PRIVACY POLICY

Effective Date: 17th September 2026
Last Updated: 23 September 2026

Megaheadz Studios (“Megaheadz,” “we,” “us,” or “our”) respects your privacy and is committed to protecting the personal information entrusted to us.

This Privacy Policy explains how we collect, use, disclose, store, protect and otherwise process personal information when you visit www.megaheadzonline.com, communicate with us, request our services, purchase our products, participate in our programmes, or otherwise interact with Megaheadz.

This Privacy Policy is intended to apply globally and is supplemented by the data-protection laws applicable to the jurisdiction in which you are located.

1. ABOUT MEGAHEADZ

Megaheadz is a creative technology company providing digital, creative and technology services.

For privacy-related questions, please contact:

Megaheadz Studios
Website: www.megaheadzonline.com
Email: privacy@megaheadzonline.com
Address: 12 Arinade Alabi Close, Ojodu Estate

2. OUR COMMITMENT TO DATA PROTECTION

Megaheadz is committed to responsible and transparent handling of personal information.

Where we process personal information relating to individuals in Nigeria, we seek to comply with the Nigeria Data Protection Act 2023 (NDP Act) and applicable regulations, directives and guidance issued by the Nigeria Data Protection Commission (NDPC).

The NDP Act replaced the Nigeria Data Protection Regulation 2019 (NDPR) as Nigeria’s principal statutory data-protection framework. The NDPR established important principles and practices that continue to provide useful historical and operational context for data protection in Nigeria. Megaheadz therefore maintains data-handling practices that reflect applicable principles from the NDPR while operating under the current NDP Act and applicable NDPC requirements.

For individuals outside Nigeria, we may also comply with other applicable privacy and data-protection laws, including where relevant the EU General Data Protection Regulation (GDPR), UK data-protection legislation and other applicable local privacy laws.

3. DATA PROTECTION PRINCIPLES

Our handling of personal information is guided by the following principles:

Lawfulness, fairness and transparency

We seek to process personal information lawfully, fairly and transparently and to explain how and why information is collected and used.

Purpose limitation

We collect personal information for specified, explicit and legitimate purposes and seek not to use it for incompatible purposes.

Data minimisation

We seek to collect only information that is reasonably necessary for the relevant purpose.

Accuracy

We take reasonable steps to ensure that personal information is accurate, complete and kept up to date where necessary.

Storage limitation

We retain personal information only for as long as reasonably necessary for the relevant purpose, subject to legal, contractual, accounting, security and other legitimate requirements.

Integrity and confidentiality

We use reasonable technical and organisational measures designed to protect personal information against unauthorized access, unlawful processing, loss, destruction, alteration or disclosure.

These principles are consistent with the data-processing principles identified by the NDPC under the NDP Act.

4. INFORMATION WE COLLECT

Depending on how you interact with Megaheadz, we may collect the following categories of information.

Information you provide directly

This may include:

• Full name;

• Email address;

• Telephone number;

• Company or organisation;

• Job title;

• Business address;

• Billing information;

• Project information;

• Messages and enquiries;

• Information submitted through forms;

• Account information;

• Feedback;

• Communications with us; and

• Other information you voluntarily provide.

Transaction information

Where you purchase a product or service, we may process information necessary to administer the transaction, such as:

• Product or service purchased;

• Transaction amount;

• Payment status;

• Billing information;

• Invoice information; and

• Transaction identifiers.

Where payment is processed through a third-party payment provider, payment-card and other financial credentials may be collected and processed directly by that provider rather than being stored by Megaheadz.

Technical information

When you visit our website, certain technical information may automatically be collected, including:

• IP address;

• Browser type;

• Device type;

• Operating system;

• Approximate location derived from IP address;

• Pages visited;

• Referring websites;

• Time and duration of visits;

• Website interactions;

• Diagnostic information; and

• Performance information.

5. NDPR / NIGERIAN DATA-HANDLING PRACTICES

Where Nigerian data-protection law applies, Megaheadz seeks to handle personal information in accordance with the applicable requirements of the Nigeria Data Protection Act 2023, relevant NDPC regulations and directives, and applicable privacy principles originating from the NDPR framework.

Our Nigerian data-handling practices include the following:

5.1 Lawful processing

We seek to process personal information only where there is an applicable lawful basis.

Depending on the circumstances, this may include:

• Consent;

• Performance of a contract;

• Steps taken at your request before entering into a contract;

• Compliance with a legal obligation;

• Protection of vital interests;

• Public interest where applicable; or

• Legitimate interests where permitted by applicable law.

The NDPC identifies recognised lawful bases including consent, legal obligation and contract.

5.2 Fair and transparent collection

Where reasonably practicable, we will inform individuals about:

• What personal information we collect;

• Why we collect it;

• How we use it;

• The relevant lawful basis;

• Categories of recipients;

• Applicable retention periods;

• International transfers where relevant; and

• Available privacy rights.

5.3 Purpose limitation

Personal information collected through our website, forms, client engagements or other channels will generally be used only for the purposes communicated at the point of collection or for compatible purposes permitted by law.

For example, information submitted through a project enquiry form may be used to:

• Respond to the enquiry;

• Prepare a proposal;

• Communicate with the prospective client;

• Assess project requirements; and

• Establish or perform a contractual relationship.

5.4 Data minimisation

Megaheadz seeks to avoid collecting personal information that is unnecessary for the stated purpose.

Where a particular piece of information is not reasonably required to provide a service, fulfil a contract, comply with law or otherwise establish a legitimate purpose, we seek not to require it.

5.5 Consent

Where consent is the appropriate legal basis for processing, we will seek consent in an appropriate manner.

Where applicable, individuals may withdraw consent.

Withdrawal of consent does not necessarily affect processing that was lawfully carried out before consent was withdrawn or processing that can lawfully continue under another legal basis.

5.6 Data security

We implement reasonable technical and organisational safeguards appropriate to the nature of the personal information and the risks associated with its processing.

These may include:

• Access controls;

• Authentication;

• Password and credential controls;

• Encryption where appropriate;

• Secure hosting;

• Backups;

• Security monitoring;

• Software and security updates;

• Restricted administrative access;

• Confidentiality obligations; and

• Other appropriate technical or organisational safeguards.

5.7 Data retention

We seek to retain personal information only for as long as reasonably necessary for the purpose for which it was collected or as required by applicable legal, contractual, regulatory, accounting or security obligations.

When information is no longer required, we may securely delete, anonymise or otherwise dispose of it.

5.8 Third-party processors

Where we use third-party service providers to process personal information, we seek to use providers that provide appropriate privacy and security safeguards.

Such providers may include:

• Cloud infrastructure providers;

• Website hosting providers;

• Payment processors;

• Email providers;

• CRM platforms;

• Analytics platforms;

• Software providers;

• Security providers;

• AI and technology providers; and

• Professional service providers.

Where required by applicable law, appropriate contractual and organisational safeguards will be used when engaging data processors.

5.9 International transfers

Personal information may be processed or stored outside Nigeria where Megaheadz or one of its service providers operates internationally.

Where applicable Nigerian law requires safeguards for international transfers, Megaheadz will take reasonable steps to ensure that appropriate legal and contractual mechanisms are in place.

6. PERSONAL DATA WE PROCESS

Depending on your relationship with Megaheadz, we may process categories of personal information such as:

The exact categories of information processed and applicable lawful basis may vary according to the specific service, relationship and circumstances.

7. COOKIES AND SIMILAR TECHNOLOGIES

We may use cookies, pixels, tags, local storage and similar technologies to:

• Operate the website;

• Remember preferences;

• Maintain security;

• Understand website usage;

• Improve website performance;

• Measure marketing effectiveness; and

• Support website functionality.

Cookies may be categorised as:

Essential cookies

These are necessary for core website functionality and security.

Preference cookies

These help remember settings and preferences.

Analytics cookies

These help us understand how visitors use our website.

Marketing cookies

Where used, these may help measure advertising performance or provide more relevant marketing.

Where required by applicable law, we will seek consent before placing or using non-essential cookies.

You may also manage cookies through your browser settings and any cookie-management tools provided on our website.

8. HOW WE USE PERSONAL INFORMATION

We may use personal information to:

• Respond to enquiries;

• Provide requested services;

• Manage client relationships;

• Prepare proposals and quotations;

• Process payments;

• Deliver projects;

• Provide customer support;

• Communicate with clients;

• Improve our website and services;

• Maintain security;

• Prevent fraud and abuse;

• Send service-related communications;

• Send marketing communications where permitted;

• Analyze website performance;

• Conduct research and development;

• Comply with legal obligations; and

• Protect our legal rights and legitimate business interests.

9. MARKETING COMMUNICATIONS

Where permitted by applicable law, Megaheadz may send information about:

• Services;

• Products;

• Events;

• Training;

• Articles;

• Resources;

• Promotions; and

• Other offerings.

You may opt out of marketing communications at any time by using the unsubscribe mechanism provided in the communication or by contacting us.

We may continue sending essential transactional, security or service-related communications where necessary.

10. HOW WE SHARE PERSONAL INFORMATION

Megaheadz does not sell personal information as a business practice.

We may disclose personal information where reasonably necessary to:

• Provide our services;

• Process transactions;

• Operate our website;

• Maintain our technology infrastructure;

• Provide customer support;

• Meet legal obligations;

• Protect our rights;

• Prevent fraud or security incidents; or

• Perform other legitimate business functions.

Recipients may include:

• Hosting providers;

• Cloud-service providers;

• Payment processors;

• Email platforms;

• Analytics providers;

• CRM systems;

• Software providers;

• Technology partners;

• Professional advisers;

• Contractors;

• Security providers; and

• Government or regulatory authorities where legally required.

11. INTERNATIONAL DATA TRANSFERS

Because Megaheadz operates in an increasingly global digital environment, information may be processed by service providers located in countries other than your country of residence.

Where required by applicable law, we will use appropriate safeguards for international data transfers.

These may include:

• Adequacy mechanisms;

• Contractual safeguards;

• Appropriate data-processing agreements;

• Other legally recognised transfer mechanisms; or

• Consent where legally appropriate.

12. DATA RETENTION

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy or as required by law.

Factors that may determine retention include:

• The purpose for which the information was collected;

• The nature of our relationship with you;

• Contractual requirements;

• Legal and regulatory requirements;

• Accounting obligations;

• Dispute resolution;

• Security requirements; and

• Legitimate business needs.

When information is no longer required, we will take reasonable steps to securely delete, anonymise or otherwise dispose of it.

13. DATA SECURITY

We use reasonable technical and organisational measures designed to protect personal information against:

• Unauthorized access;

• Unauthorized disclosure;

• Accidental loss;

• Destruction;

• Alteration;

• Misuse;

• Unlawful processing; and

• Other security threats.

No online system, however, can be guaranteed to be completely secure.

14. DATA BREACHES

If Megaheadz becomes aware of a personal-data breach, we will assess the incident and take reasonable steps to contain, investigate and remediate the incident.

Where notification is required by applicable law, we will notify the relevant regulatory authority and/or affected individuals within the applicable legal timeframe.

15. YOUR DATA-PROTECTION RIGHTS

Depending on your jurisdiction and applicable law, you may have rights including:

• Right to be informed;

• Right of access;

• Right to rectification;

• Right to object to certain processing;

• Right to restrict processing;

• Right to data portability;

• Right to erasure or deletion;

• Right to withdraw consent;

• Rights relating to automated decision-making;

• Right to request information about certain data transfers; and

• Right to lodge a complaint with a relevant supervisory authority.

The NDPC identifies rights under the NDP Act including information, access-related rights, rectification, objection, portability, erasure, withdrawal of consent and rights relating to automated decision-making.

These rights are subject to applicable legal exceptions and limitations.

16. NIGERIAN DATA SUBJECT RIGHTS

For individuals whose personal information is subject to Nigerian data-protection law, Megaheadz recognises the rights provided under the applicable provisions of the Nigeria Data Protection Act 2023.

These include, subject to applicable conditions and limitations:

• Being informed about processing;

• Accessing personal information;

• Requesting correction of inaccurate information;

• Objecting to certain processing;

• Requesting restriction of processing;

• Requesting portability where applicable;

• Requesting deletion or erasure where applicable;

• Withdrawing consent where consent is the lawful basis;

• Rights concerning automated decision-making; and

• Lodging a complaint with the Nigeria Data Protection Commission.

The NDPC confirms these categories of data-subject rights under the NDP Act.

17. HOW TO EXERCISE YOUR RIGHTS

To submit a privacy request, contact:

Email: privacy@megaheadzonline.com

Your request should, where possible, include:

• Your name;

• Contact information;

• The nature of your request;

• Relevant account, project or transaction details; and

• Any other information reasonably necessary to help us identify the information concerned.

We may request reasonable information to verify your identity before processing certain requests.

We will respond within the timeframe required by applicable law.

18. DATA PROTECTION OFFICER / PRIVACY CONTACT

Where required by applicable law, Megaheadz will designate an appropriate person or Data Protection Officer to oversee privacy and data-protection matters.

For privacy enquiries, data-subject requests or concerns, contact:

Data Protection / Privacy Contact
Website: www.megaheadzonline.com
Email: privacy@megaheadzonline.com
Address: 12 Arinade Alabi Close, Ojodu Estate

19. CHILDREN’S PRIVACY

Our website and services are not intentionally directed toward children where prohibited by applicable law.

We do not knowingly collect personal information from children without an appropriate legal basis or required parental or guardian involvement.

If you believe that a child has provided personal information to us improperly, please contact us.

20. THIRD-PARTY WEBSITES

Our website may contain links to websites and services operated by third parties.

Megaheadz does not control the privacy practices, security or content of third-party websites.

We recommend reviewing the privacy policy of any third-party website you visit.

21. AUTOMATED DECISION-MAKING AND ARTIFICIAL INTELLIGENCE

Megaheadz may use artificial intelligence, machine-learning and automated technologies as part of certain products, services, research or business processes.

Where personal information is processed using such technologies, we seek to do so in accordance with applicable privacy laws.

We will not intentionally use personal information to make solely automated decisions producing legal or similarly significant effects on individuals where prohibited by applicable law.

Where applicable law provides a right to human intervention, review or objection, we will respect those rights.

22. DATA USED IN AI SERVICES

Where a Megaheadz service involves artificial intelligence or third-party AI platforms, the relevant service may require the processing of information by an AI technology provider.

We will seek to:

• Identify relevant third-party processing where appropriate;

• Avoid submitting unnecessary personal information to AI systems;

• Apply appropriate contractual or organisational safeguards where required; and

• Use personal information only for legitimate and authorised purposes.

Clients should not provide sensitive or confidential personal information to an AI-enabled service unless the relevant service expressly permits such information to be processed.

Additional terms may apply to specific AI-powered services.

23. PRIVACY BY DESIGN

Where reasonably appropriate, Megaheadz seeks to incorporate privacy and security considerations into the design and development of digital products, websites, applications and technology solutions.

This may include:

• Data minimisation;

• Access controls;

• Secure architecture;

• Privacy-aware workflows;

• Appropriate retention mechanisms;

• User consent mechanisms; and

• Security testing and monitoring.

24. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy periodically to reflect:

• Changes in our services;

• Changes in technology;

• Changes in applicable law;

• Regulatory guidance;

• Changes in our data-processing practices; or

• Improvements to our privacy practices.

The updated version will be published on this page with a revised “Last Updated” date.

Where required by law, we will provide additional notice or obtain consent for material changes.

25. CONTACT US

For privacy questions, data-subject requests or concerns, please contact:

Megaheadz Studios
Website: www.megaheadzonline.com
Email: privacy@megaheadzonline.com
Address: 12 Arinade Alabi Close, Ojodu Estate

For individuals in Nigeria, complaints concerning data-protection rights may also be directed to the Nigeria Data Protection Commission (NDPC), the statutory data-protection regulator established under the Nigeria Data Protection Act 2023.

© Megaheadz Studios. All rights reserved.