Privacy Policy

1. Who we are

Benchmarked (benchmarked.ng) is run by [Company legal name], RC number [RC number], [registered address]. We decide how and why your personal data is used on Benchmarked, so we are its data controller under the Nigeria Data Protection Act 2023 (NDPA).

Questions or requests about your data: [privacy contact email]. Our Data Protection Officer is [DPO name or role].

2. The short version

You can browse Benchmarked without an account. We do not use analytics or advertising trackers.
If you create an account, we keep your email address private. Reviews show only the name you choose.
We never sell your personal data, and companies listed on Benchmarked never get your email address.
You can see, change or delete your data, and you can complain to the Nigeria Data Protection Commission.

3. What we collect

When you create and use an account

Your email address, the display name you choose and your password (stored only in scrambled, hashed form).
If you sign in with Google, Facebook or LinkedIn: an account ID from that service, and the name and email address it shares with us. We do not get your password for those services or access to your contacts or posts.
Whether you have confirmed your email address, and when you joined.

When you write or interact with reviews

Your review: its title, text, ratings, the product, dates, and any changes you make.
Moderation records: whether the review was approved, declined or removed, and the reason.
“Helpful” votes you give and reports you make, including any note you add.

When you claim a company profile

Your name, work email address, job role and the company, and any documents you upload to show you can act for it.
Changes you suggest to the company’s profile.

When you visit

Your IP address, used for a short time to stop spam and abuse (for example, limiting how many accounts or reviews can be sent from one connection). Our security records keep only a scrambled, shortened form of it.
Basic technical information your browser sends (such as browser type), which our hosting provider records in server logs.

4. How we use it, and why

To run your account and publish your reviews, because you asked us to (performance of our agreement with you under our Terms of Use).
To check reviews and claims and keep the site honest: moderation, spotting fake reviews and spam, checking that a company representative is genuine. This is in our legitimate interest, and yours as a reader, in reviews that can be trusted.
To send you emails about your account, such as confirming your email address, resetting your password, and updates on a company claim you have made. We do not send marketing emails unless you have agreed to them.
To keep the site secure and to deal with abuse, legal claims and requests from authorities, where the law requires it.

5. What other people can see

Published reviews show your chosen display name, your ratings, your text and the date. Your email address is never shown publicly and is never given to the companies you review. If you represent a company, your name is not shown publicly; the profile shows only that it has been claimed.

We never sell personal data. We share it only with service providers that help us run Benchmarked, under agreements that require them to protect it:

Hosting: Hostinger, which stores the site and its data in [server location].
Email delivery: [email provider], which sends our account emails.
Sign-in services: Google, Facebook or LinkedIn, only if you choose to sign in with them.
AI services: if we switch on an AI service to help spot spam or summarise reviews, we send it review text with names, phone numbers, email addresses and similar details removed first. We never send your account details. [Name the provider here if one is switched on.]

We may also disclose data where the law requires it, to protect people from harm, or to establish or defend legal claims.

7. Data sent outside Nigeria

Some of our providers store or process data outside Nigeria. When that happens we rely on the safeguards the NDPA allows, such as the recipient country’s data protection laws or contractual protections, and we only send what the service needs.

8. How long we keep it

Your account: while it is open. When you ask us to delete it, your reviews are taken down and their text and ratings are deleted. We keep a minimal record (which product, dates and status) to protect against abuse; it is no longer linked to you.
Votes and reports: votes are deleted with your account; reports stay as records of moderation but no longer show who made them.
Company claim documents: deleted 90 days after we decide the claim.
Other claim details: personal details are removed 12 months after an unsuccessful claim is decided, or 12 months after someone stops representing a company.
Security and activity logs: kept for up to 12 months.

9. Cookies

We only use cookies the site needs to work:

Sign-in cookies that keep you signed in: until you close your browser, or for two weeks if you choose “Keep me signed in”.
Short-lived security cookies used while you sign in with Google, Facebook or LinkedIn, which expire within minutes.

We do not use analytics, advertising or tracking cookies. If that changes, we will update this policy first and ask for your consent where the law requires it.

10. Your rights

Under the NDPA you can ask us to:

give you a copy of the personal data we hold about you;
correct data that is wrong or incomplete;
delete your data;
restrict or object to how we use it;
send your data to you, or to another service, in a common format; and
withdraw any consent you have given.

You can change your name and password, and ask for your account to be deleted, from your account page. For anything else, email [privacy contact email]. We will reply within 30 days. If you are unhappy with how we handle your data, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

11. Keeping data safe

We use encrypted connections (HTTPS), store passwords in hashed form, limit staff access to what each person needs, keep records of important actions, and delete or anonymise data on the schedule above. No system is perfectly secure; if a breach puts your data at risk, we will tell you and the Commission as the law requires.

12. Children

Benchmarked is not meant for anyone under [18], and you must be [18] or older to create an account. If we learn that a child has given us personal data, we will delete it.

13. Changes to this policy

We will update the “last updated” date at the top of this page when we change this policy, and tell account holders by email about important changes before they take effect.