Privacy notice
Last updated: 29 October 2026
This notice is being reviewed by our legal advisers and may be updated.
This notice explains how Vintage Solutions collects and uses personal data when you visit vintageerp.com, contact us or sign up for our newsletter, and the rights you have under the Nigeria Data Protection Act 2023 (NDPA).
1. Who we are
Vintage Solutions ("we", "us", "our") runs the website at vintageerp.com. We also make Vintage People, our payroll and HR app at people.vintageerp.com, and Vintage ERP, which is in early access.
For the personal data described in this notice we are the data controller. This means we decide why and how the data is used.
You can contact our Data Protection Officer at privacy@vintageerp.com.
2. What this notice covers
This notice covers personal data we collect through this website, through our forms and newsletter, and when you email or call us.
It does not cover the employee data our customers keep in Vintage People. For that data your employer is the controller and we act on its instructions. See if you use Vintage People through your employer and our data processing agreement.
3. What we collect and why
Demo, quote and contact forms
When you fill in one of our forms we collect your name, work email, phone number, company, the product you are interested in, your number of employees, your message and any campaign tags (UTM tags) in the link you arrived from. We store this in our customer relationship system, Zoho CRM, and use it to reply to you, arrange a demo, prepare a quote and follow up on your enquiry.
Newsletter
If you sign up for our newsletter we collect your email address and store it in Zoho CRM so we can send you the newsletter.
Emails and calls
If you email us or call us on +234 814 071 0166, we keep your contact details and what you tell us so we can help you and keep a record of the conversation.
Help article feedback
If you tell us whether a help article was useful, we record the article, your answer and any comment you add. We do not ask for your name or email address for this, so please do not put personal details in the comment.
Website analytics
We use Vercel Analytics and Speed Insights to count page views and measure how quickly pages load. They do not use cookies and are not used to identify you.
If you accept analytics cookies in our cookie banner, we also use Google Analytics 4 to understand how visitors use the site, for example which pages they view and how they found us. Google Analytics does not run unless you accept.
Technical data
Our hosting provider, Vercel, processes technical data such as your IP address, browser type and the pages you request, so that the site can be delivered to you and protected against abuse.
Settings stored in your browser
The site keeps a few small items in your browser, such as your light or dark theme and your cookie choice. They stay on your device. Our cookie notice lists them.
4. Our lawful bases
We use personal data only where the NDPA gives us a lawful basis. We rely on the following.
- Consent: for the newsletter and for Google Analytics. You can withdraw consent at any time. This does not affect anything we did before you withdrew it.
- Contract: to take the steps you ask for before entering into a contract with us, such as preparing a quote or arranging a demo, and to manage a customer relationship.
- Legitimate interests: to reply to enquiries, follow up with business contacts, run cookieless analytics, keep the site secure and improve our products. We rely on this only where our interests are not outweighed by your rights, and you can object at any time.
- Legal obligation: to keep records the law requires, such as tax and accounting records, and to respond to lawful requests from regulators and courts.
7. International transfers
Some of our service providers store or process data outside Nigeria. Where personal data is transferred outside Nigeria, we rely on an adequacy decision or another lawful transfer basis under Part VIII of the NDPA, such as appropriate safeguards in our contract with the provider.
You can ask us for more information about these transfers at privacy@vintageerp.com.
8. How long we keep data
- Enquiries, demo and quote requests: up to 24 months after our last contact with you. If you become a customer, we keep your business contact details for as long as the customer agreement requires.
- Newsletter sign-ups: until you unsubscribe.
- Google Analytics data: for the retention period set in our Google Analytics account.
- Help article feedback and technical logs: for the period our hosting provider keeps runtime logs.
- Records we must keep by law: for the period the law requires.
When we no longer need personal data, we delete it or make it anonymous.
9. Your rights
Under the NDPA you have the right to:
- be told how your personal data is used, which is what this notice does
- access the personal data we hold about you and get a copy
- have inaccurate or incomplete data corrected
- have your data deleted where we no longer have a reason to keep it
- restrict how we use your data, for example while we look into a complaint
- receive your data in a commonly used, machine-readable format and have it sent to another organisation (data portability)
- object to our use of your data, including for direct marketing
- withdraw your consent at any time, where we rely on consent
- not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you
We do not make decisions about you based solely on automated processing.
10. How to use your rights
Email privacy@vintageerp.com and tell us which right you want to use. We may ask you to confirm your identity before we act, so that we do not give your data to someone else.
We will reply within 30 days of receiving your request. If we cannot do what you ask, we will explain why. There is no charge for making a request.
To stop receiving our newsletter, email privacy@vintageerp.com or use the unsubscribe link in the email.
11. Complaints
If you are unhappy with how we have handled your personal data, please contact us first at privacy@vintageerp.com so we can try to put it right.
You also have the right to complain to the Nigeria Data Protection Commission (NDPC). Its details are on its website at ndpc.gov.ng.
12. How we protect data
We use technical and organisational measures suited to the risk. The website is served over encrypted connections (HTTPS), and we use established providers for hosting and for our CRM.
In Vintage People, each customer's data is kept separate, sensitive fields are encrypted, access is based on each user's role and changes are recorded in an audit log. Our data processing agreement gives more detail.
No system is completely secure. If a breach affects your personal data and is likely to put your rights at high risk, we will tell you and the NDPC as the law requires.
13. Children
Our website and products are for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children through the website. If you believe a child has sent us personal data, email privacy@vintageerp.com and we will delete it.
14. If you use Vintage People through your employer
If your employer uses Vintage People for payroll, HR or employee self-service, your employer is the controller of your employee data and we process it on your employer's behalf. Your employer's own privacy notice explains how it uses your data.
To use your rights over that data, contact your employer. If you contact us instead, we will pass your request to your employer and help it respond.
We are the controller for the business contact details of the people who manage a customer's account, which we use to run the service, give support and send service messages.
15. Changes to this notice
We may update this notice when our services or the law change. The date at the top shows when it was last updated. If we make a significant change, we will say so clearly on this page.
16. Contact us
- Privacy questions and requests: privacy@vintageerp.com
- General enquiries: info@vintageerp.com
- Phone: +234 814 071 0166