Privacy Policy

1. Introduction

Welcome to Montana Angels. This Privacy Policy outlines how Montana Angels WAF Ltd. ("We", "Us", "Our"), the data controller for the website https://montanaangels.com ("the Website"), collects, uses, processes, and protects your personal information.

We are committed to protecting your privacy and ensuring that your personal data is handled in a safe and responsible manner, in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

This policy applies to all visitors, users, and others who access the Website ("You", "Data Subject").

2. The Data Controller

For the purpose of the UK GDPR, the data controller is:

• Company Name: Montana Angels WAF Ltd.
• Head Office: 14A Oba Elegushi Street, Ikoyi, Lagos, Nigeria

If you have any questions about this privacy policy or our data protection practices, please contact our Data Protection Officer (DPO) or privacy team at:

• Email: [email protected]
• Postal Address: Attn: Data Protection Officer, 14A Oba Elegushi Street, Ikoyi, Lagos, Nigeria

3. Information We Collect

We may collect, use, store, and transfer different kinds of personal data about you, which we have grouped together as follows:

• Identity Data: Includes first name, last name, username or similar identifier, title, and company name.
• Contact Data: Includes billing address, delivery address, email address, and telephone numbers.
• Financial Data: Includes bank account and payment card details (Note: We typically use third-party payment processors, and We may only store partial information, such as the last four digits of a card).
• Transaction Data: Includes details about payments to and from you and other details of products or services you have purchased from us.
• Technical Data: Includes Internet Protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this Website.
• Profile Data: Includes your username and password, purchases or orders made by you, your interests, preferences, feedback, and survey responses.
• Usage Data: Includes information about how you use our Website, products, and services, such as pages viewed, navigation paths, and time spent on site.
• Marketing and Communications Data: Includes your preferences in receiving marketing from us and our third parties and your communication preferences.

We also collect, use, and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity.

4. How Your Personal Data is Collected

We use different methods to collect data from and about you, including:

• Direct Interactions: You may give us your Identity, Contact, and Financial Data by filling in forms (e.g., "opt-in" forms, contact forms, newsletter subscriptions) or by corresponding with us by post, phone, email, or otherwise.
• Automated Technologies or Interactions: As you interact with our Website, we will automatically collect Technical Data about your equipment, browsing actions, and patterns. We collect this personal data by using cookies, server logs, web beacons, tracking pixels, and other similar technologies. This includes, but is not limited to, tracking via analytics providers (like Google Analytics) and advertising networks (like Google Ads, Meta/Facebook).
• Third Parties or Publicly Available Sources: We may receive personal data about you from various third parties, including:
  • Technical Data from analytics providers (e.g., Google).
  • Advertising networks (e.g., Meta).
  • Search information providers.
  • Contact, Financial, and Transaction Data from providers of technical, payment, and delivery services.

5. Legal Basis for Processing Your Data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

Purpose/Activity	Type of Data	Lawful Basis for Processing (UK GDPR)
To register you as a new customer/user.	Identity, Contact	Performance of a Contract with you.
To process and deliver your order or service.	Identity, Contact, Financial, Transaction	(a) Performance of a Contract (b) Legitimate Interest (to recover debts).
To manage our relationship with you (e.g., customer service, notifications).	Identity, Contact, Profile	(a) Performance of a Contract (b) Legitimate Interest (to keep records updated).
To enable you to partake in a promotion, competition, or survey.	Identity, Contact, Profile, Usage	(a) Legitimate Interest (to study service usage) (b) Consent (where required).
To administer and protect our business and this Website (security, troubleshooting, data analysis, system maintenance).	Identity, Contact, Technical	(a) Legitimate Interest (for running our business, network security) (b) Legal Obligation.
To deliver relevant website content, advertisements, and marketing communications to you.	Identity, Contact, Profile, Usage, Marketing, Technical	(a) Legitimate Interest (to develop our business) (b) Consent (for third-party marketing or electronic marketing via PECR).
To use data analytics (e.g., Google Analytics) to improve our Website, services, marketing, and customer experience.	Technical, Usage	Legitimate Interest (to define types of customers, to keep our Website updated).
To respond to your direct inquiries (e.g., via a contact form).	Identity, Contact	(a) Consent (by you submitting the form) (b) Legitimate Interest (to respond to inquiries).

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

6. Data Sharing and Disclosures

We may share your personal data with the parties set out below for the purposes outlined in Section 5:

• Internal Third Parties: Other companies within the Montana Angels WAF Ltd. group (if any).
• External Third Parties (Service Providers):
  • IT and system administration service providers (e.g., web hosting, email servers).
  • Marketing automation and CRM providers.
  • Analytics providers (e.g., Google, Semrush).
  • Advertising networks and platforms (e.g., Google Ads, Meta, LinkedIn).
  • Payment processing providers.
• Professional Advisers: Lawyers, bankers, auditors, and insurers based in the United Kingdom who provide professional services.
• HM Revenue & Customs (HMRC), regulators, and other authorities: Based in the United Kingdom who require reporting of processing activities in certain circumstances.
• Business Transfers: Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

7. International Data Transfers

Many of our external third parties (e.g., Google, Meta) are based outside the United Kingdom (UK). Therefore, their processing of your personal data will involve a transfer of data outside the UK.

Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the UK Government.
• Where we use certain service providers, we may use specific contracts approved for use in the UK which give personal data the same protection it has in the UK (known as Standard Contractual Clauses or SCCs, or the UK's International Data Transfer Agreement).

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK.

8. Data Security

We have implemented appropriate technical and organizational security measures designed to prevent your personal data from being accidentally lost, used, or accessed in an unauthorized way, altered, or disclosed. These measures include:

• Use of Secure Sockets Layer (SSL) encryption for data transfer.
• Limiting access to your personal data to those employees, agents, and contractors who have a business need to know.
• Regular security reviews and malware scanning.
• Implementing procedures to deal with any suspected personal data breach.

9. Data Retention

We will only retain your personal data for as long as is reasonably necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting, or reporting requirements.

To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorized use, the purposes for which we process it, and the applicable legal requirements.

By law, we have to keep basic information about our customers (including Contact, Identity, Financial, and Transaction Data) for six years after they cease being customers for tax purposes.

10. Your Legal Rights (UK GDPR)

Under UK data protection laws, you have rights in relation to your personal data:

1. Right to be Informed: To be provided with clear, transparent, and easily understandable information about how we use your information.
2. Right of Access: To request access to your personal data (a "data subject access request").
3. Right to Rectification: To request correction of inaccurate or incomplete data.
4. Right to Erasure: To request the deletion or removal of your personal data where there is no compelling reason for us to keep using it (the 'right to be forgotten').
5. Right to Restrict Processing: To 'block' or suppress further use of your information.
6. Right to Data Portability: To obtain and reuse your personal data for your own purposes across different services.
7. Right to Object: To object to certain types of processing, including direct marketing.
8. Right to Withdraw Consent: Where processing is based on consent, you have the right to withdraw that consent at any time.

If you wish to exercise any of these rights, please contact us at the details provided in Section 2.

11. Cookies and Tracking Technologies

Our Website uses cookies and similar technologies (such as pixels, beacons, and scripts) to distinguish you from other users. This helps us to provide you with a good experience when you browse our Website and also allows us to improve our site and marketing.

We use the following types of cookies:

• Strictly Necessary Cookies: Essential for the operation of our Website.
• Analytical/Performance Cookies: Allow us to recognize and count visitors and see how they move around our Website (e.g., Google Analytics).
• Functionality Cookies: Used to recognize you when you return to our Website.
• Targeting/Advertising Cookies: Record your visit, the pages you visited, and the links you followed. We use this information to make our Website and the advertising displayed on it more relevant to your interests. We may share this data with third parties (e.g., Meta, Google) for this purpose.

Upon your first visit, you will be presented with a cookie banner requesting your explicit consent for non-essential cookies. You can manage your cookie preferences at any time via our cookie banner or your browser settings.

12. Links to Other Websites

Our Website may contain links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements.

13. Children's Privacy

Our Website is not intended for children under the age of 18, and we do not knowingly collect data relating to children.

14. Changes to This Privacy Policy

We keep our privacy policy under regular review. This version was last updated on the date stated at the top. Any changes will be posted on this page, and, where appropriate, notified to you by email.

15. How to Complain

If you are not satisfied with our response to any query you raise, you have the right to make a complaint to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues.

• Website: https://ico.org.uk/make-a-complaint/
• Helpline: 0303 123 1113