GDPR & International Privacy Rights
Table of Contents
Purpose and Scope
This GDPR & International Privacy Rights Policy (“Policy”) supplements the Sizzle Social Privacy Policy and explains the additional privacy rights, protections and legal requirements that may apply where Sizzle Social processes personal data subject to the European Union General Data Protection Regulation (“EU GDPR”), the United Kingdom General Data Protection Regulation (“UK GDPR”) or another applicable international data-protection framework.
Sizzle Social is operated under Sizzle Digital Technologies, a Nigerian business.
The principal privacy framework governing Sizzle Social’s Nigerian operations is the Nigeria Data Protection Act 2023 (“NDP Act”), together with applicable regulations, directives and guidance issued by the Nigeria Data Protection Commission (“NDPC”).
The fact that Sizzle Social is established in Nigeria does not necessarily prevent another jurisdiction’s privacy law from applying to particular processing.
Certain international privacy laws apply beyond the country in which the relevant organisation is established where statutory territorial-scope requirements are satisfied.
This Policy does not represent that the EU GDPR, UK GDPR or every other international privacy law applies to every Sizzle Social User or every processing activity.
Applicability shall be determined by reference to:
the relevant jurisdiction;
the location of the Data Subject at the relevant time;
whether Sizzle Social targets persons in that jurisdiction;
whether goods or services are offered to persons in that jurisdiction;
whether behaviour is monitored in that jurisdiction;
the nature of the processing;
applicable statutory thresholds;
the establishment of the controller or processor; and
any other jurisdiction-specific territorial requirement.
Where an international privacy law applies, Sizzle Social shall provide the rights and protections required by that law to the extent applicable to the relevant processing.
This Policy shall be read together with the Privacy Policy, Data Rights & Privacy Requests Policy, Cookie Policy and other policies published through the Sizzle Social Legal Centre.
Data Controller
Sizzle Social and Sizzle Digital Technologies
Sizzle Social is operated under Sizzle Digital Technologies.
Where Sizzle Digital Technologies determines the purposes and means of processing personal data through Sizzle Social, it acts as the relevant data controller.
Applicable controller contact information is:
Business: Sizzle Digital Technologies
Platform: Sizzle Social
Email: contact@sizzlesocial.ng
Website: https://sizzlesocial.ng
Where another organisation independently determines the purposes and means of particular processing, that organisation may act as a separate controller.
Where Sizzle Social processes personal data solely on documented instructions from another controller, Sizzle Social may act as a processor in relation to that specific processing.
The legal role applicable to any processing activity shall be determined by the actual relationship and processing activity rather than by terminology alone.
Relationship With Nigerian Privacy Law
The NDP Act Remains Applicable to Nigerian Operations
This Policy does not replace Sizzle Social’s obligations under Nigerian data-protection law.
Where both Nigerian law and an applicable international privacy law govern the same processing, Sizzle Social shall seek to comply with each applicable regime.
Where different laws impose different standards, the applicable requirements shall be assessed according to:
territorial scope;
subject matter;
legal role;
processing activity;
mandatory statutory requirements; and
the rights of the affected Data Subject.
An international privacy regime shall not be treated as displacing the NDP Act merely because an international Data Subject is involved.
When the EU GDPR May Apply
EU and EEA Territorial Scope
The EU GDPR applies throughout the European Economic Area (“EEA”), which includes the Member States of the European Union together with Iceland, Liechtenstein and Norway.
The EU GDPR may apply to organisations established outside the EEA in circumstances specified by Article 3 of the GDPR.
Where Sizzle Social has no relevant establishment in the EEA, the EU GDPR may nevertheless apply to processing relating to:
the offering of goods or services to Data Subjects who are in the European Union or EEA; or
the monitoring of the behaviour of Data Subjects where that behaviour takes place within the European Union or EEA.
The processing concerned must relate to the qualifying targeting or monitoring activity.
Offering Goods or Services to People in the EEA
The availability of a website on the internet does not, by itself, necessarily establish that an organisation intends to offer goods or services to Data Subjects in every country from which the website can technically be accessed.
Whether Sizzle Social offers Services to Data Subjects in an EEA jurisdiction shall be determined from the circumstances.
Relevant indicators may include:
expressly marketing Services to persons in an EEA country;
accepting or specifically supporting transactions from that jurisdiction;
referring expressly to customers or markets within the EEA;
using advertising directed toward persons in the EEA;
providing jurisdiction-specific commercial functionality;
deliberately serving Users in EEA markets; or
other conduct demonstrating an intention to offer Services to Data Subjects in the EEA.
No single factor shall necessarily determine territorial scope.
Monitoring Behaviour in the EEA
The EU GDPR may also apply where Sizzle Social monitors the behaviour of Data Subjects in the EEA.
Monitoring may include certain forms of systematic online tracking or profiling where individuals are tracked for purposes such as:
behavioural analysis;
prediction of preferences;
targeted advertising;
profiling;
systematic observation;
location tracking; or
comparable monitoring activity.
Ordinary technical processing shall not automatically constitute behavioural monitoring merely because a website generates server logs or performs essential security functions.
The nature, purpose and systematic character of the processing shall be considered.
Mere Website Accessibility
The mere fact that an individual in an EEA country can open a Sizzle Social webpage shall not, by itself, establish that every Sizzle Social processing activity is subject to the EU GDPR.
Territorial scope shall be determined according to the statutory criteria and the actual processing concerned.
Citizenship Is Not the Sole Test
GDPR territorial scope does not depend solely upon whether an individual holds citizenship of an EU Member State.
A Nigerian citizen who is in an EU Member State may fall within the territorial provisions applicable to a qualifying processing activity.
Conversely, the mere fact that an EU citizen is outside the EEA does not automatically mean every processing activity involving that person falls within Article 3(2).
The circumstances of the Data Subject and processing activity shall determine applicability.
EU Representative
Article 27 Representation
Where Article 3(2) of the EU GDPR applies to Sizzle Social and Article 27 requires appointment of a representative, Sizzle Social shall designate an appropriate representative in the European Union in writing.
The representative shall be established in a Member State in which relevant Data Subjects are located.
Where appointed, the representative may be authorised to receive communications concerning applicable GDPR matters from:
Data Subjects;
supervisory authorities; and
other competent bodies.
The appointment of a representative shall not remove Sizzle Social’s own responsibilities under applicable data-protection law.
Article 27 Exceptions
An EU representative may not be required where the applicable statutory exception is satisfied.
The exception may apply where the processing:
is only occasional;
does not include large-scale processing of special categories of personal data;
does not include large-scale processing of personal data relating to criminal convictions and offences; and
is unlikely to result in a risk to the rights and freedoms of natural persons, having regard to the nature, context, scope and purposes of processing.
The exception shall not be presumed merely because Sizzle Social is a non-EU business.
Where Article 27 requires appointment of a representative, the required appointment shall be made and applicable contact details shall be published.
When the UK GDPR May Apply
United Kingdom Territorial Scope
The UK GDPR is a separate legal regime from the EU GDPR.
It may apply to processing by an organisation established outside the United Kingdom where the relevant processing relates to:
offering goods or services to individuals in the United Kingdom; or
monitoring the behaviour of individuals in the United Kingdom.
The mere technical accessibility of Sizzle Social within the United Kingdom shall not necessarily establish UK GDPR applicability.
The targeting and processing circumstances shall be considered.
UK Representative
Where Sizzle Social is subject to the extra-territorial provisions of the UK GDPR and applicable law requires a United Kingdom representative, Sizzle Social shall designate such representative in accordance with the applicable legal requirements.
An applicable statutory exception may apply where the relevant processing is occasional, low risk and does not involve qualifying large-scale special-category or criminal-offence data.
Where a representative is appointed, relevant contact information shall be made available as required.
Other International Privacy Laws
Jurisdiction-Specific Application
Privacy and data-protection legislation exists in numerous jurisdictions outside Nigeria, the EEA and the United Kingdom.
Sizzle Social does not represent that every privacy law in every country automatically applies merely because the Platform can be accessed from that country.
Where another privacy law applies to Sizzle Social, applicable rights shall be determined according to that law’s:
territorial scope;
business thresholds;
processing thresholds;
exemptions;
definitions;
consumer or Data Subject eligibility requirements; and
other statutory criteria.
No Voluntary Adoption of Every Foreign Law
Nothing in this Policy shall be construed as a contractual undertaking by Sizzle Social to subject all processing worldwide to every privacy law described or referred to in this Policy.
Where an international law does not legally apply to the relevant processing, Sizzle Social may nevertheless elect to provide a comparable privacy control as a matter of policy or operational convenience.
Such voluntary accommodation shall not, by itself, constitute an admission that the foreign law applies.
Data-Protection Principles
GDPR Processing Principles
Where the EU GDPR or UK GDPR applies, personal data shall be processed consistently with applicable data-protection principles.
These include:
lawfulness, fairness and transparency;
purpose limitation;
data minimisation;
accuracy;
storage limitation;
integrity and confidentiality; and
accountability.
Sizzle Social shall be responsible for demonstrating compliance where the applicable law places that accountability obligation upon it.
Purpose Limitation
Personal data collected for a specified purpose shall not be used for a materially incompatible new purpose without an appropriate lawful basis and any additional transparency or consent required by law.
Data Minimisation
Only personal data that is adequate, relevant and reasonably necessary for the applicable processing purpose should be collected or otherwise processed.
Accuracy
Reasonable steps shall be taken to ensure that personal data requiring accuracy is kept accurate and corrected or removed where materially inaccurate.
Storage Limitation
Personal data shall not be retained in identifiable form longer than reasonably necessary for the applicable lawful purpose, subject to lawful retention requirements.
Security and Confidentiality
Personal data shall be protected using appropriate technical and organisational measures having regard to relevant processing risks.
Categories of Personal Data
Personal Data Processed by Sizzle Social
The categories of personal data processed by Sizzle Social are described principally in the Privacy Policy.
Depending upon the interaction concerned, personal data may include categories such as:
Account and registration information;
contact information;
Order information;
social media usernames and destination links;
Wallet and transaction information;
Payment Provider information;
support correspondence;
complaint and refund records;
API and reseller information;
technical and device information;
Cookie and consent information;
marketing preferences;
security information; and
other information voluntarily provided or lawfully obtained.
The presence of a category in this Policy does not mean that every category is collected from every Data Subject.
Sources of Personal Data
Data Collected Directly
Personal data may be obtained directly from a Data Subject when the person:
creates an Account;
places an Order;
makes a Payment;
contacts Sizzle Social;
submits a support request;
submits a refund request;
submits a privacy request;
subscribes to marketing;
uses Platform functionality; or
otherwise provides information directly.
Data Obtained From Other Sources
Personal data may also be obtained from lawful external sources.
Such sources may include:
Payment Providers;
banks and financial institutions;
service suppliers;
security providers;
referral systems;
authorised representatives;
publicly available social media pages;
business partners; or
competent public authorities.
Where Articles 14 or comparable transparency requirements apply to indirectly obtained data, the required information shall be provided subject to lawful exceptions.
Lawful Bases for Processing
Lawfulness Requirement
Where the EU GDPR or UK GDPR applies, personal data shall be processed only where an applicable lawful basis exists.
Depending upon the processing concerned, a lawful basis may include:
consent;
performance of a contract;
steps taken at the request of a Data Subject before entering into a contract;
compliance with a legal obligation;
protection of vital interests;
performance of a qualifying public-interest task where applicable; or
legitimate interests, subject to the required balancing assessment.
No lawful basis shall be selected merely for convenience where its legal conditions are not satisfied.
Contractual Processing
Processing may be necessary for performance of a contract where the personal data is objectively necessary to provide a Service requested by the Data Subject.
Such processing may include information necessary to:
create or administer an Account;
process an Order;
maintain a Wallet;
verify a Payment;
deliver a purchased Service; or
provide contractually requested support.
Contractual necessity shall not be interpreted as permission to process unrelated information merely because a User has accepted the Terms of Service.
Legal Obligations
Personal data may be processed where necessary to comply with a legal obligation applicable to Sizzle Social.
Depending upon the circumstances, such obligations may concern:
accounting;
taxation;
fraud prevention;
regulatory compliance;
court orders;
lawful government requests; or
another applicable statutory obligation.
Legitimate Interests
Where legitimate interests are relied upon, Sizzle Social shall identify the legitimate interest concerned and assess whether the Data Subject’s interests, fundamental rights and freedoms override that interest.
Legitimate interests may, where appropriate, include:
Platform security;
fraud prevention;
network protection;
improvement of Services;
administration of customer relationships;
defence of legal claims; and
other reasonable business interests compatible with the rights of Data Subjects.
Consent
Where consent is the applicable lawful basis, consent shall satisfy the legal standard required by the applicable privacy law.
Under the GDPR, valid consent must be freely given, specific, informed and unambiguous and must be indicated through an affirmative act.
Consent shall not be inferred merely from:
silence;
inactivity;
pre-selected acceptance;
general acceptance of unrelated contractual terms; or
another mechanism that does not establish a genuine choice.
Where explicit consent is required, the higher applicable standard shall be used.
Withdrawal of Consent
Right to Withdraw
Where processing relies on consent, the Data Subject may withdraw that consent at any time.
Withdrawal shall be as accessible as reasonably required by applicable law.
Withdrawal shall not affect the lawfulness of processing carried out before the withdrawal became effective.
Continued Processing Under Another Lawful Basis
Withdrawal of consent does not necessarily require Sizzle Social to erase or cease every processing activity involving the relevant information.
Processing may continue where another lawful basis independently applies.
For example, withdrawal of marketing consent shall not require deletion of transaction records that must lawfully be retained for tax, accounting, fraud-prevention or legal purposes.
Special Categories of Personal Data
Enhanced Protection
The EU GDPR and UK GDPR provide enhanced protection for certain categories of sensitive personal data.
Depending upon applicable law, such categories may include data revealing or concerning:
racial or ethnic origin;
political opinions;
religious or philosophical beliefs;
trade union membership;
genetic data;
biometric data used for unique identification;
health;
sex life; or
sexual orientation.
Sizzle Social does not ordinarily require these categories of personal data for normal social media growth Orders.
Lawful Processing of Special Category Data
Where special-category data is processed, both an Article 6 lawful basis and an applicable Article 9 condition or equivalent legal authorisation shall be identified where required.
The mere existence of an ordinary contractual relationship shall not automatically authorise special-category processing.
Criminal Conviction and Offence Data
Special Legal Treatment
Where information concerning criminal convictions or offences is processed under a GDPR regime, such processing shall be undertaken only where the applicable legal conditions and safeguards are satisfied.
Sizzle Social shall not treat ordinary suspicion of fraud as permission to create or process unnecessary criminal-record information.
Privacy Information and Transparency
Information Provided at Collection
Where personal data is collected directly and Article 13 or an equivalent transparency provision applies, the Data Subject shall receive applicable information concerning matters such as:
the identity and contact details of the controller;
representative details where applicable;
Data Protection Officer contact details where applicable;
processing purposes;
lawful bases;
legitimate interests where relied upon;
recipients or categories of recipients;
international transfers;
retention periods or criteria;
applicable rights;
consent withdrawal;
complaint rights;
contractual or statutory requirements to provide data; and
applicable automated decision-making.
The Privacy Policy provides the principal Sizzle Social privacy notice.
Information Where Data Is Obtained Indirectly
Where personal data has not been obtained directly from the Data Subject, additional transparency requirements may apply.
Subject to applicable exceptions, the required information may include:
categories of personal data;
source of the personal data; and
whether the source was publicly accessible.
Applicable information shall be provided within the statutory period required by the relevant law.
Right of Access
Access to Personal Data
Where the GDPR applies, a Data Subject may request confirmation as to whether personal data concerning that person is being processed.
Where processing occurs, the Data Subject may have the right to:
access the personal data;
receive a copy of qualifying personal data; and
obtain supplementary information concerning the processing.
The supplementary information may include:
purposes of processing;
categories of personal data;
recipients or categories of recipients;
applicable retention;
rights of rectification, erasure, restriction and objection;
complaint rights;
available information concerning data sources; and
information concerning qualifying automated decision-making.
Access shall remain subject to applicable rights of others, legal privilege, confidentiality, security and other lawful limitations.
Right to Rectification
Correction of Inaccurate Data
A Data Subject may request correction of inaccurate personal data and completion of incomplete personal data where the applicable law provides that right.
Sizzle Social may request proportionate supporting information where reasonably necessary to determine the accurate record.
Right to Erasure
Right to Be Forgotten
Where the applicable GDPR conditions are satisfied, a Data Subject may request erasure of personal data.
Erasure may be required where, among other circumstances:
the personal data is no longer necessary for the original purpose;
consent has been withdrawn and no other lawful basis remains;
a valid objection applies and there is no overriding ground for continuation;
the personal data has been unlawfully processed; or
erasure is required by applicable law.
Exceptions to Erasure
The right to erasure is not absolute.
Personal data may continue to be retained where processing remains necessary for an applicable lawful purpose, including:
compliance with a legal obligation;
exercise or defence of legal claims;
freedom of expression and information where applicable;
qualifying public-interest purposes; or
another lawful exception.
Sizzle Social may therefore retain transaction, Payment, security, dispute, fraud-prevention, tax or accounting records where a lawful retention basis exists.
Right to Restriction
Restriction of Processing
A Data Subject may request restriction of processing in circumstances recognised by the applicable GDPR regime.
Restriction may apply, for example, where:
accuracy is contested while verification is undertaken;
processing is unlawful but deletion is opposed;
Sizzle Social no longer requires the data but the Data Subject requires it for legal claims; or
an objection is being considered.
During restriction, ordinary processing may be limited while storage continues.
Right to Data Portability
Portable Personal Data
Where the statutory conditions are satisfied, a Data Subject may receive personal data provided to Sizzle Social in a structured, commonly used and machine-readable format.
The right generally applies where:
processing is based upon consent or contract; and
processing is carried out by automated means.
Direct Transmission
Where technically feasible and legally required, the Data Subject may request transmission of qualifying personal data directly to another controller.
Portability shall not require Sizzle Social to create incompatible systems, disclose another person’s personal data or disclose information outside the legal scope of the portability right.
Right to Object
Objection Based on Particular Circumstances
Where processing is based on legitimate interests or another lawful basis to which the statutory objection right applies, a Data Subject may object on grounds relating to that person’s particular situation.
Sizzle Social shall cease the relevant processing unless an applicable lawful ground permits continuation.
Direct Marketing
A Data Subject has the right to object at any time to processing of personal data for direct marketing.
Where such an objection is made, personal data shall no longer be used for the relevant direct-marketing purpose.
This applies to related profiling to the extent the profiling concerns that direct marketing.
Sizzle Social may retain limited suppression information necessary to ensure that the objection remains effective.
Rights Concerning Automated Decision-Making
Solely Automated Significant Decisions
Where Article 22 or a comparable provision applies, a Data Subject has protections against certain decisions based solely on automated processing, including profiling, where the decision produces legal effects or similarly significant effects.
Routine automation shall not automatically fall within this restriction.
Examples of routine automated processes may include:
Order routing;
status updates;
technical monitoring;
routine security controls;
transaction reconciliation; and
service automation.
The applicable analysis shall depend upon whether the decision is solely automated and whether it produces the required level of effect.
Permitted Exceptions
A qualifying automated decision may be permitted where the applicable law allows it, including where the decision is:
necessary for entering into or performing a contract;
authorised by applicable law containing appropriate safeguards; or
based on explicit consent.
Safeguards
Where required, Sizzle Social shall implement safeguards such as:
the right to obtain human intervention;
the right to express a point of view; and
the right to contest the decision.
Special-category personal data shall not be used for qualifying automated decisions except where the stricter applicable requirements are satisfied.
Right to Complain to a Supervisory Authority
EU Supervisory Authorities
Where the EU GDPR applies, a Data Subject may have the right to lodge a complaint with an applicable data-protection supervisory authority.
Depending upon the circumstances, this may include the supervisory authority associated with:
the Data Subject’s habitual residence;
place of work; or
place of the alleged infringement.
Use of the Sizzle Social internal privacy procedure shall not constitute a waiver of a statutory right to lodge a regulatory complaint.
United Kingdom Information Commissioner’s Office
Where the UK GDPR applies, a Data Subject may have the right to complain to the United Kingdom Information Commissioner’s Office (“ICO”).
Sizzle Social may encourage the Data Subject to permit internal investigation first, but use of an internal complaint procedure shall not remove applicable regulatory rights.
Nigeria Data Protection Commission
Where Nigerian law applies, rights to complain to the NDPC remain unaffected by this Policy.
The applicability of GDPR rights shall not displace rights independently available under the NDP Act.
Right to Judicial Remedy
Court and Tribunal Rights
Where applicable law provides a right to seek judicial or other legal redress for an alleged data-protection violation, nothing in this Policy shall operate as a waiver of that right.
Internal complaints, Data Rights Requests and regulatory complaints shall not exclude judicial remedies that cannot lawfully be restricted.
Submitting an International Privacy Request
Request Channels
Requests under the EU GDPR, UK GDPR or another applicable privacy regime may be submitted through the Sizzle Social Data Rights process or by email.
Email: contact@sizzlesocial.ng
Suggested Subject: GDPR / International Privacy Request
Failure to use the suggested subject line shall not invalidate an otherwise clear privacy request.
Information Required
The request should contain sufficient information to identify the Data Subject, determine the applicable right and locate responsive data.
Relevant information may include:
full name;
registered Sizzle Social email address;
Account identifier;
country or jurisdiction relevant to the request;
right being exercised;
description of the requested personal data or processing;
relevant Order, Payment, ticket or transaction reference;
representative authority where applicable; and
other information reasonably necessary to process the request.
No Data Subject shall be required to provide information unrelated to reasonable identification or processing of the request.
Identity Verification
Reasonable Verification
Sizzle Social may request additional information where reasonable doubt exists concerning the identity of a requester.
Verification shall be proportionate to:
the sensitivity of the information;
risk of unauthorised disclosure;
available Account authentication;
information already held; and
the consequences of acting upon an unauthorised request.
No Routine Over-Collection
Government-issued identification shall not be required automatically where identity can adequately be confirmed through less intrusive means.
Sizzle Social shall not request:
banking PINs;
card PINs;
OTPs;
online-banking passwords;
cryptocurrency private keys;
seed phrases; or
unrelated authentication secrets
for the purpose of verifying a privacy request.
GDPR Request Response Period
One-Month Response Period
Where the EU GDPR applies, Sizzle Social shall respond to applicable Data Subject rights requests without undue delay and ordinarily within one month of receipt of the valid request.
A comparable one-month standard generally applies under the UK GDPR.
The exact calculation of the applicable period shall be determined according to the governing law.
Extension for Complex or Multiple Requests
Where the GDPR permits an extension because a request is complex or because numerous requests have been received from the same individual, the applicable response period may be extended by up to an additional two months.
Where an extension is relied upon, Sizzle Social shall notify the Data Subject within the initial one-month period and provide the reason for the delay where required.
Identity Verification and Timing
Where additional information is reasonably required to confirm identity, the timing of the request shall be administered in accordance with the applicable law.
Verification shall not be used merely to delay an otherwise valid request.
Fees for Privacy Requests
Ordinary Requests Are Generally Free
Qualifying GDPR rights requests shall ordinarily be processed without charge.
Manifestly Unfounded or Excessive Requests
Where permitted by the applicable GDPR regime, Sizzle Social may charge a reasonable fee reflecting administrative costs or refuse to act on a request that is manifestly unfounded or excessive.
Relevant circumstances may include the repetitive character of the request.
The burden of demonstrating that a request is manifestly unfounded or excessive shall rest with Sizzle Social where the applicable law so provides.
A request shall not be classified as excessive merely because compliance requires reasonable administrative work.
Refusal of a GDPR Request
Notice of Refusal
Where Sizzle Social does not act on a GDPR rights request, the Data Subject shall be informed of the applicable reasons where required.
The response shall also identify applicable rights to:
lodge a complaint with a supervisory authority; and
seek a judicial remedy.
A refusal shall be based upon a recognised legal reason rather than business inconvenience.
Representatives Acting for Data Subjects
Authorised Agents
A Data Subject may act through an authorised representative where permitted by applicable law.
Sizzle Social may require reasonable evidence confirming:
the Data Subject’s identity;
the representative’s identity;
authority to act; and
scope of the representative’s mandate.
Direct verification with the Data Subject may be undertaken where reasonably necessary to prevent fraud or unauthorised disclosure.
Data Concerning Children
Enhanced Protection of Children
Children receive enhanced protection under GDPR principles.
Where consent is relied upon in relation to the direct offering of an information-society service to a child, the applicable age threshold shall be determined under the law governing the relevant Data Subject.
Under EU GDPR rules, Member States may set the applicable parental-consent threshold between 13 and 16 years.
Sizzle Social’s general contractual eligibility requirements are separately governed by the Terms of Service.
No Assumption That Children Are Targeted
Nothing in this section shall be interpreted as representing that Sizzle Social intentionally directs its Services toward children.
Where child-related processing nevertheless occurs, the applicable legal safeguards shall be observed.
Child-Focused Transparency
Where information is specifically directed to a child and applicable law requires child-appropriate transparency, the information shall be presented in language suitable to the intended audience.
Cookies, Tracking and ePrivacy
GDPR and Cookie Processing
Where Cookie or Tracking Technology data constitutes personal data and the GDPR applies, the resulting personal-data processing shall comply with the GDPR in addition to any separate electronic-communications or Cookie-consent rules.
The Cookie Policy governs Sizzle Social’s Cookie framework in greater detail.
Consent for Non-Essential Tracking
Where valid consent is required for Non-Essential Cookies, analytics, marketing or comparable tracking, such technologies shall not be activated before the required consent is obtained.
A User’s acceptance of the Terms of Service shall not, by itself, constitute GDPR-compliant consent to unrelated tracking.
Withdrawal of Cookie Consent
Where optional Cookie processing is based upon consent, applicable consent may be withdrawn through the available Cookie Preference Centre or comparable control.
Withdrawal shall operate prospectively.
Direct Marketing
Email and Other Marketing
Processing personal data for direct marketing may be subject to the GDPR and additional electronic-communications legislation.
Where applicable, Sizzle Social shall obtain any consent required for the relevant marketing channel.
The use of legitimate interests under data-protection law does not eliminate a separate requirement for consent that may apply under electronic-communications legislation.
Absolute Marketing Objection
Where Article 21 GDPR or an equivalent provision applies, an objection to direct marketing shall be honoured for the affected marketing processing.
A limited suppression record may be retained to prevent accidental re-enrolment.
Data Protection by Design and by Default
Privacy in System Design
Where Article 25 or an equivalent obligation applies, Sizzle Social shall implement appropriate technical and organisational measures designed to integrate data-protection principles into relevant processing.
Measures may include, where appropriate:
data minimisation;
restricted access;
privacy-sensitive defaults;
retention controls;
pseudonymisation;
security controls; and
limitation of unnecessary data exposure.
Default Processing
By default, personal data should not be made available to an indefinite number of persons or processed more extensively than is necessary for the relevant purpose where Article 25 applies.
Data Protection Impact Assessments
High-Risk Processing
Where processing is likely to result in a high risk to the rights and freedoms of natural persons and Article 35 or equivalent requirements apply, Sizzle Social shall assess whether a Data Protection Impact Assessment (“DPIA”) is required.
Relevant processing may include, depending upon scope and circumstances:
systematic and extensive profiling;
certain large-scale special-category processing;
large-scale systematic monitoring of publicly accessible areas; or
other processing designated as high risk by an applicable supervisory authority.
DPIA Content
Where required, an appropriate DPIA may address:
the contemplated processing;
purposes of processing;
necessity and proportionality;
risks to Data Subjects; and
safeguards intended to address those risks.
Data Protection Officer
Appointment Where Required
Where Article 37 GDPR, the UK GDPR or another applicable law requires designation of a Data Protection Officer (“DPO”), Sizzle Social shall make the required designation.
GDPR circumstances requiring a DPO may include where core activities consist of:
regular and systematic monitoring of Data Subjects on a large scale; or
large-scale processing of special categories of personal data or criminal-offence data.
The applicability of those criteria shall be assessed according to Sizzle Social’s actual processing.
DPO Contact Details
Where a DPO is formally designated under an applicable regime, Sizzle Social shall publish the appropriate DPO contact details and make required regulatory notifications.
The absence of separately published DPO details in this Policy shall not be interpreted as identification of an unnamed employee or officer as a statutory DPO.
Processors and Service Providers
Use of Processors
Where Sizzle Social appoints a processor in relation to processing governed by the GDPR, the processor shall be selected on the basis of sufficient guarantees to implement appropriate technical and organisational measures.
Processor Agreements
Where Article 28 applies, processor relationships shall be governed by an appropriate written contract or other binding legal act.
Such arrangements shall address applicable requirements including:
processing instructions;
confidentiality;
security;
subprocessors;
Data Subject rights assistance;
breach assistance;
deletion or return of data;
compliance information; and
audit rights where required.
Subprocessors
Where a processor engages another processor and GDPR requirements apply, appropriate authorisation and contractual protections shall be maintained.
Subprocessor involvement shall not remove the original processor’s applicable obligations.
Joint Controllers
Joint Determination of Processing
Where Sizzle Social and another organisation jointly determine the purposes and means of particular processing, the parties may constitute joint controllers.
Where Article 26 applies, the respective responsibilities shall be allocated through an appropriate arrangement.
The essence of the arrangement shall be made available to Data Subjects where required.
A joint-controller arrangement shall not remove the Data Subject’s right to exercise applicable rights against a controller where the GDPR permits such exercise.
Security of Processing
Appropriate Security Measures
Where Article 32 or an equivalent requirement applies, Sizzle Social shall implement technical and organisational measures appropriate to the risk.
Relevant measures may include, as appropriate:
encryption;
pseudonymisation;
access controls;
authentication;
availability protections;
backup controls;
incident response;
vulnerability management;
logging;
recovery capabilities;
periodic security review; and
personnel controls.
No provision of this Policy constitutes a representation that any technical system can be made completely immune from security incidents.
Personal Data Breaches
Breach Assessment
Where a personal data breach occurs, Sizzle Social shall assess:
the nature of the breach;
categories and approximate number of Data Subjects affected;
categories and approximate amount of data involved;
likely consequences;
risk to Data Subjects; and
measures taken or proposed to address the incident.
EU Supervisory Authority Notification
Where Article 33 GDPR applies and a personal data breach is likely to result in a risk to the rights and freedoms of natural persons, Sizzle Social shall notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of the breach.
Where notification occurs after the applicable period, reasons for the delay shall be provided where required.
A breach that is unlikely to result in the relevant risk may fall within the applicable notification exception.
Notification to Affected Data Subjects
Where Article 34 applies and a breach is likely to result in a high risk to the rights and freedoms of natural persons, affected Data Subjects shall be notified without undue delay unless an applicable exception applies.
The communication shall use clear and plain language and provide legally required information concerning the incident.
UK Breach Requirements
Where the UK GDPR applies, applicable breach-notification obligations to the ICO and affected individuals shall be handled according to UK law.
Nigerian Breach Obligations
Applicable Nigerian breach-notification requirements shall continue to apply independently where the NDP Act governs the processing.
International Data Transfers
Transfers Outside the EEA
Where personal data subject to the EU GDPR is transferred from the EEA to a recipient in a third country or international organisation, the transfer shall comply with Chapter V of the GDPR.
The purpose of the transfer rules is to ensure that GDPR protection is not undermined merely because personal data leaves the EEA.
Adequacy Decisions
Where the European Commission has adopted an applicable adequacy decision under Article 45 GDPR, personal data may be transferred within the scope of that decision without an additional Article 46 transfer safeguard.
Adequacy status may be limited by:
jurisdiction;
sector;
recipient category;
certification status; or
another condition contained in the relevant decision.
Applicable adequacy status shall therefore be checked at the time of transfer.
Transfers to Nigeria
As of the Last Updated date of this Policy, Nigeria is not listed among the jurisdictions for which the European Commission has adopted an Article 45 adequacy decision.
Accordingly, where an EEA-to-Nigeria transfer falls within Chapter V of the GDPR and no other applicable arrangement alters the analysis, an appropriate transfer mechanism shall be required unless a lawful derogation applies.
Standard Contractual Clauses
Where appropriate, Sizzle Social may rely upon Standard Contractual Clauses (“SCCs”) adopted by the European Commission as an Article 46 safeguard.
Applicable SCCs shall be selected according to the relationship between the parties, including where the transfer is:
controller to controller;
controller to processor;
processor to processor; or
processor to controller.
The use of SCCs shall not eliminate any obligation to assess whether the protections contained in the clauses can operate effectively in the circumstances of the transfer.
Supplementary Measures and Transfer Assessments
Where required, Sizzle Social or the relevant transfer party shall assess the laws and practices applicable to the transfer and determine whether supplementary safeguards are necessary.
Depending upon the circumstances, supplementary measures may include:
contractual safeguards;
encryption;
pseudonymisation;
access restrictions;
technical separation;
organisational controls; or
other measures appropriate to the identified risk.
Other EU Transfer Mechanisms
Where legally applicable, other international-transfer mechanisms may include:
Binding Corporate Rules;
approved codes of conduct;
approved certification mechanisms;
legally binding instruments between public authorities; or
another safeguard recognised under Article 46.
Sizzle Social shall not claim reliance upon a mechanism that has not actually been implemented for the relevant transfer.
Article 49 Derogations
In limited circumstances, a transfer may be permitted under an applicable Article 49 derogation.
Such derogations shall be interpreted according to their legal conditions and shall not ordinarily be used as a substitute for appropriate safeguards where transfers are regular, systematic and capable of being covered by an Article 46 mechanism.
UK International Transfers
Restricted Transfers
Where Sizzle Social makes or participates in a transfer governed by the UK GDPR’s international-transfer rules, the transfer shall be assessed according to the UK regime.
A restricted transfer may require:
UK adequacy regulations;
an appropriate safeguard; or
an applicable statutory exception.
UK Transfer Safeguards
Where appropriate, UK transfer safeguards may include mechanisms recognised under UK law, including applicable versions of:
the UK International Data Transfer Agreement;
the UK Addendum to qualifying EU Standard Contractual Clauses;
Binding Corporate Rules; or
another legally recognised safeguard.
Where a transfer-risk or data-protection assessment is required, the applicable assessment shall be undertaken.
Onward Transfers
Further Transfers to Other Recipients
Where personal data received under an international-transfer safeguard is subsequently transferred to another recipient, the onward transfer shall remain subject to applicable transfer and data-protection obligations.
An initial lawful transfer shall not automatically authorise unrestricted further disclosure.
International Hosting and Cloud Services
Remote Access May Constitute a Transfer
International data transfers may occur not only when files are physically moved from one country to another but also where personal data is made accessible to a legally separate recipient in another jurisdiction in circumstances constituting a regulated transfer.
Use of:
cloud hosting;
remote support;
database administration;
communications infrastructure;
external service providers; or
other international systems
shall therefore be assessed according to the applicable transfer rules.
Storage Location
No Guarantee of Exclusive Nigerian Storage
Sizzle Social shall not represent that personal data is stored exclusively in Nigeria unless the actual infrastructure supports that representation.
Hosting, backup, communications, Payment Provider or supplier infrastructure may involve processing in multiple jurisdictions.
Applicable international transfers shall be subject to the safeguards required by the relevant law.
Data Retention
International Retention Requirements
Where GDPR requirements apply, personal data shall be retained only for so long as reasonably necessary for the lawful purposes for which it is processed, subject to applicable legal retention requirements.
Retention considerations may include:
active Account status;
Order fulfilment;
payment reconciliation;
tax and accounting obligations;
fraud prevention;
security;
complaint handling;
chargeback periods;
limitation periods;
legal claims;
regulatory obligations; and
privacy-request records.
Specific retention periods may vary according to the category of data and purpose.
Anonymized Information
True Anonymization
Information that has been irreversibly anonymized so that no individual is identified or identifiable by reasonably available means may cease to constitute personal data for GDPR purposes.
Removing a name alone does not necessarily anonymize information.
Where information remains capable of being linked to an individual, it shall continue to be treated according to its actual legal status.
Pseudonymized Information
Pseudonymization Is Not Anonymization
Pseudonymized data remains personal data where the information can be attributed to a Data Subject through additional information.
Pseudonymization may constitute a useful safeguard but shall not be treated as eliminating GDPR obligations where the data remains identifiable.
Profiling
Meaning of Profiling
Profiling generally involves automated processing of personal data to evaluate certain personal aspects of an individual.
Depending upon the processing, this may concern matters such as:
behaviour;
preferences;
interests;
reliability;
location; or
movements.
Not every automated classification or technical process constitutes profiling.
Where profiling is undertaken and the GDPR applies, transparency, lawful-basis and applicable objection or automated-decision rights shall be observed.
Legitimate Interest Assessments
Balancing Requirement
Where Sizzle Social relies upon legitimate interests for processing governed by the GDPR, the assessment shall consider:
the legitimate interest pursued;
necessity of the processing;
reasonable expectations of the Data Subject;
nature of the personal data;
effect upon the Data Subject;
vulnerability of affected persons;
available safeguards; and
whether the Data Subject’s rights override the interest.
Where the balance favours the Data Subject, another lawful basis shall be required or the processing shall not proceed.
Records of Processing
Accountability Records
Where Article 30 or an equivalent provision requires records of processing activities, Sizzle Social shall maintain appropriate records concerning applicable processing.
Depending upon the legal role and circumstances, such records may include:
processing purposes;
categories of Data Subjects;
categories of personal data;
recipients;
international transfers;
retention information; and
security measures.
Any statutory exemption applicable to smaller organisations shall be assessed according to the conditions of the law rather than assumed solely from business size.
Regulatory Cooperation
Supervisory Authorities
Where the EU GDPR, UK GDPR or another applicable privacy regime requires cooperation with a competent supervisory authority, Sizzle Social shall respond to lawful regulatory requirements in accordance with the applicable law.
Nothing in this Policy shall require disclosure of information beyond what the authority is lawfully entitled to obtain.
Data Protection Representatives and Regulatory Contacts
Publication of Required Contacts
Where applicable law requires publication of an EU representative, UK representative, DPO or comparable privacy contact, the appropriate details shall be made available through the Privacy Policy, this Policy or another appropriate legal notice.
No person shall be deemed to hold one of those statutory roles solely because the person’s general contact details appear on the Sizzle Social website.
Conflicts Between Privacy Regimes
Concurrent Laws
More than one privacy regime may apply to the same processing activity.
Where this occurs, Sizzle Social shall seek to comply with all mandatory applicable requirements.
Where a genuine conflict arises that cannot reasonably be reconciled, the matter shall be assessed according to:
territorial scope;
conflict-of-laws principles;
mandatory statutory requirements;
applicable regulator guidance;
contractual safeguards; and
the circumstances of the processing.
Relationship With the Data Rights Policy
Operational Request Procedure
This Policy describes international rights and legal protections.
The Data Rights & Privacy Requests Policy establishes the principal Sizzle Social operational procedure for exercising those rights.
A Data Subject does not need to identify the exact statutory article applicable to a request.
Where the substance of a communication clearly constitutes a valid privacy-rights request, Sizzle Social shall assess it according to the applicable law.
Relationship With the Privacy Policy
Primary Privacy Notice
The Privacy Policy remains the primary Sizzle Social privacy notice.
It describes:
categories of personal data;
processing purposes;
lawful bases;
sharing;
international transfers;
retention;
security;
marketing;
Data Subject rights; and
privacy contact information.
This Policy supplements that notice where international privacy regimes apply.
Relationship With the Cookie Policy
Online Tracking
The Cookie Policy governs Sizzle Social’s use of Cookies and equivalent Tracking Technologies.
Where European or United Kingdom electronic-communications and privacy requirements apply, the Cookie Policy shall be interpreted together with those requirements and this Policy.
Relationship With the Terms of Service
Privacy Rights Are Not Waived by Contract
Acceptance of the Terms of Service shall not waive a privacy right that cannot lawfully be waived.
A contractual term shall not constitute GDPR consent merely because the term appears in a general agreement.
Where consent is required, the applicable consent standard shall be independently satisfied.
Policy Changes
Changes in International Privacy Law
Sizzle Social may amend this Policy to reflect:
amendments to privacy legislation;
regulatory guidance;
court decisions;
new adequacy decisions;
changes to international transfer mechanisms;
changes to Sizzle Social processing;
changes to international markets served;
new representatives or regulatory contacts; or
other compliance developments.
The Last Updated date shall identify the current published version.
Changes Requiring New Consent
A change to this Policy shall not, by itself, constitute consent to a materially new processing activity where applicable law requires separate consent.
Where fresh consent is required, an appropriate consent process shall be used.
Mandatory Law and Severability
Mandatory Privacy Protections Prevail
Where a provision of this Policy conflicts with a mandatory requirement of an applicable privacy law, the mandatory legal requirement shall prevail to the extent of that conflict.
Severability
If a provision of this Policy is determined to be unlawful, invalid or unenforceable, the remaining provisions shall continue in force to the extent permitted by law.
The affected provision shall be interpreted or modified only to the minimum extent necessary to preserve its lawful purpose.
Contact and Privacy Requests
International Privacy Requests
Requests concerning rights under the EU GDPR, UK GDPR or another applicable international privacy law may be submitted through the Sizzle Social privacy-request procedure.
Email: contact@sizzlesocial.ng
Suggested Subject: GDPR / International Privacy Request
The request should identify the privacy right being exercised and the jurisdiction considered relevant where reasonably known.
Failure to identify the correct legal provision shall not invalidate an otherwise valid request.
General Data Rights Requests
The complete procedure for submitting access, rectification, deletion, objection, portability, restriction and other privacy requests is available through the Data Rights & Privacy Requests Policy.
Legal Centre
The wider Sizzle Social legal framework is available through the Sizzle Social Legal Centre.
Related policies include:
Preservation of International Privacy Rights
Final Legal Effect
Nothing in this Policy shall be interpreted as:
requiring a Data Subject to waive an applicable privacy right;
claiming that GDPR protections apply where the GDPR is legally inapplicable;
denying GDPR protections where the territorial-scope requirements are satisfied;
authorising processing without a lawful basis;
converting general contractual acceptance into privacy consent where separate consent is required;
preventing withdrawal of consent;
preventing objection to direct marketing;
preventing a Data Subject from contacting an applicable supervisory authority;
removing an applicable right to judicial redress;
validating an unlawful international transfer;
permitting circumvention of Data Subject rights through a processor or third party;
removing protections required by Nigerian data-protection law; or
excluding another mandatory privacy protection that cannot lawfully be excluded.
The applicable rights of each Data Subject shall be determined by the privacy laws governing the relevant processing activity, together with the actual facts, location, purpose, legal role and circumstances of that processing.
