This Privacy Policy explains how Tornado-Tech collects, uses, shares, and protects personal data across our products and services — including the ResearchGains data-intelligence and survey platform and the Opinyze polling product. We are committed to processing personal data lawfully, fairly, and transparently, in line with the Nigeria Data Protection Act (NDPA) 2023, the General Data Protection Regulation (UK GDPR / EU GDPR), and other applicable laws.
01Who we are
Tornado Tech Nigeria Ltd. and Tornado Tech Ltd. (United Kingdom) (together, "Tornado-Tech", "we", "us", "our") are the data controllers responsible for the personal data described in this policy, except where we act as a data processor on behalf of a client (for example, when running a survey or poll commissioned by an organisation).
Where we process data on a client's instructions, that client is the controller and their own privacy notice governs how your data is used; we handle it only as set out in our agreement with them and in this policy.
02Data we collect
We collect the following categories of personal data, depending on how you interact with us:
Respondent and survey data
- Responses you provide to surveys, polls, and research instruments, which may include opinions, demographic details, and other information relevant to a study.
- Approximate location data (for example, your state and local government area) used to ensure representative sampling.
- Device and technical data collected by our offline-first mobile data-collection tools, such as app version and submission timestamps.
Account and contact data
- Identifiers such as your name, email address, phone number, and organisation.
- Records of your communications with us and your preferences.
Website and usage data
- Log data such as IP address, browser type, and pages viewed.
- Cookie and similar-technology data, as described in our Cookies section below.
We minimise the personal data we collect. Wherever a study allows it, survey and poll data is pseudonymised or aggregated so that individual respondents cannot be readily identified from the results we deliver to clients.
03How we use your data
We use personal data to:
- Deliver our services, including collecting, cleaning, analysing, and reporting research and polling data.
- Recruit, verify, and communicate with respondents in our enumerator and respondent network.
- Operate, secure, and improve our platforms, including quality assurance and fraud prevention.
- Respond to enquiries and provide support.
- Send service and, where you have consented, marketing communications.
- Comply with legal, regulatory, and contractual obligations.
04Legal basis for processing
Under the NDPA 2023 and GDPR, we rely on one or more of the following legal bases:
| Basis | When we rely on it |
|---|---|
| Consent | Participation in surveys and polls, and optional marketing. You may withdraw consent at any time. |
| Contract | Providing services you or your organisation have requested. |
| Legitimate interests | Improving and securing our platforms, provided your rights do not override those interests. |
| Legal obligation | Meeting requirements under applicable law and regulation. |
06International transfers
As an organisation operating in both Nigeria and the United Kingdom, we may transfer personal data across borders. Where we do, we put appropriate safeguards in place — such as standard contractual clauses or reliance on an adequacy decision — so that your data continues to receive a level of protection consistent with the NDPA 2023 and GDPR.
07Data retention
We keep personal data only for as long as necessary for the purposes described in this policy, or as required by law or a client contract. Survey and poll responses are typically retained in pseudonymised or aggregated form for research integrity and audit purposes, and identifiable contact data is deleted or anonymised when it is no longer needed.
08Your rights
Subject to applicable law, you have the right to:
- Access the personal data we hold about you.
- Request correction of inaccurate or incomplete data.
- Request deletion of your data.
- Object to or restrict certain processing.
- Withdraw consent at any time, without affecting prior lawful processing.
- Request portability of data you provided to us.
- Lodge a complaint with a supervisory authority — the Nigeria Data Protection Commission (NDPC) or, in the UK, the Information Commissioner's Office (ICO).
To exercise any of these rights, contact us using the details below. We will respond within the timeframes required by applicable law.
10Children's data
Our services are not directed at children. We do not knowingly collect personal data from anyone under the age of 18 without appropriate parental or guardian consent and a lawful basis. If you believe a minor has provided us with data, please contact us so we can address it.
11Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you. We encourage you to review this page periodically.