Privacy Policy

PCIS Group Privacy Policy — POL-PRIVACY-001 — Effective Date: 27 September 2026

Covering PCIS Limited (Nigeria), Promethean Consulting Limited (Nigeria), and PCIS Cloud LTD (United Kingdom).

1. Introduction & Scope

PCIS, Promethean Consulting Limited, and PCIS Cloud LTD (together, the "PCIS Group", "we", "us", or "our") provide managed IT, cloud hosting, backup and disaster recovery, and patch management services to businesses in Nigeria, the United Kingdom, and other countries.

This Privacy Policy explains how we collect, use, share, and protect personal data, and applies across the PCIS Group brand. Because the Group operates through more than one legal entity, Section 2 identifies which entity is responsible for your personal data depending on your location and your relationship with us.

Where we provide managed IT services (such as patch management, cloud hosting, or backup/disaster recovery) to a business customer, we typically act as a data processor on that customer's behalf under a separate, signed Data Processing Agreement. This Policy describes our practices as a data controller, for our website visitors, sales contacts, job applicants, and employees. See Section 3 for more on this distinction.

2. Who We Are

The PCIS Group operates through the following legal entities. The entity responsible for your personal data as controller is ordinarily the entity named as the contracting party in your Service Agreement, Order Form, or invoice. If you are unsure which entity this is, contact us using the details in Section 16.

Registered addresses:

• PCIS Cloud LTD: 66 Paul Street, London, EC2A 4NA, United Kingdom
• PCIS Limited: Plot 10, Olabanji Olajide Street, Lekki Phase 1, Lagos, Nigeria
• Promethean Consulting Limited: Plot 10, Olabanji Olajide Street, Lekki Phase 1, Lagos, Nigeria

3. Our Role: Controller and Processor

The PCIS Group acts in two distinct capacities, depending on the data in question:

As a Data Processor
When we deliver managed IT services, such as patch management, cloud hosting, or backup and disaster recovery, on behalf of a business customer, we process personal data (for example, device names, usernames, or IP addresses on managed systems) strictly on that customer's documented instructions, under a signed Data Processing Agreement (DPA) between us and that customer. That customer is the controller of the data we process on their behalf. The terms of that specific DPA, not this general Policy, govern our handling of that data, including retention, sub-processors, and international transfer commitments specific to that engagement.

As a Data Controller
This Policy describes our practices as a controller, meaning where we decide how and why personal data is processed. This includes personal data belonging to our website visitors, sales and marketing contacts, job applicants, and our own employees and contractors.

4. What Personal Data We Collect

Website Visitors

• Standard web analytics data (pages visited, browser/device type, approximate location), collected via cookies and similar technologies [analytics tooling — to confirm]

Sales and Marketing Contacts

• Name, job title, company, email address, and phone number, collected when you contact us, request a quote, or attend an event

Customer Contacts

• Name, work email, job title, and phone number of individuals at customer organisations who we deal with in the course of delivering services or managing the commercial relationship

Job Applicants

• Name, contact details, CV/resume content, and interview notes, collected during recruitment

Employees and Contractors

• Standard HR data (contact details, right-to-work documentation, payroll and benefits information, performance records), handled separately under our internal HR policies

Note: Data processed by us on behalf of a customer under a signed DPA (for example, device metadata processed as part of a patch management or backup service) is not listed here — it is governed by that customer's own DPA, not this general Policy.

5. How and Why We Use Personal Data

• To deliver, manage, and support the services we are contracted to provide
• To respond to enquiries and provide quotes or proposals
• To manage billing, invoicing, and our commercial relationship with customers
• To maintain the security of our systems and the systems we manage
• To communicate updates, service notices, and, where you have agreed to receive them, marketing communications
• To comply with our legal, tax, and regulatory obligations
• To recruit and manage our workforce

6. Legal Bases for Processing

We rely on one or more of the following bases to process personal data as a controller: performance of a contract with you or your organisation, our legitimate interests (such as running and securing our business), your consent (for example, for marketing communications), or compliance with a legal obligation. See Annex A for Nigeria-specific terminology under the NDPA, and Annex B for UK GDPR Article 6 basis terminology.

7. Cookies and Website Analytics

Our website may use cookies and similar technologies to understand how visitors use our site and to improve it. [Specific analytics/cookie tooling in use — to confirm]. Where required by law, we will seek your consent before setting non-essential cookies. A dedicated Cookie Policy, with full detail on the specific cookies used, will be published separately.

8. Data Sharing and Subprocessors

We may share personal data with trusted third parties who support our operations, such as IT platform providers, hosting providers, and professional advisers, under appropriate confidentiality and data protection terms. [A maintained group-wide subprocessor list is to be confirmed and will be referenced here]. Where we act as a processor for a specific customer, any sub-processors used in that engagement are disclosed in the relevant DPA, not here.

9. International Data Transfers

As a group operating across Nigeria, the United Kingdom, and other countries, personal data we control may be accessed or stored in more than one country. Where we transfer personal data internationally, we take steps to ensure an appropriate level of protection, consistent with applicable law (see Annex A and Annex B).

Note: This general commitment does not override any specific, more restrictive international transfer commitment made to a customer in that customer's own Data Processing Agreement (for example, a commitment to host data only within the United Kingdom). Where such a specific commitment exists, it takes precedence for that customer's data.

10. Data Retention

We retain personal data for as long as necessary to fulfil the purposes described in this Policy, including to satisfy legal, accounting, or reporting requirements. [A detailed retention schedule by data category is to be confirmed and will be reflected here]. As a general principle, sales and marketing contact data is retained for as long as you remain an active contact or customer, and job applicant data is retained for a limited period after a recruitment process concludes unless you consent to us retaining it for future opportunities.

11. Security Measures

We maintain technical and organisational measures designed to protect personal data against unauthorised access, loss, or misuse, including access controls, encryption where appropriate, and staff confidentiality obligations. We do not publish detailed technical security configurations in this Policy, as doing so could itself create a security risk.

12. Your Rights

Depending on where you are located and which entity controls your data, you may have rights to access, correct, delete, restrict, or object to our processing of your personal data, and to receive your data in a portable format. You may also have the right to complain to your local data protection regulator. Jurisdiction-specific detail is set out in Annex A (Nigeria) and Annex B (United Kingdom).

13. Other Countries We Operate In

In addition to Nigeria and the United Kingdom, the PCIS Group supports customers in other countries, including Gambia, Sierra Leone, and Liberia. We are committed to applying data protection standards consistent with this Policy in those countries. Dedicated jurisdiction-specific annexes for these countries will be added as needed, based on confirmation of the applicable local law and the contracting arrangement in each case.

14. Children's Privacy

Our services are directed at businesses and are not intended for use by children. We do not knowingly collect personal data from children.

15. Changes to This Policy

We may update this Policy from time to time. Each annex shows its own effective date, so a change specific to one jurisdiction does not require reissuing the entire Policy. Material changes to the shared body of this Policy will be dated at the top of this document.

16. How to Contact Us

If you have questions about this Policy, or wish to exercise your rights, please contact us at: privacy@pcis.io.

---

Annex A: Nigeria

Applies to: personal data controlled by PCIS Limited or Promethean Consulting Limited, and to data subjects located in Nigeria. This Annex reflects the Nigeria Data Protection Act (NDPA) 2023.

Your Rights

• The right to be informed about how your personal data is processed
• The right to access your personal data
• The right to request correction of inaccurate personal data
• The right to request deletion of your personal data, subject to applicable exceptions
• The right to object to or restrict certain processing
• The right to data portability, where applicable
• The right to withdraw consent, where processing is based on consent

How to Complain

If you are not satisfied with how we have handled your personal data, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC).

Annex Effective Date: 27 September 2026

---

Annex B: United Kingdom

Applies to: personal data controlled by PCIS Cloud LTD, and to data subjects located in the United Kingdom. This Annex reflects the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Your Rights

• The right to be informed
• The right of access
• The right to rectification
• The right to erasure
• The right to restrict processing
• The right to data portability
• The right to object
• Rights related to automated decision-making and profiling

We aim to respond to a valid rights request within one month, as required under UK GDPR.

How to Complain

If you are not satisfied with how we have handled your personal data, you may lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent data protection regulator, at ico.org.uk.

Annex Effective Date: 27 September 2026