Privacy notice | Elevo Consulting

Last updated: 5 November 2026

1. Who we are and what this notice covers

Elevo Consulting Ltd (“Elevo”, “we”, “us” or “our”) is a private limited company registered in Nigeria under RC 8605968. Elevo provides strategic advisory services in strategy, risk, governance, sustainability, and public policy and institutional reform. Our business office is at Waterfront Plaza (Vurin Suite), Plot 270 Ozumba Mbadiwe Avenue, Victoria Island, Lagos, Nigeria.

This Privacy Notice explains how we collect, use, disclose, store and protect personal data when you visit our website, contact us, submit a request for proposal, send documents to us, or apply to join our advisory network. It applies to website-related interactions. A separate engagement letter, contract or project privacy notice may apply when we provide advisory services or work with you on a client engagement.

For website enquiries and the activities described in this Notice, Elevo is generally the data controller because we decide why and how the relevant personal data is processed.

2. Personal data we may collect

The information we collect depends on how you interact with us. It may include:

Identity and contact details: Name, work email address, telephone number and other contact details you choose to provide.
Professional and organisation details: Employer or organisation, job title, role, industry or sector, and practice area of interest.
Enquiry and proposal information: The subject of your enquiry, project description, business needs, scope, proposal deadline, correspondence and documents you send to us.
Advisory network application information: Curriculum vitae, employment and consulting history, qualifications, professional experience, practice areas, references and your accompanying note.
Communications: Emails, telephone notes, messages, meeting requests and records of our communications with you.
Technical and security information: Internet Protocol address, browser and device details, operating system, pages requested, referral information, timestamps, diagnostic records and security events.
Cookie and browser-storage information: Information held in strictly necessary cookies or similar browser storage used for core site operation, security or remembering your privacy-notice choice.

Please do not send sensitive personal data, identity documents, financial account information, health information or personal data about another individual unless it is genuinely necessary for your request and you are authorised to provide it. We do not ask for such information through the website enquiry forms.

3. How we collect personal data

Directly from you when you complete an enquiry or proposal form, email us, telephone us, send a curriculum vitae or otherwise communicate with Elevo.
Automatically from your browser or device when you visit the website, including technical, diagnostic and security information needed to operate and protect the site.
From a person who submits information on your behalf, or from a professional reference you have authorised, where this is relevant to an advisory network application or engagement.

4. Why we use personal data and our lawful bases

We use personal data only for specified and legitimate purposes. Depending on the interaction, we rely on one or more lawful bases recognised by the Nigeria Data Protection Act 2023, including steps taken at your request before entering into a contract, performance of a contract, compliance with a legal obligation, consent, or legitimate interests where those interests are not overridden by your rights.

Responding to a general enquiry or introduction: Contact, professional and message details. Lawful basis: taking steps at your request before a possible contract and, where appropriate, our legitimate interest in managing business communications.
Receiving and evaluating a request for proposal or potential engagement: Contact, organisation, project, sector, deadline and tender information. Lawful basis: taking steps at your request before a contract, performance of a contract if we are appointed, and legal obligation where applicable.
Assessing advisory network applications: Curriculum vitae, qualifications, experience, references and application note. Lawful basis: our legitimate interest in assessing whether an applicant may be suitable for a current or anticipated engagement, and steps requested by the applicant before a possible contract.
Operating, securing and maintaining the website: Technical, device, usage and security information. Lawful basis: our legitimate interests in website operation, network security, fraud prevention, troubleshooting and service integrity.
Meeting legal, regulatory and professional obligations: Relevant contact, correspondence, proposal and engagement records. Lawful basis: compliance with a legal obligation and, where relevant, the establishment, exercise or defence of legal claims.
Direct marketing, if introduced in future: Contact details and recorded preferences. Lawful basis: consent where required. We do not use website forms to enrol you in a marketing mailing list.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Where we rely on another lawful basis, withdrawing consent will not automatically require us to stop processing that is lawfully based on a different ground.

5. Whether you must provide information

Fields marked as required on our forms are needed to understand and respond to your request. If you do not provide the required information, we may be unable to respond properly, evaluate a proposal or consider an advisory network application. Optional fields are identified as optional.

6. Who may receive personal data

We may disclose personal data, on a need-to-know basis and subject to appropriate safeguards, to:

Elevo principals, employees and authorised consultants who need the information to review an enquiry, assess an opportunity or perform an engagement.
Service providers that support website hosting, domain management, email, cloud storage, form delivery, spam prevention, cybersecurity, system maintenance and similar operational functions.
Professional advisers, including legal, audit, accounting and insurance advisers, where access is reasonably necessary.
A regulator, law-enforcement body, court or other public authority where disclosure is required or permitted by law, or is necessary to protect rights and safety.
A successor, purchaser or professional adviser in connection with a proposed reorganisation, merger or transfer of all or part of our business, subject to applicable privacy requirements.

We do not sell personal data. We do not permit service providers to use personal data received from Elevo for their own unrelated purposes, and our service providers are subject to appropriate contractual and security obligations.

7. International transfers

Some of our website hosting, domain, email, form delivery, cloud and security providers may store or access information from outside Nigeria. Where personal data is transferred from Nigeria or made accessible in another country, Elevo will do so only where a transfer condition permitted by sections 41 to 43 of the Nigeria Data Protection Act 2023 is satisfied. Depending on the circumstances, this may include an adequacy decision, an approved or otherwise permitted safeguard, or another statutory transfer condition. We document the applicable transfer basis and take appropriate steps to protect the information.

We maintain a record of our service providers, where they process data and the safeguards we rely on, and can provide further information on request.

8. How long we keep personal data

We keep personal data only for as long as reasonably necessary for the purposes described in this Notice, including any applicable legal, accounting, regulatory or claims-related requirements.

General website enquiries where no engagement follows: Up to 24 months after the last meaningful communication, then securely deleted or anonymised unless a legal or claims-related reason requires longer retention.
Requests for proposal and proposal submissions where no engagement follows: Up to 24 months after the relevant procurement or proposal process closes, then securely deleted or anonymised unless a legal or claims-related reason requires longer retention.
Advisory network applications where no engagement follows: Up to 12 months from receipt, then securely deleted unless you agree to a new retention period or a lawful exception applies.
Client and engagement records: For the engagement and for any additional period required by applicable law, contract, professional obligations or the reasonable establishment, exercise or defence of legal claims.
Website security and diagnostic logs: Normally up to 90 days, unless a security incident, investigation or legal requirement justifies a longer period.

If an application or enquiry becomes part of a client engagement, the engagement-record period may apply instead.

9. How we protect personal data

We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss or destruction. Measures may include access controls, restricted permissions, secure transmission, provider due diligence, staff confidentiality obligations and appropriate backups. No website, email transmission or storage system can be guaranteed to be completely secure.

If a personal data breach occurs, Elevo will assess it and make notifications to the Nigeria Data Protection Commission and affected individuals where and as required by applicable law and regulatory direction.

10. Your data protection rights

Subject to the Nigeria Data Protection Act 2023 and any applicable limitations, you may have the right to:

Request confirmation of whether we process your personal data and obtain access to it.
Request correction of inaccurate or incomplete personal data.
Request erasure or restriction of processing in circumstances provided by law.
Object to processing based on legitimate interests and object to direct marketing.
Withdraw consent where processing is based on consent.
Request portability of personal data where the statutory conditions apply.
Challenge a decision based solely on automated processing where the decision has legal or similarly significant effects, subject to the statutory framework.
Lodge a complaint with the Nigeria Data Protection Commission.

To exercise a right, email inquiry@elevoconsult.com with the subject line “Privacy request”. Tell us which right you wish to exercise and provide enough information for us to locate the relevant record. We may ask for proportionate information to verify your identity or authority. We will respond within the time limits and requirements of applicable law, and explain where a request cannot be fully met because a lawful exception applies.

11. Children

The website is designed for organisations, business leaders, professionals and prospective consultants. It is not directed to children, and we do not knowingly invite children to submit personal data. Please contact us if you believe a child has provided personal data through the website so that we can assess and address the matter in accordance with applicable law.

12. Third-party websites and services

The website may link to third-party websites or services, including professional and social platforms. Those websites operate under their own privacy notices and terms, and Elevo does not control their data practices. Review the relevant third-party notice before providing information to them.

13. Changes to this Notice

We may update this Notice to reflect changes in the law, our services, the website or the providers we use. The “Last updated” date shows when the Notice was most recently revised. Where required, we will bring material changes to your attention before the changed processing begins.

Contact details

Company: Elevo Consulting Ltd (RC 8605968), registered in Nigeria
Website: www.elevoconsult.com
Business office: Waterfront Plaza (Vurin Suite), Plot 270 Ozumba Mbadiwe Avenue, Victoria Island, Lagos, Nigeria
Privacy and general enquiries: inquiry@elevoconsult.com (please use the subject line “Privacy request” for data protection matters)
Advisory network applications: careers@elevoconsult.com
Regulatory complaints: You may lodge a complaint with the Nigeria Data Protection Commission at ndpc.gov.ng.