Privacy Policy

This Privacy Policy explains how Catalyst Business Consult (“we”, “us”, “our”), operator of the Catalyst Mentoring Programme (“CMP”), collects, uses, shares and protects your personal data when you apply for, or take part in, the programme through this website.

We process personal data in line with the Nigeria Data Protection Act 2023 (NDPA) and the directives of the Nigeria Data Protection Commission (NDPC). For the purposes of that law, Catalyst Business Consult is the data controller of the personal data described below.

1. The personal data we collect

Depending on how you use CMP, we collect:

• Identity & contact details — your full name, email address and phone number.
• Account credentials — a password, which is stored in encrypted (hashed) form by our authentication provider. We never see or store your password in plain text.
• Application information — your business or brand name, the stage of your business, your goals for the programme, and your chosen payment plan.
• Learning activity — for enrolled mentees: your progress through lessons, quiz answers and scores, written or uploaded assignment submissions, and any session feedback you give.
• Photographs — where you have given your consent, we may publish photographs of you from programme events in the gallery on our website.
• Technical data — cookies needed to keep you logged in, and basic sign-in records such as the date of your last login.

We do not collect or store card or bank-account details. Programme fees are paid by direct bank transfer, which happens outside this website.

2. How and why we use your data

We use your personal data for the following purposes and legal bases:

• To assess your application and, if successful, enrol and deliver the programme to you — performance of a contract, or steps taken at your request before entering a contract.
• To create and secure your account and give you access to your dashboard and course content — performance of a contract.
• To send you programme-related emails, such as application updates, approval notices and reminders — performance of a contract and our legitimate interest in running the programme.
• To notify our team when a new application is received, and to review it — our legitimate interest in administering the programme.
• To publish event photographs in our gallery — your consent, which you may withdraw at any time.
• To meet legal, accounting and regulatory obligations — compliance with a legal obligation.

Decisions about your application are made by our team. We do not make decisions about you by solely automated means.

3. Who we share your data with

We do not sell your personal data. We share it only with trusted service providers who process it on our behalf, under contract, to run this platform:

• Supabase — our database, authentication and file storage provider.
• Vercel — hosts and serves this website.
• Resend — sends our transactional and notification emails.

We may also disclose personal data where required by law, regulation or a valid request from a competent authority.

4. International transfer of your data

The service providers above store and process data on servers located outside Nigeria. This means your personal data may be transferred to, and held in, other countries. Where we transfer your data abroad, we do so on the basis that the transfer is necessary to provide the service to you and with appropriate safeguards, consistent with the NDPA’s rules on cross-border transfers. By using the platform, you acknowledge this transfer.

5. Cookies

We use only strictly necessary cookies — chiefly to keep you securely signed in and to remember your session. These are required for the site to function and do not track you for advertising. If we introduce analytics or other non-essential cookies in future, we will ask for your consent first.

6. How long we keep your data

We keep your account and learning data for as long as you have an active account with us. If your application is unsuccessful, we retain your application data for up to 12 months and then delete it, unless we are required to keep it longer for legal reasons. You can ask us to delete your data at any time (see your rights below).

7. Your rights

Under the NDPA, you have the right to:

• access the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• have your data deleted (“right to be forgotten”);
• restrict or object to how we use your data;
• receive your data in a portable format;
• withdraw your consent at any time, where we rely on consent; and
• not be subject to a decision based solely on automated processing.

To exercise any of these rights, email us at catalyst@catalystbusinessconsult.com. We will respond within the timeframe required by law.

8. How we protect your data

We apply reasonable technical and organisational measures to keep your data safe. These include encryption in transit (HTTPS), hashed storage of passwords, role-based access controls so that only authorised staff and mentors can see the data they need, private storage for uploaded files, and database-level security rules that restrict access to your own records.

9. Children

CMP is intended for adults (18 years and older). We do not knowingly collect the personal data of children. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Complaints

If you have a concern about how we handle your personal data, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. Significant changes will be communicated where appropriate.

12. Contact us

For any questions about this policy or your personal data, contact our data protection contact:

Catalyst Business Consult
Email: catalyst@catalystbusinessconsult.com
Lagos, Nigeria