PRIVACY POLICY
COLLECTION AND USE OF PERSONAL INFORMATION
Personal information is data that can be used to identify or contact a single person.
Last updated: September 10, 2026
1. Introduction and Scope
A.G. Leventis (Nigeria) Limited (“AGL”, “we”, “us” or “our”) is committed to protecting the privacy and personal data of individuals who interact with us. This Website Privacy Policy explains how AGL collects, uses, discloses, stores, protects and otherwise processes personal data in accordance with the Nigeria Data Protection Act 2023 (NDP Act), the Nigeria Data Protection Act (General Application and Implementation Directive) 2025 (GAID), applicable guidance issued by the Nigeria Data Protection Commission (NDPC), and other applicable data-protection requirements.
This Policy applies to personal data processed by AGL in connection with its website and broader interactions with customers, prospective customers, website visitors, business contacts, vendors, service providers, visitors to our premises, job applicants and other individuals who interact with AGL. Personal data may be collected through our website, business transactions, recruitment and employment processes, supplier or contractor relationships, physical visits to our premises, electronic communications, meetings and other lawful business activities.
This Policy is intended to provide transparency about AGL’s processing of personal data. It does not mean that consent is the lawful basis for every processing activity. AGL relies on the lawful basis appropriate to the particular purpose and circumstances of the processing.
HOW WE USE YOUR PERSONAL INFORMATION
A.G. Leventis (Nigeria) Limited is a Nigeria-based company with business activities that include real estate, fleet solutions/logistics, and the sale and support of commercial vehicles and related equipment. AGL’s official/public address is 2 Wharf Road, Apapa, Lagos, Nigeria. For personal data processed for its own business purposes, AGL generally acts as a data controller and determines the purposes and means of processing.
3. Key Definitions
Personal Data means information relating to an identified or identifiable natural person.
Sensitive Personal Data includes categories of personal data that receive additional protection under applicable law, including, where applicable, health information, biometric or genetic data, racial or ethnic origin, religious or philosophical beliefs, trade union membership, sex life or sexual orientation, and other categories recognised under applicable law.
Processing includes operations performed on personal data such as collection, recording, organisation, storage, alteration, consultation, use, disclosure, transmission, restriction, deletion or destruction.
4. Personal Data We May Collect
The personal data AGL may collect depends on the nature of the relationship or interaction. Categories may include the following, where applicable:
| Category | Examples |
| Identity information | Names, photographs and, where applicable to the relevant process, government-issued identification information such as National Identification Number, passport or driver’s licence details. |
| Contact information | Residential or business address, email address and telephone number. |
| Employment and applicant information | Curriculum vitae, qualifications, employment history and, where applicable to the employment relationship, payroll and pension information. |
| Financial and regulatory information | Bank/payment information, tax identification information and other information required for relevant transactions or legal obligations. |
| Website and technical information | IP address, browser/device information, cookies, server logs and website usage information. |
| Security and access information | CCTV footage, visitor information and access-control records where such systems are used. |
| Business and professional information | Customer/vendor details, contractual information, correspondence, transaction information and professional/business contact information. |
AGL may also process sensitive personal data where this is necessary for a lawful purpose and where an appropriate lawful basis and any additional condition required by applicable law have been established. Appropriate safeguards will be applied.
5. How We Collect Personal Data
AGL may obtain personal data directly from you, from your employer or organisation, through contractual and business engagements, recruitment processes, physical forms, meetings, electronic communications, our website, CCTV or access-control systems, public records, regulatory authorities, authorised representatives, service providers and other lawful third-party sources.
6. Why We Process Personal Data and Our Lawful Bases
| Purpose of Processing | Lawful Basis, as applicable |
| Responding to enquiries, requests and quotations; managing customer and business relationships | Steps requested before entering into a contract; performance of a contract; legitimate interests. |
| Providing products, services and support; administering transactions and contracts | Performance of a contract; legal obligation; legitimate interests. |
| Vendor and supplier administration | Performance of a contract; legal obligation; legitimate interests. |
| Recruitment, employment and workforce administration | Steps requested before entering into a contract; performance of a contract; legal obligation; legitimate interests; consent where specifically appropriate. |
| Payroll, pension, tax and other statutory administration | Performance of a contract; legal obligation and other applicable lawful basis. |
| Security, access control, fraud prevention and protection of people, premises, systems and assets | Legitimate interests; legal obligation or another applicable lawful basis. |
| Health and safety, incident management and emergency response | Legal obligation; vital interests; legitimate interests or another applicable lawful basis. |
| Legal, regulatory, audit, tax, compliance, litigation, investigation and record-keeping requirements | Legal obligation; legitimate interests; establishment, exercise or defence of legal claims, where applicable. |
| Website operation, website security, cookies and similar technologies | Legitimate interests and/or consent, depending on the technology and processing involved. |
| Marketing communications and related engagement | Consent and/or legitimate interests, where permitted and appropriate. |
Where AGL relies on legitimate interests, AGL will assess the purpose and necessity of the processing and balance its legitimate interests against the rights, freedoms and reasonable expectations of the affected individual. The assessment will be documented where appropriate.
7. Consent
Where consent is the applicable lawful basis, AGL will obtain appropriate consent before carrying out the relevant processing. Consent will be specific to the identified purpose and will not be treated as the lawful basis where another lawful basis properly applies.
Where processing is based on consent, you may withdraw that consent at any time by contacting the Data Protection Officer at dpo@agleventis.com. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.
8. Cookies and Similar Technologies
AGL’s website uses cookies and similar technologies to support the operation, security and functionality of the website. Cookies are small pieces of information stored on or associated with a user’s device when visiting a website.
Some cookies are necessary to support website functionality. The website also uses cookies to record and manage visitors’ cookie-consent choices, including whether a visitor has accepted or declined optional cookies.
The website may use third-party technologies for specific functions. Where such technologies use cookies or otherwise process personal data, AGL will provide appropriate information and, where required, obtain or respect the visitor’s cookie preferences before optional cookies are activated.
Visitors may accept or decline optional cookies and, where applicable, manage their preferences through the cookie controls provided on the website.
AGL will keep its cookie disclosures and preference controls under review so that they reflect the technologies actually deployed on the website.
9. Disclosure and Sharing of Personal Data
AGL will not pass on your personal data to third parties without first obtaining your consent, except where the disclosure is otherwise permitted or required by law, necessary for the performance of a contract or requested service, or supported by another applicable lawful basis.
Where lawful and necessary, categories of recipients may include AGL affiliates, authorised service providers and data processors, professional advisers, external legal advisers, auditors, insurers, financial institutions, cloud or technology service providers, regulators, government agencies, law-enforcement authorities, courts or tribunals, and relevant business counterparties.
Where a third party processes personal data on behalf of AGL, AGL will put in place an appropriate Data Processing Agreement or other applicable data-protection contractual terms and will seek reasonable assurance that the processor maintains appropriate technical and organisational measures to protect personal data.
10. International and Cross-Border Transfers
Where personal data is transferred outside Nigeria, AGL will ensure that the transfer is carried out in accordance with the NDP Act and other applicable requirements. Depending on the circumstances, this may include reliance on an applicable adequacy basis, contractual safeguards or approved data-protection clauses, binding corporate rules, approved codes of conduct or certification mechanisms, or another lawful transfer mechanism recognised under applicable law.
AGL will document the applicable transfer basis and safeguards for relevant cross-border processing activities. Further information about applicable safeguards may be requested from the Data Protection Officer.
11. Data Retention and Secure Disposal
AGL will retain personal data only for as long as reasonably necessary for the purpose for which it was collected and to meet applicable legal, regulatory, contractual, audit, security and legitimate business requirements. Retention periods may vary according to the category of data and processing activity and will be managed in accordance with AGL’s approved retention requirements.
When personal data is no longer required, AGL will take appropriate steps to securely delete, destroy or anonymise it, subject to applicable legal or regulatory retention obligations.
12. Security Measures
AGL implements appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, unlawful destruction, alteration, disclosure or misuse. Depending on the processing and associated risk, such measures may include access controls, authentication and password controls, secure storage, encryption where appropriate, confidentiality obligations, security monitoring, backup and recovery arrangements, and periodic security assessments. AGL reviews its safeguards in light of the nature of the personal data, the processing activity and reasonably foreseeable risks.
13. Your Data Protection Rights
Subject to applicable conditions and exemptions under the NDP Act and other applicable law, you may have the right to:
- request access to personal data AGL holds about you and obtain information about its processing;
- request correction of personal data that is inaccurate or incomplete;
- request erasure of personal data where the applicable legal conditions are satisfied;
- request restriction of processing in applicable circumstances;
- receive or request transfer of personal data where the right to data portability applies;
- object to certain processing, including direct marketing and, where applicable, processing based on legitimate interests;
- withdraw consent at any time where processing is based on consent;
- object to or seek applicable safeguards in relation to certain automated decision-making or profiling; and
- lodge a complaint or seek an appropriate remedy where you are dissatisfied with AGL’s handling of your personal data or privacy request.
Where required by law, AGL will communicate applicable rectification, erasure or restriction actions to relevant recipients of the personal data.
AGL may request information reasonably necessary to verify your identity and understand your request. Any verification requirement will be proportionate to the nature of the request and the personal data involved.
14. Personal Data Breach Management
Where a personal data breach occurs, AGL will investigate and manage the incident in accordance with its applicable incident and data-breach procedures. Where notification is required by law, AGL will notify the Nigeria Data Protection Commission and/or affected individuals within the applicable legal timelines.
15. Children’s Personal Data
AGL’s corporate website is primarily intended for a general adult and business audience and is not designed as a service directed specifically at children. Where AGL has a lawful need to process a child’s personal data, AGL will apply the additional safeguards required by applicable law, including obtaining consent or authorisation from a parent or legal guardian where this is required.
If AGL becomes aware that a child’s personal data has been collected or processed in circumstances that do not comply with applicable requirements, appropriate steps will be taken to address the matter.
16. Third-Party Websites and Services
AGL’s website may contain links to websites or services operated by third parties. AGL does not control the privacy practices of independent third-party websites. Visitors are encouraged to review the applicable privacy information of those third parties before providing personal data to them.
17. Accuracy of Personal Data
AGL takes reasonable steps to keep personal data accurate and, where necessary, up to date. Individuals are encouraged to inform AGL where information held about them is inaccurate or has changed so that appropriate corrections can be made.
18. Changes to This Privacy Policy
AGL may update this Privacy Policy from time to time to reflect changes in legal or regulatory requirements, technology, business operations or AGL’s personal-data processing practices. The latest version will be published on the AGL website with an updated revision date.
19. Contacting the Data Protection Officer
For privacy enquiries, data-protection requests or concerns about AGL’s processing of personal data, please contact:
Contact: Data Protection Officer
Organisation: A.G. Leventis (Nigeria) Limited
Address: 2 Wharf Road, Apapa, Lagos, Nigeria
Email: dpo@agleventis.com
20. Complaints
If you are dissatisfied with how AGL has processed your personal data or handled a privacy request or complaint, you may first contact AGL’s Data Protection Officer using the details above.
You may also, where applicable, lodge a complaint with the Nigeria Data Protection Commission (NDPC) or seek any other remedy available under applicable law.
21. Related Privacy Information
This Website Privacy Policy should be read together with AGL’s Cookie Policy and any specific privacy statement or notice presented at a particular data-collection point, where applicable.
