • Processing client inquiries, preparing technical quotations, and facilitating project execution.
  • Administering engineering training courses, issuing verified certificates, and maintaining alumni certification databases.
  • Evaluating prospective candidates for engineering, technical, and administrative careers.
  • Conducting vendor screening, due diligence, and managing supplier supply chain relationships.
  • Maintaining the cybersecurity, performance, and uptime of our digital assets.
  • Complying with statutory reporting, taxation, and Nigerian audit obligations.
06

Third-Party Disclosures & Data Sharing

We do not sell, rent, or trade your personal data to any third party for commercial marketing. We only share personal data with vetted third parties under strict confidentiality and NDPA-compliant data processing agreements:

  • Technology Partners & Cloud Hosting Providers: Trusted cloud infrastructure, secure email service providers, and web hosting partners that support our operational infrastructure under binding data privacy agreements.
  • OEMs & Technical Certifiers: Original Equipment Manufacturers (e.g., Rockwell Automation, Siemens, Schneider Electric) and training accreditation bodies (e.g., OGTAN, CSIA) strictly for validating engineering credentials or warranties.
  • Statutory Regulators & Law Enforcement: Government ministries, the Nigeria Data Protection Commission (NDPC), NUPRC, or law enforcement authorities when required by binding legal process or court order.
07

Cross-Border Data Transfers (NDPA Sections 41–43)

Where personal data is transferred outside the territory of the Federal Republic of Nigeria (such as when utilizing secure enterprise cloud platforms hosted in Europe or North America, or collaborating with international engineering partners), Hexagon ensures compliance with Sections 41, 42, and 43 of the NDPA 2023.

Such transfers are carried out only where:

  • The recipient country provides an adequate level of data protection recognized by the NDPC; or
  • Appropriate contractual safeguards, such as Standard Contractual Clauses (SCCs) and binding corporate rules, have been executed; or
  • The data subject has provided explicit, informed consent after being briefed on the transfer safeguards.
08

Data Retention & Safe Disposal

Hexagon retains personal data only for the period necessary to fulfill the specific purposes for which it was obtained, or to comply with statutory retention requirements under Nigerian corporate, tax, and labor legislation.

• Client Project & Commercial Records: Retained for the lifespan of the engineering warranty plus statutory limitation periods (typically 6 years under Nigerian law).

• Training & Certification Verification: Retained indefinitely or for the duration required by accreditation bodies to enable ongoing certificate verification for graduates.

• Recruitment Data: Resumes and interview evaluations for non-hired candidates are retained for up to 12 months for prospective future openings, after which they are securely purged, unless the candidate requests immediate deletion.

• Web Telemetry & Logs: Kept for a maximum of 12 months for security audit and incident investigation purposes.

Upon the expiration of the retention window, data is permanently destroyed, securely shredded, or irreversibly anonymized.

09

Technical & Security Safeguards (NDPA Section 39)

Pursuant to Section 39 of the NDPA 2023, Hexagon implements state-of-the-art technical, physical, and organizational measures to safeguard personal data against unauthorized or unlawful processing, accidental loss, damage, or destruction:

Encryption in Transit & at Rest

All digital communications are secured with industry-standard SSL/TLS 256-bit encryption; data repositories are protected with modern encryption ciphers.

Role-Based Access Control

Strict least-privilege access rules ensure that only authorized personnel with verified operational necessity can access personal records.

Network Security & Firewalls

Continuous monitoring, intrusion detection, firewalling, and periodic vulnerability evaluations across our IT and OT infrastructure.

Incident Management Protocol

Formal incident response plan mandating notification to the NDPC within 72 hours in the unlikely event of a reportable data security breach.

10

Your Statutory Rights as a Data Subject

Under Section 34 of the Nigeria Data Protection Act 2023, you enjoy comprehensive, legally enforceable rights regarding your personal data:

Right to be Informed: You have the right to know how your personal data is collected, stored, and processed by Hexagon.
Right of Access: You can request copies of the personal data we hold about you at any time without undue delay.
Right to Rectification: You may require us to correct any inaccurate, outdated, or incomplete data concerning you.
Right to Erasure (“Right to be Forgotten”): You can request the deletion of your personal data where there is no longer a compelling legal ground for continued processing.
Right to Restriction of Processing: You can request that we restrict processing while a contested claim (such as accuracy or lawfulness) is resolved.
Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format.
Right to Object: You have the right to object at any time to the processing of your data for direct marketing or based on legitimate interests.
Right to Withdraw Consent: Where processing relies on consent, you may withdraw that consent at any time without affecting the lawfulness of past processing.

To exercise any of these rights, please write to our Data Protection Office at privacy@hexagon-automation.com. We respond to all verified statutory requests within 30 days as mandated by the NDPA.

11

Cookies & Web Tracking Technologies

Our website utilizes cookies and similar web identifiers to improve navigation performance, maintain security tokens, and analyze traffic patterns.

• Essential & Operational Cookies: Necessary for secure user session management, anti-CSRF token verification, and administrative login functionality.

• Performance & Telemetry Cookies: Anonymized analytical scripts that help us understand page popularity, load times, and broken links to enhance site usability.

You can configure your browser preferences to alert you when cookies are placed or disable cookies entirely. Note that disabling essential cookies may impact certain interactive features on our site.

12

Protection of Children's Data (NDPA Section 31)

Hexagon Engineering's services, industrial systems, and training academy are intended exclusively for commercial clients, industry professionals, and adults. In accordance with Section 31 of the NDPA 2023, we do not knowingly solicit or collect personal data from children under the age of 18 without verifiable parental or guardian consent.

If we discover that a minor's data has been provided inadvertently without requisite guardian consent, we will promptly delete such data from our records.

13

DPO & Regulatory Inquiries

If you have questions, feedback, or requests regarding this Privacy Policy, or wish to exercise your rights under the Nigeria Data Protection Act 2023, please contact our Data Protection Team:

Hexagon Data Protection Office

Email: privacy@hexagon-automation.com

General Inquiries: info@hexagon-automation.com

Phone (Lagos): +234 (0) 704-100-4852

Phone (Port Harcourt): +234 (0) 905-685-0877

Lagos Office: 3B Alade Close, Off Alade Street, Allen Avenue, Ikeja, Lagos State, Nigeria.

PHC Office: Block B, 33, Federal Housing Estate, Peter Odili Rd, Trans-Amadi, Port Harcourt, Rivers State, Nigeria.

Supervisory Commission

You also have the statutory right under the NDPA to lodge a formal complaint or petition with Nigeria's national data protection regulator:

Agency: Nigeria Data Protection Commission (NDPC)

National Headquarters: No. 12 Lake Chad Crescent, Maitama, Abuja, FCT, Nigeria.

Official Website: https://ndpc.gov.ng

Email: info@ndpc.gov.ng

Changes to this Privacy Policy: Hexagon reserves the right to update this policy periodically to reflect evolving regulatory directives from the NDPC or operational adjustments. The latest revision date will always be indicated at the top of this page.