Event Privacy Notice

1. Introduction

Nigerian Exchange Group (“we”, “us”, “our” or the “Organisation”) respects your privacy and is committed to protecting your Personal Data.

This Event Privacy Notice (“Notice”) explains how we collect, use, disclose, store and otherwise process Personal Data in connection with conferences, meetings, workshops, webinars, roadshows, stakeholder engagements, training programmes, ceremonies and other events organised, sponsored, co-hosted or supported by us (“Events”).

We process Personal Data in accordance with the Nigeria Data Protection Act 2023 (“NDP Act”), the Nigeria Data Protection Act – General Application and Implementation Directive 2025 (“GAID”), applicable directives and guidance issued by the Nigeria Data Protection Commission (“NDPC” or the “Commission”), and other applicable data protection requirements.

2. Personal Data We May Collect

Depending on the nature of the Event and your participation, we may collect and process Personal Data including:

1. your name, title and contact information, including email address and telephone number;
2. organisation, employer, job title and other professional information;
3. registration, invitation, accreditation and attendance information;
4. information you voluntarily provide when completing registration forms, surveys, questionnaires or feedback forms;
5. photographs, images, audio recordings and video recordings captured during the Event;
6. information relating to your participation in Event sessions, discussions, questions or other activities;
7. dietary, accessibility or other information you voluntarily provide where necessary to accommodate your participation;
8. technical, device and usage information where you participate through an online or virtual Event platform; and
9. other Personal Data reasonably necessary for the organisation, administration, security or delivery of the Event.

We will collect and process only Personal Data that is adequate, relevant and reasonably necessary for the identified purposes.

Where Sensitive Personal Data is required in connection with an Event, we will ensure that the processing is permitted under the NDP Act, GAID and other applicable requirements and that appropriate safeguards are applied.

3. How We Collect Your Personal Data

We may collect Personal Data directly from you when you:

1. register for, attend or participate in an Event;
2. accept an invitation;
3. communicate with us concerning an Event;
4. complete a registration, survey, questionnaire or feedback form;
5. participate in a virtual or hybrid Event; or
6. otherwise interact with us in connection with an Event.

We may also receive your Personal Data indirectly from your employer, organisation, an Event partner or co-host, another person authorised to nominate or register you, or another lawful source.

Where Personal Data has not been obtained directly from you, we will provide the information required under applicable data protection law within the applicable period and in the appropriate manner, unless an applicable exemption applies.

4. Purposes for Which We Process Personal Data

We may process your Personal Data for specified and lawful purposes including:

1. inviting you to and registering you for an Event;
2. confirming and administering your attendance;
3. communicating Event information, updates and logistical arrangements;
4. managing accreditation, identification and access to Event venues or platforms;
5. facilitating your participation in Event activities;
6. processing reasonable accommodation or accessibility requirements;
7. maintaining appropriate attendance and Event records;
8. managing the safety and security of attendees, personnel and Event venues;
9. responding to enquiries and providing Event-related assistance;
10. obtaining feedback and evaluating the effectiveness of Events;
11. documenting and reporting on Events;
12. maintaining appropriate corporate and historical records;
13. complying with applicable legal, regulatory, audit and record-keeping requirements;
14. preventing, detecting or responding to fraud, security incidents or other unlawful activities; and
15. where permitted by applicable law, communicating with you regarding future Events, programmes, initiatives or other relevant activities.

We will not further process your Personal Data for a purpose that is incompatible with the purpose for which it was collected unless such further processing is otherwise permitted by applicable law.

5. Lawful Bases for Processing

We will ensure that each processing activity undertaken in connection with an Event is supported by an appropriate lawful basis.

Depending on the nature, purpose and circumstances of the processing, we may rely upon:

1. Consent – where you have freely given valid consent to processing for one or more specified purposes;
2. Contract – where processing is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into a contract;
3. Legal Obligation – where processing is necessary for compliance with a legal obligation to which we are subject;
4. Vital Interests – where processing is necessary to protect your vital interests or those of another person;
5. Public Interest or Official Authority – where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority; or
6. Legitimate Interests – where processing is necessary for legitimate interests pursued by us or a third party and those interests are not overridden by your fundamental rights, freedoms and interests.

Where consent is relied upon, you may withdraw your consent at any time through an appropriate mechanism made available to you. Withdrawal will not affect the lawfulness of processing undertaken before consent was withdrawn.

We will not treat your registration for or attendance at an Event as blanket consent to all processing activities associated with that Event.

6. Photography, Video, Audio Recording and Event Coverage

Our Events may be photographed, filmed, livestreamed or otherwise recorded. Photographs, video footage, audio recordings and other images or recordings capable of identifying an individual constitute Personal Data and will be processed in accordance with applicable data protection requirements.

Where photography, filming or recording is intended to take place, we will take reasonable steps to put attendees on notice. This may be done through Event invitations, registration materials, Event webpages, announcements, signage displayed at entrances or within the Event venue, or other appropriate means.

Images and recordings captured during an Event may, where lawfully permitted, be used for purposes including:

1. documenting and reporting on the Event;
2. maintaining appropriate corporate or historical records;
3. reporting on our programmes, initiatives and activities;
4. publication in appropriate corporate reports, newsletters or publications;
5. publication on our website or corporate communication channels; and
6. other journalistic, informational or communication purposes permitted under applicable law.

Participation in a public Event may, in circumstances recognised under the GAID, constitute implied or constructive consent to the use of images captured at that Event for the purpose of reporting on the Event or other purposes permitted under the NDP Act, provided applicable safeguards are observed.

We will not rely solely on participation in an Event to use an attendee’s image for profit-oriented or commercial advertising purposes where express consent is required. Where express consent is required for a particular use of an attendee’s photograph, image, voice or recording, we will obtain such consent through an appropriate mechanism.

We will also take reasonable steps to ensure that images selected and used in connection with Event reporting do not portray attendees in an inappropriate, misleading or adverse manner.

Where reasonably practicable, an attendee who has a concern about photography, filming or recording may notify an Event representative or contact us using the details contained in this Notice so that appropriate measures can be considered.

7. Future Events and Direct Marketing Communications

Registration for or attendance at an Event does not, by itself, constitute consent to receive unrelated direct marketing communications.

Where we intend to use your Personal Data to send direct marketing communications and consent is the appropriate or required lawful basis, we will provide you with a clear and separate opportunity to indicate your preference.

Where consent is relied upon, refusal to provide marketing consent will not prevent you from registering for or participating in the Event unless the relevant processing is genuinely necessary for the Event.

You may withdraw your marketing consent or exercise your applicable right to object to direct marketing at any time, including through an unsubscribed mechanism contained in the relevant communication or by contacting us.

8. Sharing Your Personal Data

Where supported by an appropriate lawful basis and reasonably necessary for an identified purpose, we may share relevant Personal Data with categories of recipients including:

1. Event organisers, co-hosts and partners;
2. Event venues and Event management providers;
3. registration and accreditation service providers;
4. technology, communications and virtual Event platform providers;
5. security and access-control providers;
6. photographers, videographers and other media service providers;
7. professional advisers and other authorised service providers; and
8. regulatory, governmental, judicial or law-enforcement authorities where disclosure is required or permitted by applicable law.

We will take reasonable steps to ensure that Personal Data disclosed to third parties is adequate, relevant and limited to what is reasonably necessary for the particular purpose.

We do not sell Personal Data collected in connection with our Events.

 

9. Third-Party Data Processors

Where we engage a third party to process Personal Data on our behalf in connection with an Event, we will undertake appropriate due diligence having regard to the nature and risks of the processing.

Such processing will be governed by an appropriate written agreement or other legally binding arrangement, as required by applicable law. The arrangement will contain appropriate provisions relating to data protection, confidentiality, security, processing instructions, Data Subject rights, Personal Data Breaches, retention and deletion, sub-processing and international transfers, as applicable.

We will take reasonable steps to ensure that Data Processors engaged by us implement appropriate technical and organisational measures and process Personal Data only for authorised purposes and in accordance with our documented instructions, except where otherwise required by law.

10. International Transfers

Where Personal Data collected in connection with an Event is transferred, stored, accessed or otherwise processed outside the Federal Republic of Nigeria, we will ensure that the transfer is undertaken in accordance with the applicable cross-border transfer requirements of the NDP Act and GAID.

Where required, we will establish and document an appropriate basis or transfer mechanism and implement applicable safeguards before undertaking the transfer.

11. Security of Personal Data

We implement appropriate technical and organisational measures designed to protect Event-related Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, access or other unlawful processing.

Depending on the nature and risks of the processing, these measures may include appropriate access controls, authentication mechanisms, secure storage and transmission, confidentiality requirements, information-security controls and incident-management procedures.

Access to Event-related Personal Data will, where appropriate, be limited to authorised personnel and service providers who require such access for specified and legitimate purposes.

12. Data Protection Impact Assessments

Where an Event or an associated processing activity is likely to result in a high risk to the rights and freedoms of Data Subjects by virtue of its nature, scope, context or purposes, we will conduct a Data Protection Impact Assessment (“DPIA”) prior to undertaking the relevant processing, as required by applicable law.

The DPIA will assess the necessity and proportionality of the processing, relevant risks to Data Subjects and appropriate safeguards and measures for addressing identified risks.

13. Retention of Personal Data

We will retain Personal Data collected in connection with an Event only for as long as reasonably necessary to fulfil the purposes for which it was collected and to satisfy applicable legal, regulatory, contractual, audit, record-keeping and legitimate business requirements.

Different categories of Event-related Personal Data may be subject to different retention periods depending on the purposes for which they are processed and applicable legal or regulatory requirements.

When Personal Data is no longer required, it will be securely deleted, destroyed or anonymised in accordance with our applicable data retention requirements.

14. Your Data Protection Rights

Subject to the NDP Act and other applicable law, you may have the right to:

1. obtain information concerning the processing of your Personal Data;
2. request access to your Personal Data;
3. request rectification of inaccurate or incomplete Personal Data;
4. request erasure of Personal Data in appropriate circumstances;
5. request restriction of processing in appropriate circumstances;
6. object to certain processing, including processing for direct marketing;
7. withdraw consent where processing is based on consent;
8. request portability of your Personal Data where applicable;
9. obtain information regarding recipients or categories of recipients to whom your Personal Data has been or may be disclosed;
10. exercise applicable rights concerning automated decision-making; and
11. lodge a complaint regarding the processing of your Personal Data.

The exercise of these rights may be subject to applicable statutory conditions, limitations or exemptions.

15. Complaints and Right to Lodge a Complaint with the NDPC

If you have a concern regarding the manner in which we process your Personal Data, we encourage you to contact us using the details below so that we can review and respond to your concern.

You also have the right, subject to applicable law, to lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe that the processing of your Personal Data infringes applicable data protection requirements.

16. Contact Us

If you have questions concerning this Notice, the processing of your Personal Data in connection with an Event or wish to exercise your Data Subject rights, please contact:

1. Data Protection/Compliance Team
2. Nigerian Exchange Group
3. Nigerian Exchange House, 2/4 Custom Street, Marina, Lagos
4. Email: dataprotectionoffice@ngxgroup.com
5. Telephone: +234 (700) 225-5649

 

17. Changes to this Notice

We may review and update this Event Privacy Notice periodically to reflect changes in our processing activities, applicable law, regulatory requirements or our data protection practices.

The current version of this Notice will be made available through our website, relevant Event registration page or another appropriate communication channel.