Privacy Policy

About this policy

This Privacy Policy explains how Kursi Group Limited (RC 7201389) and its subsidiaries ("Kursi", "we", "us") collect and use personal data about visitors to www.kursigroup.com, customers, suppliers, business partners, job applicants, members of our host communities and anyone else who contacts us.

We process personal data in line with the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Regulation 2019 (NDPR) to the extent it remains in force, the General Application and Implementation Directive (GAID) 2025 issued by the Nigeria Data Protection Commission (NDPC), and other applicable law. Where we process data of people in other countries, we also respect the data protection laws that apply there.

For a summary of how we comply with Nigerian data protection law as an organisation, see our Data Protection (NDPA) Compliance Statement.

Who is responsible for your data

The data controller is the Kursi Group company you deal with — for most website enquiries this is Kursi Group Limited, 12C Agadez Crescent, Wuse II, Abuja, Federal Capital Territory, Nigeria.

We have appointed a Data Protection Officer (DPO), who you can contact at dpo@kursigroup.com or by post at the address above, marked "For the attention of the Data Protection Officer".

The personal data we collect

We collect only the data we need for the purposes described in this policy.

We do not intentionally collect sensitive personal data — such as health, religious belief or biometric data — through this website. Where we must process sensitive data (for example, occupational health records for employees and contractors, or biometric access control at operating sites), we do so only where the NDPA permits and with additional safeguards.

How and why we use your data

The NDPA requires us to have a lawful basis for each use of personal data. The table below sets out our main purposes and bases.

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You can ask us for details of that assessment.

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing, including profiling.

Who we share your data with

We share personal data only where necessary and lawful, and we never sell it. Recipients may include:

• Kursi Group companies, where needed to handle your enquiry or relationship;
• service providers that act on our instructions, such as IT, email and cloud hosting, recruitment platforms, screening and verification providers, security contractors, auditors and professional advisers — each bound by a written agreement requiring them to protect your data;
• banks, insurers, logistics, clearing and forwarding agents involved in a transaction;
• regulators and public authorities where the law requires, including the Nigeria Data Protection Commission, the Ministry of Solid Minerals Development and its agencies, the Nigerian Financial Intelligence Unit, the Special Control Unit against Money Laundering, tax authorities, law enforcement and courts;
• certification and standards bodies, such as the Responsible Jewellery Council, where an audit requires access to records;
• prospective buyers or investors in a Kursi Group business, under confidentiality and only where necessary.

International transfers

Some of our service providers and business partners are outside Nigeria. When we transfer personal data outside Nigeria we do so only as the NDPA permits — for example, where the recipient country has been recognised as providing an adequate level of protection, where appropriate safeguards such as binding contractual clauses are in place, or where another lawful condition applies (such as the transfer being necessary to perform a contract with you). You can ask our DPO for information about the safeguards we use.

How long we keep your data

We keep personal data only for as long as necessary for the purpose it was collected for, or as the law requires.

When data is no longer needed we delete it securely or anonymise it.

How we protect your data

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration and disclosure. These include encrypted connections (HTTPS), access controls based on job role, hashing of IP addresses collected by website forms, secure hosting, staff training, confidentiality obligations and written agreements with service providers.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it and, where the risk is high, we will tell you without undue delay.

Your rights

Under the NDPA you have the right to:

1. be informed about how your personal data is used;
2. access the personal data we hold about you and receive a copy;
3. rectification of inaccurate or incomplete data;
4. erasure of your data where there is no longer a lawful reason to keep it;
5. restrict our processing in certain circumstances;
6. object to processing based on legitimate interests, and to direct marketing at any time;
7. data portability — to receive data you gave us in a structured, commonly used format, or have it sent to another organisation;
8. withdraw consent at any time, without affecting processing that took place before you withdrew it;
9. not be subject to a decision based solely on automated processing that produces legal or similarly significant effects; and
10. lodge a complaint with the Nigeria Data Protection Commission.

To exercise any of these rights, email dpo@kursigroup.com or use the request form at the end of this page. Requests are free. We may need to verify your identity before acting. We will respond without undue delay and in any event within the time limit set by the NDPA and the GAID, which is generally 30 days; if a request is complex we will tell you if we need longer and why.

Some rights are limited by law — for example, we may need to keep KYC records even if you ask us to delete them, because anti-money-laundering law requires it. We will explain if this applies.

Recruitment

When you apply for a role we use the data in your application, and information from referees and checks you agree to, only to assess your suitability, communicate with you and, if successful, prepare your employment. Background, qualification and reference checks are carried out only for shortlisted candidates and only where relevant to the role. Kursi Group never charges candidates a fee.

Children

Our website and services are intended for adults. We do not knowingly collect personal data from anyone under 18 through this website. Where we work with children in the community — for example, through scholarships — we obtain consent from a parent or guardian and apply additional safeguards.

Cookies

We use strictly necessary cookies to run this site and, only with your consent, analytics cookies. See our Cookie Policy for details and to change your choices.

Links to other websites

This website links to other sites, including our recruitment portal and social media pages. Their owners are responsible for how they handle your data, so please read their privacy notices.

Complaints

If you have concerns about how we handle your data, please contact our DPO first so we can try to resolve them. You also have the right to complain to the Nigeria Data Protection Commission (www.ndpc.gov.ng).

Changes to this policy

We review this policy at least once a year and update it when our practices or the law change. The effective date at the top of this page shows when it was last updated. Material changes will be highlighted on this website.