TTP Data Protection Policy

Applicability

Employees of TTP and its subsidiaries must follow this policy. Contractors, consultants, partners, Government Agencies and any other external entity are also included. Generally, TTP policy refers to anyone it collaborates with or any who acts on TTP’s behalf and may need occasional access to data.

Policy Purpose

TTP Data Privacy and Consent Policy refer to TTP’s commitment to treat information of employees, customers, stakeholders and other interested parties with the utmost care and confidentiality. With this policy, TTP ensures that it gathers, stores and handles data fairly, transparently and with respect towards individual rights.

Information TTP will Collect

As part of TTP’s operations, TTP needs to obtain and process information. This information includes any offline or online data that makes a person or truck identifiable such as names, addresses, usernames and passwords, digital footprints, photographs, videos, financial data, etc.

Thus, TTP will collect your details and that of your truck(s) or vehicle(s) when you come into and out of designated Ports and Parks in Nigeria and when you apply to use, or are using TTP’s services. These details include but are not limited to:

Information on the Drivers, the Trucks, the truck Owners, the Agents, terminal operators, Unions, law enforcement agents’ activities, payment information etc.
Photographs of truck drivers, trucks, parks etc.
Other images, audio material, video material and audio-visual material and other information legally and reasonably required to access TTP’s services.

The designated Ports and Parks for which information will be required include but are not limited to:

Apapa Port;
Tincan Island Port;
Lilypond Park;
ABAT Park, Orile
MOB Park;
Sagamu Park; and
Any other park forming part of the network.

TTP collects this information in a transparent way and only with the full cooperation and knowledge of the necessary parties.

Information with Third Parties

Your personal information may be shared with third parties if:

• Further processing is required. Further processing may include translation, transfer to foreign countries or international organisation in accordance with the NITDA, NDPR, and any other applicable regulation in force.
• TTP has a statutory duty to disclose it for legal and regulatory reasons or for public interest.
• You consent to the transfer of your data.
• It is necessary for the performance of contract or conclusion of the same between you and TTP.
• It is to establish, defend or exercise legal claims.

Where your personal data is shared with third parties, TTP will ensure that such third parties comply with all current data protection legislations. Where such third parties are located outside of Nigeria, such organisations will process your personal data subject to the provisions of NITDA and NDPR.

Legal Basis for Processing your Personal Data

In line with the provisions of the NDPR, processing of Personal Data by TTP shall be lawful if at least one of the following applies:

• You (Data Subject) have given consent to the processing of your Personal Data for one or more specific purposes.
• The processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract.
• Processing is necessary for compliance with a legal obligation to which TTP is subject.
• Processing is necessary in order to protect your interest or that of another natural person, and
• Processing is necessary for the performance of a task carried out in the public interest or in the exercise of the official public mandate vested in TTP.

Governing Principles of Data Processing

In addition to the procedures laid down under the NITDA and NDPR or any other instrument, your Personal data collected will be processed lawfully and legitimately for the purpose it was collected only if you consent to it. Further processing may be done only for archiving, scientific research, historical research or statistical purposes for public interest.

TTP will store your data accurately, adequately and will not be prejudicial to you or to anyone. Data collected will only be for the period within which it is needed. TTP will employ the latest technology and apply best industry practices in securing your data against all foreseeable hazards and breaches such as theft, cyber-attack, viral attack, dissemination, manipulations of any kind, damage by rain, fire, or exposure to other natural elements.

TTP owes you a duty of care and is accountable to you for acts or omissions in respect of the data processing.

Lawful Processing

Your Data shall be lawfully processed if one or more of the factors below apply:

• Consent: You have given TTP your consent.
• Performance of Contract: processing is necessary for the performance of a contract which you are part of.
• Legal Obligation: Processing is necessary for compliance with legal obligation.
• Your Interest: Processing is necessary in order to protect your interest or that of another natural person.
• Performance of Task: Processing is necessary in order to carry out a task in public interest or exercise of official public mandate vested in the TTP.

Procuring Your Consent

TTP will only obtain information from you with your consent and ensure the following:

• No data will be obtained from you except the specific purpose of collection is made known to you.
• TTP is under obligation to ensure that your consent has been obtained without fraud, coercion or undue influence.
• Where processing is based on consent, TTP will obtain the necessary consent before processing your Personal Data and ensure that you have the legal capacity to give consent.
• That the consent is sufficiently distinct from other matters to which you have agreed.
• That the consent is clearly provided in an affirmative manner.
• That consent is obtained for the purpose of Personal Data collection and processing.
• That it is clearly communicated to you and you understood that you can update, manage or withdraw your consent at any time.
• For your consent to be valid, you must give it voluntarily and with clear understanding. In line with regulatory requirements, consent cannot be implied neither does silence amount to consent under the NDPR.
• Consent in respect of sensitive Personal Data must be unambiguous.
• Consent of Minors: The consents of minors (under the age of 18) will always be protected and obtained from minor’s representatives in accordance with applicable regulatory requirements.

Data Protection Officer (DPO) and Trainings

TTP has appointed a Data Protection Officer (DPO) who shall oversee the Company’s data protection policy, application and ensure compliance with NDPR requirements.

The contact details of the Data Protection officer are as follows –

TTP shall ensure that its management and employees who collect, access and process Personal Data receive adequate and continuous trainings on data privacy and protection in order to understand the requisite data protection requirements of the NDPR and to comply with them.

Data Security

TTP has in place, a range of physical and electronic security safeguards to protect your personal information against loss or theft, as well as unauthorized access, disclosure, copying, use, or modification.

Our website uses Secure Sockets Layer/Transport Layer Security (SSL/TLS) to ensure secure transmission of your Personal Data. You should see the padlock symbol in your URL address bar once you are successfully logged into the platform. The URL address will also start with https:// depicting a secure webpage. SSL applies encryption between two points such as your PC and the connecting server. Any data transmitted during the session will be encrypted before transmission and decrypted at the receiving end. This is to ensure that data cannot be read during transmission. Our website, Ètò app and ERP are all hosted on AWS where standard AWS cloud security also applies.

Consequently, when information is collected, TTP will ensure the following rules apply and that your data is:

• Accurate and kept up-to-date.
• Collected fairly and for lawful purposes only.
• Processed by TTP within its legal and moral boundaries.
• Protected against any unauthorized or illegal access by internal or external parties.

Advancement of Right to Privacy

The privacy right you have shall be interpreted for the purpose of advancing and never for the purpose of restricting the safeguards you are entitled to under any data protection instrument made in furtherance of fundamental rights and the Nigerian laws.

Data Breach

Ensuring the utmost security of your personal data is important to us. Accordingly, if there is any data breach, TTP shall notify NITDA of such personal breaches within 72 hours of becoming aware of such breach. In addition, TTP will take the requisite steps within the reasonable shortest time and according to the relevant extant laws and regulations to remedy any such breach.

Disciplinary Consequences

All principles described in this policy must be strictly followed. A breach of data protection guidelines will invoke disciplinary and possibly legal action against any of TTP employees found wanting.

Transfer of Data to Foreign Country

Where Personal Data is to be transferred to a country outside Nigeria for business purposes, TTP shall put adequate measures in place to ensure the security of such Personal Data.

TTP shall, among other things, conduct a detailed assessment of whether the said country is on the National Information Technology Development Agency (NITDA) White List of Countries with adequate data protection laws.

Your Personal Information shall be stored in Oracle Advanced Security Transparent Data Encryption format using Generally Accepted International Security Standards (ISO).

Your Personal Information shall be subject to the Nigerian Data Protection Regulation (NDPR) as may be amended from time to time and any other applicable Data Protection Regulations in Nigeria.

Particularly, TTP will comply with extant provisions of the NDPR below:

• That NITDA has decided that the foreign country, territory or one or more specified sectors within that foreign country, or the international organisation in question ensures an adequate level of protection.
• That the Attorney-General of the Federation, has taken into consideration the legal system of the foreign country as it applies to areas such as rule of law, respect for human rights and fundamental freedom, relevant legislation, both general and sectoral, including public security, defence, national security and criminal law and whether government of the foreign country has access to personal data stored within its territory.

Exceptions in Respect of Transfer of Data to a Foreign Country

In the absence of any decision by NITDA or HAGF as to the adequacy of safeguards in a foreign country, a transfer or a set of transfers of Personal Data to a foreign country or an international organisation shall take place once one of the conditions below are fulfilled:

• Consent: You (Data subject) must consent to the transfer, having been fully informed of the possible risks associated with hosting data in a foreign company or international organisation.
• Contract: The transfer is necessary for the performance of a contract between you and TTP or the implementation of pre-contractual measures taken at your request.
• The transfer is necessary for the conclusion or performance of a contract concluded in your interest between TTP and another natural or legal person.
• Public Interest: The transfer is necessary for public interest.
• Legal Claims: The transfer is necessary for the establishment, exercise or defence of legal claims.
• Interest of the Data Subject: The transfer is necessary in order to protect your vital interests or of other persons, where you are physically or legally incapable of giving consent.

Your Rights

Your right to object to the processing of your data shall always be safeguarded. You have the right to:

• Right to request for and access your Personal Data collected and stored. Where data is held electronically in a structured form, such as in a Database, you have the right to receive that data in a common electronic format.
• Right to information on your personal data collected and stored.
• Right to objection or request for restriction.
• Right to object to automated decision making.
• Right to request rectification and modification of your data which is kept by TTP.
• Right to request for deletion of your data, except as restricted by law or TTP’s statutory obligations.
• Right to request the transfer of data from TTP to a third Party, that is, the right to the portability of data.
• Right to object to, and to request that TTP restricts the processing of your information except as required by law or TTP’s statutory obligations.
• Right to object to the processing of Personal Data relating to you which TTP intends to process for the purpose of marketing.
• Right to be expressly and manifestly offered the mechanism for objection to any form of data processing free of charge.

You can exercise any of your rights by contacting TTP through the channel below:

Methods of Collection and Storage of Personal Data

• Physical and online forms.
• CCTV recordings.
• Cookies
• Interviews
• Surveys

Cookies

Cookies are small files placed on your computer’s hard drive that enable the website to identify your computer as you view different pages. Cookies allow websites and applications to store your preferences to present contents, options, or functions specific to you.

Like most interactive websites, our website uses cookies to enable the tracking of your activity for the duration of a session. Our website uses only encrypted session cookies which are erased either after a predefined timeout period or once the user logs out of the platform and closes the browser. Session cookies do not collect information from the user’s computer; they store information in the form of a session identification that does not personally identify the user.

Risks Associated with Transfer of Data to Foreign Country or International Organisation

TTP applies best effort in exercising due diligence and due care in the selection of foreign countries and international organisations for needed data processing, to ensure they have adequate data protection rules and practices, as well as data protection authority, similar to the recommendations and requirements of the NDPR, along with a rule of law similar to that of Nigeria.

However, such transfer of data inherently bears risks which you need to be aware of and acknowledge these risks as a part of providing the needed services on TTP systems, including Eto, to you and/or your organization, which risks are as follows:

• The Data transfer is susceptible to violation of national and international data regulations by host country government.
• The Data may be intercepted and decrypted by third party during the process of transfer.
• The Data may be lost during transfer.
• The Data may be corrupted during transfer.

Links to other Websites

While TTP website and mobile applications may have links to or from other websites, TTP is not responsible for the content, security, or privacy of these websites. TTP recommends that you always review the privacy and consent policies of the websites before engaging with them.

Monitoring Electronic Communication Channels

TTP communicates with its customers via different channels and methods such as telephone, email, online chat, etc. These channels of communication may be monitored and communications recorded as allowed by the law in keeping with TTP’s legal and regulatory responsibilities and internal policies.

Social Media Channels

To improve its services, TTP operates and communicates through its social media pages on some social media sites. The following apply to the social media accounts:

• TTP gathers information from comments and posts on the designated pages.
• TTP is not responsible for any information posted on those sites except those posted by TTP designated officials.
• TTP does not endorse the social media sites in themselves or any information posted on them by third parties or other users as these platforms are opened to and can be accessed by the general public.

Right to Change this Data Privacy and Consent Policy

TTP reserves the right to change this Data Privacy and Consent Policy. However, TTP will publish all changes on the websites/mobile app. The latest version of the policy will replace all earlier versions, unless it says differently.

Effective Date

December 1, 2020

CONSENT

• By ticking the “I agree” box on this website or the Ètò mobile app, or in the electronic versions of this form or completing and signing a hard copy and returning same to TTP Customer Care Department, I declare and acknowledge that I have read this Form and TTP Data Privacy and Consent Policy and I understand same. I further declare that to the extent that my consent is required, I grant my consent to TTP to process, disclose and retain my personal information for the purposes explained above.

• By ticking the “I agree” box on this website or the Ètò mobile app, or in the electronic versions of this form or completing and signing a hard copy and returning same to TTP Customer Care Department, I declare and acknowledge that I have read this Form and TTP Data Privacy and Consent Policy and I understand same. I also declare that I understand the possible risks associated with hosting data in a foreign company or international organisation, and to the extent that my consent is required, I grant consent to TTP to process and transfer my data to foreign country or international organization for the purposes stated by TTP in its Data Privacy and Consent Policy. TTP complying with the rights and responsibilities herein, I waive any legal, equitable or contractual rights for any damages that I may incur as a result of use of my data in the manner set out herein.