Data Rights & Privacy Requests
Table of Contents
Purpose and Scope
This Data Rights & Privacy Requests Policy (“Policy”) establishes the procedures through which individuals may exercise rights relating to personal data processed by Sizzle Social.
This Policy applies to personal data processed by Sizzle Digital Technologies in connection with the operation of Sizzle Social, including personal data relating to registered Users, website visitors, customers, payers, support contacts, API users, resellers, prospective customers, business contacts, applicants and other identifiable natural persons whose personal data is processed by Sizzle Social.
This Policy is intended to give effect to applicable rights arising under the Nigeria Data Protection Act 2023 (“NDP Act”), applicable regulations and directives of the Nigeria Data Protection Commission (“NDPC”), and other privacy laws that may apply to particular processing activities.
This Policy shall be read together with the Sizzle Social Privacy Policy, Cookie Policy, Terms of Service and other policies published through the Sizzle Social Legal Centre.
Nothing in this Policy shall operate to restrict or waive a privacy right that cannot lawfully be excluded.
Data Controller
Sizzle Social and Sizzle Digital Technologies
Sizzle Social is operated under Sizzle Digital Technologies.
Where Sizzle Digital Technologies determines the purposes and means by which personal data is processed through Sizzle Social, it acts as the relevant data controller for purposes of applicable data-protection law.
Privacy enquiries and rights requests may be submitted through the request procedure set out in this Policy.
Contact Email: contact@sizzlesocial.ng
Website: https://sizzlesocial.ng
Where a dedicated Data Protection Officer or additional privacy contact is formally designated and published by Sizzle Social, the applicable contact details may also be made available through this page and the Privacy Policy.
Meaning of a Data Rights Request
Formal Exercise of a Privacy Right
A “Data Rights Request”, “Privacy Rights Request” or “Data Subject Request” means a request through which an identifiable natural person seeks to exercise a right relating to personal data processed about that person.
A Data Rights Request may concern one or more of the following matters:
confirmation that personal data is being processed;
access to personal data;
information about processing;
correction of inaccurate information;
completion of incomplete information;
erasure or deletion;
restriction of processing;
objection to processing;
objection to direct marketing;
withdrawal of consent;
data portability;
automated decision-making;
information about the source of personal data;
information about recipients of personal data;
information about international transfers;
information about retention;
a privacy complaint; or
another applicable data-protection right.
A general enquiry about Sizzle Social’s Privacy Policy shall not necessarily constitute a formal Data Rights Request unless the communication reasonably indicates that the individual intends to exercise a privacy right.
Who May Exercise Data Rights
Natural Persons
Data-protection rights generally attach to identifiable natural persons.
A registered Sizzle Social User may therefore exercise applicable rights concerning personal data held in connection with that User’s Account.
The same principle may apply to a person who does not maintain a registered Sizzle Social Account but whose personal data is nevertheless processed by Sizzle Social.
This may include, where applicable:
website visitors;
payers;
support contacts;
business representatives;
applicants; and
other identifiable individuals.
Companies and Organisations
A company, partnership or other legal entity does not ordinarily exercise personal-data rights in its own corporate capacity.
However, an individual associated with that organisation may exercise rights concerning personal data relating to that individual.
For example, a director may have rights concerning the director’s personal contact information even where the information appears in a business Account.
Authorised Representatives
A Data Subject may authorise another person to submit a request on the Data Subject’s behalf.
Where a request is submitted through a representative, Sizzle Social may require reasonable evidence establishing:
the identity of the Data Subject;
the identity of the representative;
the representative’s authority to act;
the scope of that authority; and
any additional information reasonably necessary to prevent unauthorised disclosure.
Sizzle Social may communicate directly with the Data Subject where necessary to verify the authority granted to the representative.
Right to Be Informed
Information About Personal Data Processing
A Data Subject is entitled to receive appropriate information concerning how and why personal data is processed.
Sizzle Social provides primary transparency information through its Privacy Policy and other relevant privacy notices.
Depending upon the processing concerned, information may include:
the identity of the data controller;
the categories of personal data processed;
the purposes of processing;
applicable lawful bases;
categories of recipients;
international transfers;
applicable retention periods or retention criteria;
applicable privacy rights;
automated decision-making where relevant; and
available complaint mechanisms.
Additional transaction-specific or processing-specific notices may be provided where appropriate.
Right of Access
Confirmation of Processing
A Data Subject may request confirmation as to whether Sizzle Social is storing or otherwise processing personal data concerning that individual.
Where qualifying personal data is being processed, the Data Subject may request access to that personal data and relevant information concerning the processing.
Information Available Through an Access Request
Subject to applicable law, a qualifying access request may include information concerning:
the purposes for which the personal data is processed;
the categories of personal data concerned;
recipients or categories of recipients to whom the data has been or may be disclosed;
recipients located in third countries or international organisations where applicable;
the period for which the personal data is expected to be retained;
the criteria used to determine retention where a specific period cannot reasonably be stated;
the existence of rights to rectification, erasure, restriction or objection;
the right to complain to the NDPC;
available information concerning the source of personal data not collected directly from the Data Subject; and
the existence, significance and envisaged consequences of qualifying automated decision-making or profiling.
The applicable response shall depend upon the personal data actually held by Sizzle Social and the legal circumstances of the request.
Copies of Personal Data
Where required by applicable law, Sizzle Social shall provide a copy of qualifying personal data in a commonly used electronic format.
A right of access is a right to the Data Subject’s personal data. It shall not automatically create an unrestricted right to copies of every document, database, internal record, source code, confidential commercial record or third-party information in which the Data Subject’s personal data happens to appear.
Sizzle Social may satisfy an access right by providing the relevant personal data in a form that communicates the information without unnecessarily disclosing unrelated confidential information.
Right to Rectification
Correction of Inaccurate Personal Data
A Data Subject may request correction of personal data that is inaccurate, out of date, incomplete or misleading.
Where the disputed information can be corrected through ordinary Account functionality, Sizzle Social may direct the Data Subject to that functionality where doing so provides an effective means of correction.
Where direct self-service correction is unavailable or inappropriate, the request may be processed through the Data Rights procedure.
Evidence Supporting a Correction
Where the accuracy of information is reasonably disputed, Sizzle Social may request supporting information sufficient to determine the correct record.
The level of evidence required shall be proportionate to:
the nature of the information;
the significance of the requested change;
the risk of fraudulent alteration;
the availability of other verification methods; and
the consequences of making an inaccurate correction.
A correction request shall not be denied merely because the requested information is inconvenient to update.
Right to Erasure
Requests for Deletion of Personal Data
A Data Subject may request erasure of personal data where the applicable legal conditions are satisfied.
Personal data shall be considered for erasure where, among other applicable circumstances:
the personal data is no longer necessary for the purpose for which it was collected or processed;
consent has been withdrawn and no other lawful basis applies;
the Data Subject validly objects to processing and there is no overriding lawful ground for continuation;
the personal data has been unlawfully processed; or
erasure is required to comply with an applicable legal obligation.
Where erasure is legally required, Sizzle Social shall take reasonable steps to erase the relevant personal data without undue delay.
The Right to Erasure Is Not Absolute
A request for deletion shall not require Sizzle Social to erase information that Sizzle Social remains lawfully required or entitled to retain.
Depending upon the circumstances, continued retention may be necessary for:
compliance with a legal obligation;
accounting or tax requirements;
payment reconciliation;
fraud prevention;
cybersecurity;
chargeback defence;
investigation of abuse;
dispute resolution;
establishment, exercise or defence of legal claims;
enforcement of contractual rights;
regulatory requirements; or
another lawful basis recognised under applicable law.
Where only part of the requested information must be retained, Sizzle Social may erase other information that no longer requires retention.
Deletion and Account Closure
Account closure and statutory erasure are distinct processes.
Closure of a Sizzle Social Account may prevent further ordinary use of the Account but shall not automatically require immediate destruction of every record associated with that Account.
Transaction, security, payment, tax, dispute and other records may continue to be retained where a lawful basis exists.
Backups and Technical Copies
Where personal data qualifying for erasure remains temporarily within backups, archival systems or disaster-recovery systems that cannot reasonably be altered immediately without affecting system integrity, Sizzle Social may retain the information until deletion occurs through the applicable backup lifecycle.
During such period, the information shall remain subject to appropriate security and shall not be restored to ordinary active processing except where legitimately necessary, including for disaster recovery, security, compliance or legal purposes.
Right to Restriction of Processing
Temporary Restriction
A Data Subject may request restriction of qualifying processing where applicable.
Restriction may be appropriate while:
the accuracy of disputed personal data is being verified;
an objection is being considered;
processing is alleged to be unlawful but erasure is opposed;
Sizzle Social no longer requires the personal data for ordinary processing but the Data Subject requires it for legal claims; or
another circumstance recognised by applicable law applies.
Restriction does not necessarily require physical deletion of the information.
It may instead require limiting the purposes for which the information may be actively processed during the relevant period.
Permitted Processing During Restriction
Where processing is restricted, Sizzle Social may continue to store the information and may process it to the extent permitted by law, including where necessary for:
legal claims;
protection of the rights of another person;
legal obligations;
regulatory requirements; or
another applicable exception.
Right to Withdraw Consent
Withdrawal Where Consent Is the Lawful Basis
Where a processing activity relies upon consent, the Data Subject may withdraw that consent at any time.
Sizzle Social shall seek to make withdrawal as accessible as the method through which consent was originally provided.
Withdrawal of consent shall apply prospectively.
It shall not render unlawful processing that was lawfully undertaken before withdrawal.
Processing Based on Other Lawful Grounds
Withdrawal of consent shall not require Sizzle Social to cease processing that is independently authorised by another lawful basis.
For example, withdrawal of marketing consent does not necessarily require deletion of transaction information lawfully retained for accounting, fraud prevention, contractual, tax or legal purposes.
Where processing continues on another lawful basis after consent has been withdrawn, the continuing basis shall be capable of being identified and justified.
Right to Object to Processing
General Objection
A Data Subject may object to the processing of personal data relating to that Data Subject where the applicable legal conditions are satisfied.
Where an objection applies, Sizzle Social shall discontinue the relevant processing unless Sizzle Social can establish an applicable lawful justification for continuing, including compelling legitimate grounds or another basis recognised by law.
The assessment may take into account:
the nature of the processing;
Sizzle Social’s lawful basis;
the interests advanced by the processing;
the impact upon the Data Subject;
the Data Subject’s rights and freedoms; and
any applicable legal obligation.
Direct Marketing Objections
Where personal data is processed for direct marketing purposes, a Data Subject may object at any time.
Following a valid direct marketing objection, the relevant personal data shall no longer be processed for that direct marketing purpose.
This includes profiling to the extent that the profiling relates to the relevant direct marketing.
Sizzle Social may retain limited information necessary to maintain an opt-out or suppression record so that the objection can continue to be honoured.
Marketing Unsubscribe Requests
Unsubscribing From Promotional Communications
An unsubscribe request concerning marketing communications may be exercised through the unsubscribe functionality made available in applicable communications or through a Privacy Request.
Unsubscribing from marketing shall not ordinarily prevent communications that are reasonably necessary for:
Account administration;
transaction confirmation;
payment processing;
Order updates;
security;
refunds;
customer support;
policy notices;
regulatory matters; or
another non-marketing purpose supported by an appropriate lawful basis.
A marketing unsubscribe shall not be interpreted as a request to close the Account or erase all personal data unless the Data Subject expressly requests those separate actions.
Right to Data Portability
Portable Personal Data
Where the applicable conditions for portability are satisfied, a Data Subject may request personal data in a structured, commonly used and machine-readable format.
Portability may permit the Data Subject to transmit qualifying personal data to another data controller.
Where technically possible and legally applicable, a Data Subject may request direct transmission between controllers.
Scope of Portability
Data portability shall apply only to personal data falling within the applicable legal scope of the right.
It shall not require Sizzle Social to:
disclose proprietary algorithms;
disclose another person’s personal data without a lawful basis;
provide information that is not subject to portability;
create technical interoperability that is not reasonably available; or
compromise the rights and freedoms of another person.
Where only part of a dataset is portable, Sizzle Social may provide the qualifying portion.
Automated Decision-Making and Profiling
Qualifying Automated Decisions
A Data Subject has rights in relation to certain decisions based solely on automated processing, including profiling, where the decision produces legal effects or similarly significant effects concerning that Data Subject.
Not every automated Sizzle Social process constitutes such a decision.
Routine processes may include:
Order routing;
transaction-status updates;
fraud indicators;
technical monitoring;
authentication controls; and
Service automation.
The fact that software is involved shall not, by itself, establish that a process constitutes qualifying automated decision-making.
The relevant legal effect and degree of human involvement shall determine whether the statutory protection applies.
Permitted Automated Decisions
Applicable law may permit a qualifying automated decision where, for example, it is:
necessary for entering into or performing a contract;
authorised by written law containing appropriate safeguards; or
authorised by the Data Subject’s valid consent.
Where such a decision is lawfully undertaken, applicable safeguards shall be maintained.
Human Intervention and Challenge
Where required by applicable law, a Data Subject affected by a qualifying automated decision may be entitled to:
obtain human intervention;
express the Data Subject’s point of view; and
contest the decision.
A request concerning automated decision-making should identify the decision or Account activity concerned to enable appropriate investigation.
Right to Information About Data Sources
Data Not Obtained Directly From the Data Subject
Where Sizzle Social processes personal data that was not collected directly from the Data Subject, the Data Subject may request available information concerning the source of that personal data, subject to applicable limitations and exemptions.
Sources may include, depending upon the relevant activity:
Payment Providers;
banks;
Service suppliers;
referral systems;
publicly accessible social media information;
security providers;
business partners;
authorised representatives; or
other lawful sources.
Sizzle Social shall not fabricate source information where the source cannot reasonably be identified.
Right to Information About Recipients
Recipients and Categories of Recipients
A qualifying access request may seek information concerning recipients or categories of recipients to whom personal data has been or may be disclosed.
The relevant response may identify categories such as:
hosting and infrastructure providers;
Payment Providers;
email or communication providers;
social media Service suppliers;
security providers;
professional advisers;
regulators;
law-enforcement authorities; or
other recipients applicable to the relevant processing.
Where appropriate and legally required, more specific recipient information may be provided.
International Transfer Information
Transfers Outside Nigeria
Where personal data is transferred outside Nigeria, applicable rights may include information concerning:
the fact that the transfer occurs;
the relevant recipient or category of recipient;
the destination where reasonably ascertainable; and
the lawful mechanism or safeguards applicable to the transfer.
International transfers are governed further by the Privacy Policy and, where applicable, the GDPR & International Privacy Rights Policy.
Submitting a Data Rights Request
Permitted Request Channels
A Data Rights Request may be submitted through the privacy-request functionality made available on this page or by email to:
Where submitted by email, the subject line “Data Rights Request” or “Privacy Request” should be used where practicable to assist proper routing.
Failure to use a particular subject line shall not invalidate an otherwise clear Data Rights Request.
Information Required to Process a Request
A request should contain sufficient information to allow Sizzle Social to identify the requester, understand the right being exercised and locate the relevant information.
Relevant information may include:
full name;
registered Sizzle Social email address where applicable;
alternative contact email where necessary;
Account username or identifier where applicable;
type of privacy right being exercised;
description of the personal data or processing concerned;
relevant transaction, Order, ticket or communication reference where applicable;
jurisdiction or country where relevant to determining additional rights;
whether the request is made personally or through an authorised representative; and
any other information reasonably necessary to understand the request.
A Data Subject shall not be required to explain why a statutory right is being exercised unless the reason is relevant to determining whether the right applies.
Identity Verification
Protection Against Unauthorised Disclosure
Sizzle Social shall take reasonable steps to establish that a person exercising a privacy right is the relevant Data Subject or an authorised representative.
Identity verification is necessary because disclosure, correction or deletion of personal information in response to an unauthorised request could itself constitute a privacy or security breach.
Proportionate Verification
Verification shall be proportionate to:
the sensitivity of the requested information;
the nature of the right being exercised;
the risk of impersonation;
whether the requester is already authenticated;
information already held by Sizzle Social; and
the consequences of an incorrect disclosure or alteration.
Where sufficient verification can be achieved through an authenticated Account, registered email or existing information, additional identification should not be requested merely as a routine formality.
Additional Identification
Where reasonable doubt remains concerning identity, Sizzle Social may request additional evidence.
Any identification requested shall be limited to what is reasonably necessary for verification.
Sizzle Social shall not request:
an online-banking password;
banking PIN;
card PIN;
OTP;
cryptocurrency private key;
seed phrase; or
another unrelated authentication secret
for the purpose of processing a Data Rights Request.
Failure to Verify Identity
Where Sizzle Social cannot reasonably establish the identity or authority of the requester, disclosure or alteration of personal data may be withheld until appropriate verification is completed.
The inability to verify identity shall not be used as a pretext to obstruct a valid request where reasonable verification is available.
Requests Concerning Another Person
Third-Party Personal Data
A Data Subject’s right of access shall be balanced against the privacy and other rights of third parties.
Where responsive information contains personal data relating to another person, Sizzle Social may, as appropriate:
redact the third party’s information;
provide a summary;
separate the Data Subject’s information;
seek appropriate consent;
withhold the affected portion; or
adopt another lawful method that protects the rights of all persons concerned.
The presence of third-party information shall not automatically justify refusing the entire request where the Data Subject’s own information can reasonably be provided separately.
Requests Involving Confidential or Protected Information
Rights of Others and Legal Restrictions
A Data Rights Request shall not require disclosure of information where disclosure is prohibited or lawfully restricted.
Depending upon the circumstances, limitations may apply to information protected by:
another person’s privacy rights;
legal professional privilege;
confidentiality obligations;
security requirements;
fraud-prevention requirements;
legal restrictions;
intellectual-property rights;
trade secrets; or
another lawful exemption.
Any restriction shall be applied only to the extent reasonably necessary.
Where practicable, Sizzle Social shall provide non-exempt portions of the requested personal data.
Search for Responsive Personal Data
Reasonable and Proportionate Search
Upon receipt of a valid access request, Sizzle Social shall undertake a reasonable search for personal data within systems reasonably likely to contain responsive information.
Depending upon the request, such systems may include:
Account records;
customer databases;
Wallet and transaction records;
Order history;
support tickets;
refund records;
complaint records;
relevant email communications;
security records;
API records; and
other systems containing personal data within the scope of the request.
The right of access shall not require a search that is technically impossible, legally prohibited or wholly disproportionate where applicable law permits appropriate limitations.
Clarification of Broad Requests
Clarification Where Scope Is Unclear
Where a request is so broad or unclear that Sizzle Social cannot reasonably identify the information sought, Sizzle Social may request clarification.
A request for clarification shall not be used to improperly delay a request that is already sufficiently clear.
Where part of a request can be processed without clarification, Sizzle Social may proceed with that part while seeking clarification concerning the remainder.
Response Period
General Response Standard
Sizzle Social shall process valid Data Rights Requests without unreasonable delay.
As an internal service standard, Sizzle Social shall ordinarily aim to provide a substantive response within 30 days after receipt of a sufficiently clear request and completion of any identity verification reasonably required to process it.
Where additional information necessary to process the request is requested from the Data Subject, the applicable period may be calculated or adjusted in accordance with applicable law.
Complex Requests
Where a request is unusually complex, involves substantial records, contains multiple distinct rights requests or requires consultation with third parties, additional time may be required to the extent permitted by applicable law.
Where the applicable response period must be extended, Sizzle Social shall provide notice where legally required.
Such notice may identify:
the reason for the extension;
the status of the request; and
the expected further response period.
An extension shall not be used merely because a request is inconvenient.
Fees and Costs
Ordinary Requests
Sizzle Social shall not impose an arbitrary fee merely because a Data Subject exercises a statutory privacy right.
Unreasonable Costs
Where providing a copy of personal data would impose unreasonable costs and applicable law permits the Data Subject to bear some or all of such costs, Sizzle Social may seek a reasonable contribution consistent with the legal requirements applicable to the request.
Any charge shall relate to the permitted cost and shall not operate as a penalty designed to deter exercise of the right.
Where a fee is proposed, the Data Subject shall be informed before the relevant charged activity is undertaken where required.
Repetitive, Abusive or Unreasonable Requests
Good-Faith Exercise of Rights
Privacy rights may be exercised without retaliation or obstruction.
A request shall not be treated as abusive solely because:
the Data Subject is dissatisfied with Sizzle Social;
the request may reveal an error;
the Data Subject has made a complaint;
the request concerns a dispute; or
compliance requires administrative effort.
Manifestly Abusive Conduct
Where applicable law permits limitations concerning manifestly unfounded, excessive or abusive requests, Sizzle Social may take proportionate action.
Relevant circumstances may include deliberate and repeated requests having no genuine privacy purpose, requests designed solely to disrupt systems, or repeated requests for identical information where no relevant processing has changed.
Any restriction shall be documented and capable of justification.
Response Format
Electronic Responses
Where a request is submitted electronically, Sizzle Social may ordinarily respond electronically unless:
the Data Subject reasonably requests another available format;
security considerations require another method; or
applicable law requires otherwise.
Personal data supplied electronically may be provided in a commonly used format appropriate to the right exercised.
Secure Delivery
Where a response contains sensitive or substantial personal information, Sizzle Social may use additional security controls, including authenticated access, password-protected files or another reasonable secure-delivery method.
Security credentials for accessing a response should be communicated through an appropriately separate or protected channel where warranted.
Effect of a Successful Rectification Request
Correction of Active Records
Where a rectification request is accepted, relevant active records shall be corrected where reasonably necessary.
Where inaccurate information has been disclosed to a third-party processor or recipient and applicable law requires notification of the correction, reasonable steps shall be taken accordingly.
Historical records shall not necessarily be rewritten where doing so would improperly alter an accurate historical record of what occurred at an earlier time.
Where appropriate, an annotation or corrective record may be used instead.
Effect of a Successful Erasure Request
Deletion or De-Identification
Where erasure is granted, Sizzle Social may comply through appropriate measures including:
deletion;
irreversible anonymisation;
de-identification where legally sufficient;
removal from active systems; or
another method that effectively fulfils the applicable erasure obligation.
The method selected shall depend upon the system and legal requirements concerned.
Third-Party Processors
Where personal data subject to erasure is held by a processor acting on Sizzle Social’s instructions, Sizzle Social shall take reasonable steps required under the applicable processor arrangement and law to communicate the relevant deletion requirement.
Restriction During a Dispute
Preservation Without Ordinary Use
Where a request properly requires restriction while a matter is being resolved, Sizzle Social may preserve the disputed information while limiting ordinary processing.
This may be appropriate where immediate deletion would prejudice the determination of:
an accuracy dispute;
an objection;
a privacy complaint;
a payment dispute;
a legal claim; or
another unresolved right.
Direct Marketing Suppression
Retention of an Opt-Out Record
Where a Data Subject objects to direct marketing, Sizzle Social may retain the minimum information reasonably necessary to maintain a suppression list.
The purpose of the suppression record is to prevent the person from being inadvertently re-added to the marketing activity that the person has rejected.
Such retention shall not authorise the continued use of the information for the rejected marketing purpose.
Fraud, Security and Legal Holds
Rights Requests During Investigations
A Data Rights Request shall not automatically require destruction of information reasonably necessary for:
fraud investigation;
security investigation;
chargeback defence;
enforcement of legal rights;
compliance with a legal obligation;
litigation;
regulatory enquiry; or
preservation pursuant to a lawful hold.
Any continued processing shall remain limited to an appropriate lawful purpose.
The existence of an investigation shall not justify retaining unrelated personal data indefinitely.
Requests Relating to Payment Information
Payment and Financial Records
Privacy rights applying to payment-related information shall be subject to lawful obligations concerning accounting, tax, payment reconciliation, fraud prevention, refunds, disputes and financial record retention.
A request to erase a Sizzle Social Account shall therefore not necessarily result in immediate deletion of all historical:
payment records;
Wallet records;
invoices;
refund records;
chargeback records; or
transaction references.
Such records shall be retained only where an applicable lawful basis exists.
Requests Relating to Social Media Order Information
Order Destinations and Public Identifiers
Sizzle Social may process usernames, public profile URLs, post URLs, video URLs, channel URLs and other destination information in connection with Service Orders.
A request concerning such information shall be assessed according to:
whether the information constitutes personal data relating to the requester;
whether the requester is entitled to exercise rights concerning it;
whether an Order or dispute remains active;
applicable retention requirements; and
other lawful grounds for processing.
The fact that information is publicly accessible shall not automatically prevent it from constituting personal data.
Requests Relating to Another Person's Social Media Account
Authority Over Third-Party Destinations
A Sizzle Social User who purchased a Service for another person’s public social media destination does not automatically acquire authority to exercise statutory privacy rights on behalf of that other person.
Where a Data Rights Request concerns personal data belonging to another identifiable person, Sizzle Social may require evidence of authority or require the relevant Data Subject to make the request directly.
Requests Relating to Digital Accounts
Digital Product Records
Where a request concerns Digital Accounts, Social Logs or another Digital Product, privacy rights shall apply to qualifying personal data processed by Sizzle Social.
A privacy request shall not automatically require Sizzle Social to disclose:
credentials belonging to another User;
supplier trade secrets;
unrelated customer records;
security information;
proprietary sourcing information; or
information whose disclosure would unlawfully affect another person.
Applicable personal data shall nevertheless remain subject to the Data Subject’s statutory rights.
Requests Relating to Cookies
Cookie and Tracking Data
Where Cookie-derived information constitutes personal data, applicable rights may be exercised concerning that information.
A Data Subject seeking to stop future consent-based Cookie processing should also use the applicable Cookie Preference Centre or consent mechanism.
The Cookie Policy governs Cookie consent and withdrawal in greater detail.
Requests Concerning Data Breaches
Information About a Suspected Breach
A person who believes personal data associated with that person may have been involved in a security incident may submit a privacy enquiry or complaint.
Sizzle Social’s statutory breach-notification obligations operate independently from a Data Subject’s request.
Nothing in this Policy requires Sizzle Social to disclose security information where disclosure would create an additional security risk or prejudice a legitimate investigation, except to the extent disclosure is legally required.
No Retaliation for Exercising Privacy Rights
Exercise of Rights
Sizzle Social shall not suspend, terminate, penalise or materially disadvantage a Data Subject solely because the person exercised a legitimate data-protection right or submitted a privacy complaint.
This provision shall not prevent Sizzle Social from taking independent action for:
fraud;
unlawful conduct;
breach of the Terms of Service;
unpaid amounts;
security threats; or
another legitimate reason unrelated to exercise of the privacy right.
Decisions on Data Rights Requests
Full Approval
A request may be fully approved where the requested action is supported by applicable law and no relevant limitation applies.
Partial Approval
A request may be partly fulfilled where one portion is legally available but another portion is subject to a lawful restriction.
For example, certain Account profile information may qualify for deletion while financial transaction records remain subject to lawful retention.
Request for Further Information
Further information may be requested where necessary to:
verify identity;
identify the requested records;
understand the right being exercised;
verify representative authority; or
determine whether an applicable exception applies.
Refusal or Limitation
Where Sizzle Social declines or materially limits a Data Rights Request, the decision shall be based upon an identifiable legal, factual or verification basis.
Where required by law, the response shall provide sufficient information concerning:
the decision;
the relevant reason;
available internal review or complaint procedures; and
applicable rights to complain to the NDPC.
Privacy Complaints
Internal Privacy Complaint
A Data Subject may submit a complaint concerning Sizzle Social’s processing of personal data or handling of a Data Rights Request.
A complaint may concern matters including:
unlawful processing;
excessive data collection;
inaccurate information;
refusal to correct data;
failure to delete qualifying data;
marketing after objection;
ineffective consent withdrawal;
inappropriate disclosure;
unauthorised access;
Cookie tracking;
international transfers;
automated decision-making;
delay in responding to a rights request; or
another alleged privacy violation.
Privacy complaints may be submitted through the privacy-request mechanism or the Complaints & Dispute Resolution Policy.
Right to Complain to the Nigeria Data Protection Commission
External Regulatory Complaint
A Data Subject aggrieved by an action, decision or inaction of a data controller or data processor that is alleged to violate the NDP Act or applicable subsidiary legislation may lodge a complaint with the Nigeria Data Protection Commission.
Sizzle Social’s internal privacy-request or complaint procedure shall not operate as a waiver of that statutory right.
A Data Subject is not required to surrender the right to regulatory redress as a condition of using Sizzle Social.
The Commission may exercise the powers available to it under applicable law, including investigation and enforcement powers.
Other Legal Remedies
Preservation of Legal Rights
Nothing in this Policy shall prevent a Data Subject from exercising another remedy available under applicable law.
The existence of an internal Data Rights process shall not exclude:
regulatory remedies;
judicial remedies;
contractual remedies; or
other legally available rights.
Requests From Individuals Outside Nigeria
Additional International Rights
Sizzle Social is operated from Nigeria and the NDP Act forms the principal framework governing this Policy.
Where another privacy law applies to a particular Data Subject or processing activity, additional rights or procedural requirements may apply.
Such requirements may concern:
response periods;
copies of personal data;
portability;
erasure;
profiling;
international transfers;
representatives;
supervisory complaints; or
restrictions on processing.
Additional information is provided in the GDPR & International Privacy Rights Policy.
Relationship With Other Sizzle Social Policies
Privacy Policy
The Privacy Policy remains the principal notice describing what personal data Sizzle Social processes, why it is processed, lawful bases, recipients, retention, security and international transfers.
This Policy governs the procedures through which applicable rights concerning that processing may be exercised.
Cookie Policy
The Cookie Policy governs Cookies and comparable Tracking Technologies.
Cookie consent may ordinarily be changed through the Cookie Preference Centre.
A Data Rights Request may nevertheless be submitted where Cookie-derived information constitutes personal data or where a wider privacy issue exists.
Account Settings
The availability of an Account setting that permits a User to update information shall not extinguish a statutory right to rectification.
Where appropriate, Sizzle Social may fulfil a simple rectification request by enabling or directing the User to an effective self-service mechanism.
Account Closure
A request to close an Account shall not automatically be interpreted as:
withdrawal of every consent;
objection to every processing activity;
request for statutory erasure;
request for access; or
request for portability.
Where a Data Subject intends to exercise one of those rights, the intention should be stated expressly.
Likewise, a statutory erasure request may result in Account closure where the data required to maintain the Account can no longer lawfully be processed.
Request Records and Retention
Retention of Rights-Request Records
Sizzle Social may retain records concerning Data Rights Requests for an appropriate period where necessary to:
demonstrate compliance;
establish what was requested;
show how the request was handled;
manage subsequent complaints;
defend legal claims;
identify repeated requests; or
comply with regulatory obligations.
Retention of the request record shall not authorise unrelated reuse of the information.
Security of Data Rights Responses
Confidentiality of Disclosures
Personal data disclosed in response to an access or portability request shall be transmitted using security measures proportionate to the nature and sensitivity of the information.
Where a response is made available through an authenticated Account or secure download, access may be time-limited or subject to additional authentication.
Sizzle Social shall not knowingly transmit substantial personal information to a materially different email address without appropriate verification.
Changes to This Policy
Policy Amendments
Sizzle Social may amend this Policy to reflect:
changes in applicable law;
NDPC regulations or guidance;
changes to Sizzle Social systems;
new privacy-request functionality;
operational improvements;
international privacy requirements; or
other legitimate developments.
The Last Updated date shall identify the current published version.
A later amendment shall not be used to retrospectively remove a statutory right that applied when a request arose.
Mandatory Law and Severability
Mandatory Rights Prevail
Where any provision of this Policy conflicts with a mandatory data-protection requirement, the mandatory requirement shall prevail to the extent of the conflict.
The remaining provisions shall continue to apply to the fullest extent permitted by law.
Severability
If any provision of this Policy is determined to be invalid or unenforceable, the remaining provisions shall remain effective.
Any affected provision shall be interpreted or modified only to the extent reasonably necessary to make it lawful while preserving its legitimate purpose.
Contact and Submission Details
Privacy Requests
Formal Data Rights Requests may be submitted using the Privacy Request form provided on this page or through:
Email: contact@sizzlesocial.ng
Suggested Subject: Data Rights Request
A request shall not be invalid merely because the suggested subject line is not used.
General Legal Information
The wider Sizzle Social legal framework is available through the Sizzle Social Legal Centre.
Related policies include:
Preservation of Data Subject Rights
Final Legal Effect
Nothing in this Policy shall be interpreted as:
requiring a Data Subject to waive a statutory privacy right;
authorising Sizzle Social to refuse a valid request merely because compliance is inconvenient;
permitting unnecessary identity collection;
authorising disclosure to an unauthorised requester;
preventing objection to direct marketing;
preventing withdrawal of consent;
eliminating a right to complain to the NDPC;
validating processing that is otherwise unlawful; or
limiting another data-protection remedy that cannot lawfully be restricted.
Data Subject rights shall be determined by the applicable law, the personal data concerned, the lawful basis for processing, the circumstances of the request and any legally applicable limitation or exemption.
