NexaNet Privacy Policy

Data controller: NexaNet Internet Services, a project of New Born Consult Ltd ("NexaNet", "we", "us", "our").
Effective date: August 1, 2025
Last updated: August 14, 2026

1. Who we are

NexaNet Internet Services is a project of New Born Consult Ltd. We provide internet connectivity and operate the back-office and customer platform used to manage your service, billing, and communications. For the purposes of data-protection law, New Born Consult Ltd is the data controller responsible for your personal data.

Registered address: 2, Hamman Madu Street, Bungalow City, Sabojibi, Abuja.

2. Personal data we collect

Depending on how you use NexaNet, we may collect:

• Identity & contact: your name, email address, and phone number.
• Network & technical: your assigned IP address and device/queue identifiers, your data-usage volumes, connection quality and saturation metrics, and latency/packet-loss diagnostics for network targets. We use these to deliver and maintain your connection.
• Billing & payments: your subscription plan(s), wallet balance and transactions, payment records, virtual bank account details, and payment references. Card details are handled by our payment processor and are not stored by NexaNet.
• Communications: the SMS, WhatsApp, and email messages we send you, together with their delivery status.
• Revenue Participant information (if you are a funding partner): your equity/stake records, investment details, and any withdrawal or transfer requests.
• Audit & security: logs of significant account actions, timestamps, and operational events.

3. How and why we use your data

We use personal data for the following purposes:

• Providing and managing your internet service — provisioning your connection, metering usage, applying throttling, suspension and reconnection through our network routers.
• Billing and payments — processing subscriptions, wallet top-ups, auto-renewals, and accounting/bookkeeping, including tax records.
• Customer support and service communications — sending receipts, alerts, one-time passwords (OTPs), reminders, upgrade suggestions, and win-back or referral messages.
• Network health monitoring — detecting saturation and plan-fit issues proactively to maintain service quality.
• Referral program administration — linking a referrer to a referred customer, where applicable.
• Security, fraud prevention, audit, and compliance — protecting accounts and the network, and meeting our legal and regulatory obligations.

4. Lawful bases for processing

We rely on one or more of the following lawful bases, depending on the activity:

• Performance of a contract — to provide the internet service and account you signed up for, and to bill for it.
• Consent — where you have given it (for example, certain optional communications). You can withdraw consent at any time.
• Legitimate interests — to keep the network healthy and secure, prevent fraud, and improve and communicate about our service, balanced against your rights.
• Legal obligation — to keep accounting and tax records and to comply with applicable laws and lawful requests.

5. Who we share your data with

We share personal data only with the categories of providers we need in order to deliver the service, and only the data necessary for each purpose. These providers process data on NexaNet's behalf under their own terms and applicable agreements:

• A payment processor — for card payments, wallet funding, virtual accounts, and payouts.
• An upstream internet/connectivity provider — for the underlying internet connectivity.
• Network equipment / router systems — for provisioning and managing your connection.
• Communication providers — for SMS, WhatsApp, and email delivery.

We may also disclose personal data to courts, regulators, or law-enforcement authorities where we are legally required to do so, or to establish, exercise, or defend legal claims. We do not sell your personal data.

6. International transfers

Some of the providers described above may operate or store data outside Nigeria. Where personal data is transferred internationally, we take steps to ensure appropriate safeguards are in place, consistent with the NDPA 2023 and applicable data-protection requirements.

7. Data retention

We keep personal data only for as long as it is needed for the purposes described in this policy — that is, for the duration of your service relationship and afterwards as required for accounting, tax, audit, and legal obligations, or to resolve disputes.

• Service and account data: 6 years after account closure or last service activity.
• Billing, payment, and accounting/tax records: 7 years after the end of the financial year in which the transaction occurred.

When data is no longer needed, we delete it or anonymise it.

8. How we protect your data

We apply security measures appropriate to an ISP platform, including:

• Access controls and role-based permissions, so staff can only access the data their role requires.
• Encryption of data in transit over secure connections.
• Restricted staff access to sensitive systems and records.
• Audit logging of significant account actions and operational events.
• Verified payment notifications, so that payment and wallet events are confirmed before being acted on.

No system can be guaranteed to be completely secure, but we work to protect your data and to respond appropriately to any security incident.

9. Cookies and session data

The NexaNet web application uses only standard session and authentication cookies that are necessary to keep you signed in and to keep the service secure (for example, your login session and security tokens). We do not use these cookies for advertising. If this changes, we will update this policy.

10. Your rights

Under Nigeria's Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation (NDPR), and consistent with international best practice (such as GDPR-style rights), you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your data, where applicable;
• Restrict processing in certain circumstances;
• Object to certain processing, including direct-marketing messages;
• Data portability — to receive certain data in a portable format; and
• Withdraw consent at any time, where we rely on consent.

Some rights are subject to conditions and legal limits — for example, we may need to retain certain records for accounting, tax, or legal reasons even after a deletion request.

11. How to exercise your rights, and complaints

To exercise any of these rights, contact us at nexanet@newborn.com.ng or +2347066390100. We may need to verify your identity before acting on a request.

If you are not satisfied with how we handle your data or your request, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).

12. Children's data

NexaNet is intended for account holders and is not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can take appropriate action.

13. Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, notify you through the platform or by message. Material changes will take effect on the stated effective date.

14. Contact us

For any privacy questions or requests, contact:

• NexaNet Internet Services (a project of New Born Consult Ltd)
• Email: nexanet@newborn.com.ng
• Phone: +2347066390100
• Address: 2, Hamman Madu Street, Bungalow City, Sabojibi, Abuja.