Privacy Policy

1. Who We Are

GSA Professional Services & Consulting is a Lagos, Nigeria-based consultancy offering professional accounting, tax, and business advisory services to individuals and businesses. For the purposes of the Nigeria Data Protection Act, 2023 (NDPA), GSA acts as a Data Controller in respect of data we collect directly from you, and as a Data Processor where we process data on behalf of a client business.

2. Information We Collect

We collect personal data in the course of providing our services and operating our website. This may include:

3. How We Collect Your Information

• Directly from you, when you complete an enquiry form, engage us for services, send us documents, or communicate via phone, email, or WhatsApp
• From publicly available sources, such as the Corporate Affairs Commission (CAC) or regulatory portals, where necessary to verify business information
• From third parties acting on your instruction, such as your bank, previous accountant, or business partners
• Automatically through our website, via cookies and similar technologies (see Section 9)

4. How We Use Your Information

We use your personal data for the following purposes:

• Preparing and filing tax returns (VAT, WHT, PAYE, CIT, and other statutory filings) with NRS and relevant State Internal Revenue Services
• Conducting bookkeeping, payroll management, and preparing financial statements
• Registering businesses and handling statutory filings with the CAC and other regulators
• Providing tax, financial, and business advisory and consultancy services
• Communicating with you about engagements, deliverables, and invoices
• Meeting our legal, regulatory, and professional obligations, including anti-money-laundering (AML) and Know-Your-Client (KYC) requirements
• Improving our services, website, and client experience
• Sending you updates, newsletters, or marketing communications, where you have consented to receive them

5. Legal Basis for Processing

Under the NDPA, we rely on one or more of the following legal bases to process your personal data:

• Consent – where you have given clear permission, such as opting in to marketing communications
• Contractual necessity – where processing is required to deliver the services you have engaged us for
• Legal obligation – where we must process data to comply with tax, corporate, or AML laws
• Legitimate interest – where processing is necessary for our legitimate business interests, such as maintaining client records, and does not override your rights

6. Sharing and Disclosure of Information

We do not sell your personal data. We may share your information with:

• Regulatory and statutory bodies, including the Nigerian Revenue Service (NRS), State Internal Revenue Services, the Corporate Affairs Commission (CAC), the Pension Commission (PenCom), and other relevant government agencies, as required to deliver our services
• Professional advisers, such as auditors, lawyers, or banks, where necessary and authorised by you
• Service providers, such as cloud storage, accounting software, and IT support providers, who process data on our behalf under confidentiality obligations
• Law enforcement or regulatory authorities, where required by law or to protect our legal rights

Any third party we share data with is required to protect it in a manner consistent with this Policy and applicable law.

7. Data Storage and Security

• We store personal data using secure, access-controlled digital systems and, where applicable, locked physical storage
• Access to client data is restricted to authorised personnel who need it to perform their duties
• We use reasonable technical and organisational measures, including passwords, encryption where applicable, and secure cloud platforms, to protect data against unauthorised access, loss, or misuse
• While we take data security seriously, no method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, tax, or reporting requirements. Financial and tax records are generally retained for a minimum of six (6) years, in line with Nigerian statutory record-keeping requirements, or longer where required by law. Once data is no longer needed, we securely delete or anonymise it.

9. Cookies and Website Tracking

Our website may use cookies and similar technologies to enhance your browsing experience, understand website traffic, and improve our content. Cookies are small text files stored on your device. You can control or disable cookies through your browser settings; however, doing so may affect certain website features.

10. Your Rights

As a data subject under the NDPA, you have the following rights regarding your personal data:

To exercise any of these rights, please contact us using the details in Section 13. We will respond within the timeframe required by applicable law.

11. Children's Privacy

Our services and website are intended for businesses and individuals aged 18 and above. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected data from a minor, we will take steps to delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. Any updates will be posted on this page with a revised effective date. We encourage you to review this Policy periodically.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us: