Legal

Privacy policy

Last updated 1 November 2026

What personal data ISPDock collects, why, who sees it, how long we keep it, and the rights you have over it.

1. Who we are

ISPDock is a product of Metasoft Limited, a company registered in Nigeria (RC 9918520) (“Metasoft”, “we”, “us”). This policy explains how we handle personal data when you visit ispdock.com, contact us, or use the ISPDock platform (the company dashboard, the customer portal and related apps).

We follow the Nigeria Data Protection Act 2023 (NDPA) and the rules of the Nigeria Data Protection Commission (NDPC). Questions about this policy or your data: hello@ispdock.com.

2. Our two roles

We are the data controller for data about visitors to this website, people who contact us or book a demo, and the internet service providers (“companies”) that subscribe to ISPDock and their staff users.

We are a data processor for data about each company’s own customers (their subscribers). The company decides why and how that data is used and is the controller of it; we store and process it only to run the platform for that company, on its instructions. If you are a customer of an internet provider that uses ISPDock, please contact your provider first about your data. We will help them answer you.

3. What we collect

Website visitors. Our servers record basic technical data with each request (IP address, browser type, the page asked for, date and time) to keep the site running and secure. The site sets no cookies and uses no tracking or advertising tools (see our cookie policy).

People who contact us. What you send us: your name, email address, phone number, company and message. Demo bookings are made through Calendly, which collects the details you enter there under its own privacy policy and passes them to us.

Companies and their staff. Company name and registration details, addresses, contact and billing details, and for each staff user their name, email address, phone number, role, password (stored only as a one-way hash), two-step sign-in settings, sign-in times and the actions they take in the dashboard (kept in an audit log).

Payments to us. Invoices and payment records for the subscription. Card and bank payments are taken by our payment provider; we never see or store full card numbers.

Data we process for companies (as processor): their customers’ names, contact details, addresses and location, identity documents provided for verification, plans, invoices, payments, connection and usage records, equipment details, support tickets and chats, and messages the company sends them.

4. Why we use it, and on what legal basis

  • To provide the platform and our services to the company that subscribed: performance of a contract.
  • To bill for the service and keep financial records: performance of a contract and legal obligation (tax and accounting law).
  • To keep the platform secure (sign-in protection, audit logs, fraud and abuse prevention, backups): legitimate interests, and our duty under the NDPA to protect data.
  • To reply to you and arrange demos: legitimate interests, or steps you asked for before a contract.
  • To send service messages (security alerts, invoices, changes to these terms): performance of a contract and legal obligation.
  • To improve the product using aggregated, non-identifying figures: legitimate interests.
  • Optional marketing emails, only with your consent, which you can withdraw at any time.

5. Who we share it with

We do not sell personal data. We share it only with service providers who help us run ISPDock, under contracts that require them to protect it and use it only for us. Depending on how a company sets up its account, these can include:

  • server hosting, file storage and off-site backup providers;
  • email delivery and SMS providers;
  • payment providers (for example Paystack, Flutterwave, Monnify or OPay; payments a company’s customers make go through that company’s own account with the provider);
  • map providers (OpenStreetMap, or Google Maps if a company connects its own key);
  • alert channels a company connects (such as Telegram or Slack), and Calendly for demo bookings.

We may also disclose data when the law requires it, to protect rights, safety or security, or as part of a merger or sale of the business (the buyer would be bound by this policy). We will tell you about such a transfer where the law requires it.

6. Transfers outside Nigeria

Some of our service providers store or process data outside Nigeria. When that happens we rely on the grounds the NDPA allows, such as an adequate level of protection in the receiving country, contractual safeguards, or your consent, and we take steps to keep the data protected to the standard of this policy.

7. How long we keep it

We keep personal data only as long as we need it for the purposes above or the law requires. As a guide:

  • company and staff account data: while the account is open, then up to six months after it closes (so a copy can be sent or the account restored), unless the company asks us to delete it sooner;
  • invoices and payment records: up to six years, as tax and accounting law requires;
  • audit logs and change history: up to two years; in-app notifications: 90 days;
  • connection records processed for companies: up to about 13 months;
  • backups: deleted on a rolling basis, generally within 30 days;
  • enquiries and demo requests: up to two years after the last contact.

Data we process for a company is deleted or returned when the company asks or when its subscription ends, as set out in our terms of service.

8. How we protect it

We use encrypted connections (HTTPS), one-way hashing for passwords, encryption for stored secrets such as payment keys, optional two-step sign-in, role-based access so staff see only what their role allows, separation between companies at the database level, audit logs of staff actions, and regular backups. No system is perfectly secure; if a breach puts your rights at risk we will notify the NDPC within 72 hours where the law requires it, and tell the companies and people affected without undue delay.

9. Your rights

Under the NDPA you can ask us to: tell you what data we hold about you and give you a copy; correct it; delete it; restrict or object to how we use it; move it to another provider in a common format; and not be subject to decisions made only by automated means that significantly affect you. Where we rely on consent you can withdraw it at any time.

Email hello@ispdock.com. We may need to confirm who you are first. We reply within 30 days. If you are not satisfied, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

If your data is held by an internet provider that uses ISPDock, send your request to that provider; we will help them deal with it.

10. Children

ISPDock is a business service and is not meant for anyone under 18. We do not knowingly collect children’s data for our own purposes. A company may hold data about customers of any age; it is responsible for having a lawful basis for that.

11. Changes to this policy

We may update this policy. The date at the top shows the latest version. If a change is significant we will tell companies by email or in the dashboard before it takes effect.

12. Contact

Metasoft Limited (RC 9918520), owner of ISPDock. Email: hello@ispdock.com.