FirstRep for Businesses Privacy Policy

This Privacy Policy applies to the business-facing version of FirstRep used by gyms, fitness studios, and similar businesses.

It covers information we collect directly from business customers and authorized staff users, as well as personal data processed on behalf of business customers through the service.

FirstRep processes personal data in line with the Nigeria Data Protection Act 2023 (NDPA) and the guidance of the Nigeria Data Protection Commission (NDPC). Where we serve customers outside Nigeria, we also comply with the data protection laws that apply in those countries.

We use information to operate and improve FirstRep for Businesses.

• • Provide, secure, and support the service
• • Manage subscriptions, billing, and account administration
• • Maintain analytics, dashboards, and product performance
• • Communicate about service updates, security, and support
• • Comply with legal obligations and enforce our terms

For business account information, FirstRep generally acts as a controller because we determine how that account and billing information is used to operate the service.

For member and staff personal data submitted by a business through the platform, the business customer is the controller and FirstRep acts as a processor or service provider on the customer's behalf.

Business customers are responsible for obtaining any notices, consents, and permissions required to use the platform lawfully.

We may share information only as needed to operate the service.

• • With hosting, infrastructure, analytics, and support providers
• • With payment processors for billing administration
• • To comply with law, regulation, or valid legal requests
• • To protect the rights, safety, security, and integrity of FirstRep, our customers, and end users

Every service provider we use is bound by confidentiality and data protection obligations and may only process data as needed to provide its service to us.

We maintain administrative, technical, and organizational safeguards designed to protect information processed through the service.

• • Encryption of data in transit and at rest, with appropriate access controls
• • Internal authentication and permission management
• • Monitoring, logging, backups, and recovery processes
• • Staff confidentiality and security practices

No platform can guarantee absolute security, but we take commercially reasonable steps to protect the data entrusted to us.

If we become aware of a personal data breach affecting customer data, we will notify the affected business customer without undue delay, and in any case within 48 hours of becoming aware of it. We will share what happened, what data was affected and the steps we are taking, and we will support the customer in meeting its own reporting obligations to the NDPC.

Customer data is hosted with our cloud infrastructure provider on servers located in Europe.

Because this involves transferring personal data outside Nigeria, we rely on the safeguards permitted under the NDPA, including recognised data protection standards and contractual protections with our service providers.

We retain data while an account is active and for a reasonable period after termination to support account closure, dispute resolution, legal compliance, and operational continuity.

When a customer account ends, we keep customer data for 90 days so the customer can request an export. After that, we delete or anonymise it, unless we are required by law to keep it longer. Deleted data may remain in encrypted backups for up to a further 30 days before it is overwritten.

Authorized business customers may request access, correction, export, or deletion of business account information we control, subject to legal and operational limitations.

If a member or staff person wants to exercise rights over data submitted by a business through the service, that request should usually be directed first to the relevant business, which controls that data.