Privacy Policy
T-One Technologies Limited (RC1024387) ("we", "us") provides RevSprint CRM, a business software service. This policy explains what personal data we handle, why, who we share it with and what rights you have under the Nigeria Data Protection Act 2023 (the "NDPA"). It covers visitors to our website and people who use the service. Questions go to support@t-onetech.com.ng.
1. Two different roles
Your account and billing details. For the details we need to run your account and subscription, we decide how and why they are used, so we are the data controller.
Your business data. Companies that use RevSprint CRM put their own contacts, customers, staff and records into it. For that data the company is the controller and we are its processor: we store and process it only to provide the service and on the company's instructions. If a company holds your data in RevSprint CRM (for example you are its customer or employee), please contact that company first about your rights.
2. What we collect
- Account details: your name, work email address, password (stored only as a one-way hash), role, the company you belong to, and whether you use two-factor authentication.
- Company and billing details: company name, industry, contact person, plan and subscription status. Card payments are handled by our payment providers; we do not store card numbers.
- Usage and security records: sign-in times, IP address and browser type, actions recorded in audit logs, and error logs. We use these to keep the service secure and working.
- Content you or your company add: contacts, deals, tickets, invoices, staff and HR records, documents and so on. This may include sensitive personal data such as salary or identity documents if your company chooses to store it.
- Messages to us: emails and support requests you send.
3. Why we use it, and our lawful basis
- To provide and run the service you or your company signed up for (performance of a contract).
- To keep the service secure, prevent abuse and fix faults, including captcha checks on sign-up (our legitimate interests).
- To send service messages such as email verification, password resets, invoices and security alerts (contract and legitimate interests).
- To meet legal, tax and accounting duties (legal obligation).
- To send news or offers only where you have agreed; you can withdraw that at any time.
We do not sell personal data and we do not use it for advertising.
4. Who we share it with
We use service providers who process data for us under their own security and confidentiality commitments. Which of these apply depends on what you switch on:
- Hosting and infrastructure for our servers and backups.
- Email delivery for verification, reset and notification emails.
- Payments: Paystack and Flutterwave, to take subscription and invoice payments.
- Captcha: Cloudflare Turnstile on sign-up forms, which sees your IP address and browser details to tell people from bots.
- Messaging: SMS and WhatsApp providers, only if your company connects them.
- Sign-in and calendar/email connections: Google or Microsoft, only if you or your company connect them.
- AI features: when you use an AI feature, the text needed for that request is sent to the AI provider your company has configured (for example Anthropic or OpenAI) to produce the answer. Do not use AI features with data you are not allowed to send.
- Government e-invoicing systems, if your company turns on tax e-invoicing.
We may also disclose data where the law requires it, to protect people's safety or our rights, or in a merger or sale of the business, in which case we will tell you.
5. Transfers outside Nigeria
Some of the providers above run their systems outside Nigeria. Where personal data is sent abroad we take steps required by the NDPA, such as choosing providers that protect it to an adequate standard and binding them by contract.
6. Cookies and similar storage
We use only what the service needs to work: a session cookie that keeps you signed in, a security cookie that protects forms against forgery, an optional "remember me" cookie if you ask for it, and small items in your browser's local storage that remember display choices such as theme and which menu sections are open. We do not use advertising or tracking cookies. Our pages load fonts from Bunny Fonts, which does not track visitors. If Cloudflare Turnstile is switched on, Cloudflare may set its own cookie to run the check.
7. How long we keep it
- Account and business data: while the account is active. After a company closes its account we keep its data for a short period so it can be recovered or exported, then delete it, except where we must keep records.
- Billing and tax records: as long as the law requires.
- Security and audit logs: only as long as needed for security and legal purposes.
- Backups: deleted data can remain in backups until they are overwritten in the normal cycle.
8. Security
We protect data with encrypted connections, access controls that separate each company's data from every other company's, two-factor authentication required for administrators, rate limits and logging. Some sensitive items, such as stored credentials in the vault, are encrypted at rest. No system is perfectly secure. If a breach puts your personal data at risk we will notify you and the Nigeria Data Protection Commission as the NDPA requires.
9. Your rights
Under the NDPA you can ask to: see the personal data we hold about you; correct it; have it deleted; restrict or object to how it is used; receive it in a portable form; and withdraw consent you gave earlier. You can also object to automated decisions that significantly affect you. To use these rights for data we control, email support@t-onetech.com.ng. We will respond within the time the law allows, usually within 30 days, and may need to confirm who you are first.
If you believe we have mishandled your data you can complain to us, and you have the right to complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
Some companies using RevSprint CRM offer their own data request page; for data a company holds about you, use that page or contact the company.
10. Children
The service is for businesses and is not aimed at anyone under 18. We do not knowingly collect children's data. If you think a child has given us data, tell us and we will delete it.
11. Changes
We may update this policy. When the changes are important we will tell account holders by email or in the app before they take effect. The date at the top shows the latest version.
12. Contact
T-One Technologies Limited, RC1024387.
Privacy questions and requests: support@t-onetech.com.ng.