MyTribeERP Book a demo

Legal

Privacy Notice

How we collect, use, share and protect personal data on this website and on the MyTribeERP platform, and the rights you have under the Nigeria Data Protection Act 2023.

Version
1.0
Last updated

Under legal review. This notice describes how we handle personal data today. Our legal advisers are reviewing it, and we will publish any change here with a new date.

1. Who we are

MyTribeERP is provided by Clear Path Digital Consulting Limited, a company incorporated in Nigeria with its office in Lagos ("ClearPath Digital", "we", "us"). This notice explains how we handle personal data. We follow the Nigeria Data Protection Act 2023 (the "NDPA") and the Nigeria Data Protection Commission's General Application and Implementation Directive 2025 (the "GAID").

This notice covers:

  • visitors to this website, mytribeerp.com, including people who book a demo;
  • people who apply for or manage a MyTribeERP subscription for an organisation, such as an EXCO officer, an estate manager or the director of a management company;
  • anyone who signs in to the MyTribeERP apps, including residents, officers, estate staff, security personnel and vendors; and
  • people who contact us for support.

2. Two different roles

MyTribeERP is used by residents' associations and estate management companies (our "customers") to run their estates. Who is responsible for your data depends on what the data is.

Your estate is in charge of estate records. When an estate records information in MyTribeERP (for example households, charges, payments, visitors, meetings and votes), the estate is the data controller and we are its data processor. We handle that information only on the estate's instructions, under our Data Processing Terms. If you have a question about what your estate records about you, please contact your association or estate manager first. We will help them answer you.

We are the data controller for the information we collect for our own purposes: this website and its demo form, your sign-in account, security records, customer applications, support conversations and our own billing records. This notice mainly describes that information.

3. What we collect and why

Information Examples Why we use it Lawful basis (NDPA s.25)
Demo requests Name, email, phone (optional), role, organisation, estate size, preferred date and time, your notes To arrange and confirm your demo and follow up on it Your consent, given on the form
Website request logs IP address, browser type, page requested, date and time To deliver the website, keep it secure and investigate misuse Legitimate interests in running a secure website
Account details Name, email address, mobile number (if you add one) To create your account, sign you in and contact you about it Performance of a contract with you or the organisation you act for
Sign-in security Password (stored only as a one-way hash), second-step and passkey settings, sign-in times, device and browser type, a shortened IP address To keep accounts secure, detect misuse and investigate incidents Legitimate interests in security; our legal duty to secure personal data
Customer applications Organisation name, address and CAC number, estate details, representatives' names and contacts, evidence of authority (such as an EXCO resolution) To check that an organisation is genuine and the applicant is authorised, and to set up the subscription Steps taken before entering a contract; legitimate interests in preventing fraud
Acceptance records Which version of our terms was accepted, when, and the name typed To show what was agreed Contract; legal obligation
Support Messages, ticket details, support session records To help you, and to keep a record of any access to customer data Contract; legitimate interests
Audit records Who did what and when for privileged actions such as access changes, approvals, financial postings, exports and support sessions Accountability, security and resolving disputes Legitimate interests; legal obligation
Message delivery Delivery status of emails and SMS we send To make sure important messages arrive Contract; legitimate interests
Our billing records Invoices to the customer organisation, payment status To bill for the service and keep tax records Contract; legal obligation

We collect only what we need. We ask customers and users not to upload sensitive personal data (such as health, religious or biometric information) unless the estate has a clear legal basis and need for it.

4. Where the information comes from

Mostly from you. Some comes from the organisation you belong to: for example, your estate may invite you by email or record you as an officer. Some is created by our systems, such as sign-in, security and audit records.

5. This website

  • This website does not use cookies, analytics, advertising or tracking tools, and does not build a profile of you.
  • Our hosting provider, Google Cloud, records standard request logs (IP address, browser type, page requested and time). We use them only to run and secure the site, and they are deleted automatically after about 30 days.
  • The website loads its typefaces from Google Fonts. When it does, your browser sends your IP address and browser details to Google. Google says it does not use this to build profiles or for advertising.
  • The demo form sends your details to us only when you press Send request, after you tick the consent box. We email the request to our team and send you a receipt.

6. Sign-in and security

  • You sign in with your email address and a password, or with a passkey on devices that support it.
  • You can add a second sign-in step, a code from an authenticator app or by SMS. We recommend it, especially for officers and anyone with finance or administrator access.
  • We never put passwords, secrets or personal data in web addresses or in our logs.
  • We never send bank account numbers or similar sensitive account details by SMS.
  • The application stores only a shortened version of your IP address. Full IP addresses are kept only in our security logging service, for no more than 90 days.

7. Cookies

This website (mytribeerp.com) sets no cookies.

The MyTribeERP apps (app.mytribeerp.com and the mobile apps) use only strictly necessary cookies and similar device storage. The service does not work without them, so they do not need your consent. They are:

Purpose What it does How long
Session Keeps you signed in, and protects against cross-site request forgery Until you sign out; at most 12 hours on a shared device, and 180 days on your own device (30 days if unused)
Sign-in in progress Links the steps of a sign-in together (for example password, then a second step) 24 hours
Device recognition Recognises a browser or device you have signed in from, to spot unusual sign-ins 400 days
Remember this device Only if you choose it: skips the second step on your own device 30 days

We do not use analytics, advertising or third-party tracking cookies. If that ever changes, we will update this notice first and ask for your consent where the law requires it.

8. Who we share information with

We do not sell personal data. We share it only with:

  • Our service providers (sub-processors), who act on our instructions under written contracts: Google Cloud (Google LLC and its affiliates) for hosting, database, file storage and backups, and Infobip for delivering email and SMS messages.
  • The customer organisation you belong to, for information about your use of its estates. For example, your estate administrator can see your role and the audit trail of actions in their estate.
  • Payment providers chosen by your estate. If you pay a charge online, you deal with the provider your estate has chosen, and the money goes directly to your association's account. MyTribeERP never holds it. The provider handles your payment details under its own privacy notice.
  • Authorities, where the law requires it, such as a valid court order or a request from the Nigeria Data Protection Commission. Where we lawfully can, we tell the affected customer first.
  • A successor business, if our business is sold or merged, under the same protections.

9. Data stored outside Nigeria

MyTribeERP is hosted on Google Cloud in the africa-south1 region (Johannesburg, South Africa), so personal data is transferred out of Nigeria and stored in South Africa. Infobip may process message data in its data centres outside Nigeria to deliver messages.

We transfer personal data out of Nigeria only as sections 41 to 43 of the NDPA and the GAID allow, with contractual and technical safeguards in place with each provider, including encryption in transit and at rest. You can ask us for a summary of these safeguards using the contact details in section 15.

10. How long we keep information

We keep personal data only as long as we need it, then delete or anonymise it.

Information How long
Demo requests Closed automatically after 90 days without action; deleted 12 months after the request is closed
Website request logs About 30 days
Your account While you have access to any estate, then up to 24 months, unless you ask us to delete it sooner
Sign-in and security events 24 months
Full IP addresses in security logs No more than 90 days
Audit records of access, support sessions and exports 6 years
Audit records of financial and governance actions 6 years after the end of the financial year they relate to, or longer if the estate requires it
Customer applications that were rejected 12 months, then personal data and files are erased; a minimal record (reference, dates and outcome) is kept to prevent abuse
Applications that were abandoned or withdrawn 90 days, then erased as above
Approved applications For the life of the subscription and 6 years after it ends
Support records 3 years after the ticket is closed
Our billing records 6 years after the end of the financial year, as Nigerian tax and company law requires
Backups Deleted data may remain in encrypted backups until they expire, currently about 7 days

Information we process for an estate as its processor is kept according to that estate's own retention settings and our Data Processing Terms.

11. How we protect information

  • Each customer's data is kept separate from every other customer's, and the database itself enforces this.
  • Data is encrypted in transit and at rest.
  • Access is based on roles and limited to what each person needs.
  • Our staff cannot see a customer's data except through a time-limited support session that the customer's administrator approves. Every action in it is recorded and visible to the customer.
  • Records of privileged actions cannot be edited or deleted through the application.
  • We back up data, test recovery, monitor for attacks and test our security. You can report a security issue on our security page.

12. Children

Our website and apps are intended for adults. We do not knowingly create accounts for anyone under 18. An estate may record information about children in a household as part of its own records; the estate is responsible for that information and for obtaining a parent's or guardian's consent where the NDPA requires it.

13. Your rights

Under the NDPA you have the right to:

  • be told how your data is used (this notice);
  • get a copy of your personal data;
  • have inaccurate data corrected;
  • have your data deleted, where there is no good reason to keep it;
  • restrict or object to some uses, including use based on legitimate interests;
  • receive your data in a common machine-readable format, and have it sent to another provider where feasible;
  • withdraw consent where we rely on it, without affecting what we did before; and
  • not be subject to a decision based only on automated processing that significantly affects you. MyTribeERP does not make such decisions.

How to use your rights

  • For information an estate keeps about you (such as your household, charges, payments or visitor records), contact your association or estate manager, which controls that data. If you contact us, we will pass your request to them and help them respond.
  • For information we control, email hello@mytribeerp.com. We may need to confirm your identity first. We will respond within 30 days.
  • To delete your MyTribeERP account, follow the steps on our account deletion page.
  • To withdraw consent for a demo request, email hello@mytribeerp.com and we will delete it.

Some records cannot be deleted while the law requires us or the estate to keep them, for example financial records and audit trails. If so, we will tell you why.

14. Complaints

If you are unhappy with how we handle your data, please contact us first so we can put it right. You also have the right to complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

15. Contact us

For any privacy question or request, contact our Data Protection Officer:

Company
Clear Path Digital Consulting Limited
Email
hello@mytribeerp.com
Address
Lagos, Nigeria

16. Changes to this notice

We may update this notice. We publish each new version here and in the app with its date. If a change materially affects how we use your data, we will tell account holders in advance by email or in-app notice.