Privacy Policy

Funding-readiness assessments

When you request a funding-readiness report, we collect your name, email, business context and selected answers. We use them to calculate a self-reported preparation score, email your personalised action plan through our email provider, and make your assessment available to authorised CredaBiz staff for relevant follow-up. We do not request bank account numbers, BVNs or document uploads in this assessment.

Assessment records follow our enquiry retention period. The report is not a credit assessment, funding application or guarantee of eligibility. Newsletter subscription is optional and separate from report delivery; existing unsubscribe preferences remain protected.

Who we are

Creda Corporate Services ("Creda", "we") is a corporate services provider registered in Nigeria. We act as the data controller for the personal data described in this policy.

What we collect

We collect only what a corporate registration or compliance filing requires, plus what you choose to give us.

• Identity and contact details. Full name, email address, telephone number and postal address, for you and for each director, shareholder or beneficial owner named on an application.
• Identification documents. Passport photographs, national identification numbers, international passports, proof of address and signatures, submitted for statutory filing.
• Company information. Proposed names, registered addresses, share structures, business activities and your CAC registration number.
• Payment information. Transaction references, amounts and status. We do not store full card numbers; card details are held by our payment processor and never reach our servers.
• Correspondence. Messages you send us, and documents we produce in response.

Why we hold it

We process this data to perform the service you engaged us for. A company registration cannot be filed without director identification and a share structure, so providing it is necessary rather than optional.

We also rely on it to meet our legal obligations as corporate secretaries, including record retention. We do not use identification documents for marketing.

Who we share it with

• Regulators. The Corporate Affairs Commission, the Nigeria Revenue Service, SCUML and relevant banks, where disclosure is required to complete your filing.
• Service providers. Our hosting provider, email provider and payment processor, each under a confidentiality obligation and limited to the purpose of providing their service.
• Professional advisers. Where a matter requires a licensed advocate or tax practitioner, we will tell you before sharing anything.
• Law enforcement or regulators, where we are legally required to disclose.

How we protect it

Uploaded documents are stored in private storage buckets that are not publicly readable. Access is granted per request through short-lived, signed links and is limited to your own records and to staff assigned to your file. Every staff action on a document is written to an immutable audit log.

All traffic is encrypted in transit. Access to the production database is restricted to named staff and protected by row-level security, so a staff member cannot read a client file unless their role permits it.

How long we keep it

Corporate secretarial records are retained for a minimum of ten years from the date of the relevant filing, in line with the record-keeping expectations of the Corporate Affairs Commission. Enquiries and marketing correspondence are kept for two years.

When the retention period expires, records are deleted or anonymised. If you ask us to delete your account, we remove your profile and notifications immediately, and your filed statutory records are retained for the period above because we are required to keep them.

Your rights

Under the Nigeria Data Protection Act you have the right to access a copy of the personal data we hold about you, to correct data that is inaccurate or incomplete, to request deletion where we are not required to retain it, to object to or restrict certain processing, and to request that we transfer your data to another provider.

Blog readership

We count article visits to show popular registration guides. Our blog counters store a daily, article-specific hash of the network address, rather than the raw address, to limit duplicate counts. These markers are cleared during counter maintenance; aggregate article totals are retained. We add no readership cookies and do not build visitor profiles or track readers across websites.

Cookies

We use a small number of cookies to keep you signed in and to remember your theme preference. Optional marketing tracking stays off unless you accept it in Privacy settings. With consent, Meta may use cookies and process usage information to measure campaigns. You can withdraw consent in Privacy settings.

When optional website measurement is enabled and accepted, we record article actions and keep a CTA-click reference in this browser tab for up to 30 minutes. A matching enquiry or consultation submitted in that window may be linked to the click inside our protected systems. Staff can review enquiry quality and confirm consultation completion. The measurement records do not copy your name, email, form answers or full referring URL, and no visitor profile is created. You can reject or withdraw optional measurement in Privacy settings; this clears the tab reference and stops further optional collection. Earlier consented records are not automatically erased by withdrawal.

Changes to this policy

If we change how we handle your data we will update this page and change the date at the top. Material changes affecting existing clients will be notified by email.