Privacy Policy
Effective date: 19 July 2026
This Privacy Policy explains how GLI Consults ("GLI Consults", "we", "us", or "our") collects, uses, shares, and safeguards personal information when you use STRATOSCAN, including the diagnostic, portal, and reports (the "Service"). It applies to founders, operators, partner staff, and administrators who interact with STRATOSCAN. It is written to comply with the Nigeria Data Protection Act 2023 ("NDPA") and, where applicable, the EU and UK General Data Protection Regulation ("GDPR").
1. Controller and contact
GLI Consults is the data controller for personal information processed through STRATOSCAN. You can reach our privacy team at privacy@gliconsults.com. For security reports, contact security@gliconsults.com.
2. Information we collect
- Account and business details you provide: full name, work email, phone number, role, business name, sector, country, business stage, and team size.
- Diagnostic content: the answers you submit, the zone scores, band, bottleneck, canvas, and narrative report we generate from them.
- Collaboration data: invitations you send, collaborators you grant access to, and referrals you make.
- Authentication and security data: hashed credentials, sign-in timestamps, IP address, browser and device metadata, and audit-log entries needed to operate and protect the Service.
- Communications: emails we send you (transactional and, where you opt in, marketing) and any messages you send to us.
- Usage telemetry: pages viewed, actions taken, error diagnostics, and cookie identifiers used to keep the Service reliable and secure.
We do not intentionally collect special-category data (for example, health or biometric data) and ask that you not submit such data through the Service.
3. How and why we use your information
| Purpose | Lawful basis (NDPA / GDPR) |
|---|---|
| Create your account and deliver your report and portal | Performance of a contract |
| Send transactional emails (sign-in links, report ready, security alerts) | Performance of a contract; legitimate interests in secure operation |
| Match you to partner funding, cohorts, and support programmes | Consent (you can withdraw at any time) |
| Produce anonymised benchmarks and research | Consent, with the ability to opt out; legitimate interests in improving the Service |
| Send occasional product and programme updates | Consent (unsubscribe link in every message) |
| Detect fraud, abuse, and security incidents; maintain audit logs | Legal obligation; legitimate interests in a safe service |
| Comply with legal, regulatory, and reporting obligations | Legal obligation |
4. Sharing your information
We share personal information only in the ways described here:
- Partner organisations. If you arrived through a partner link or joined a partner programme, your identified diagnosis may be shared with that partner so they can offer you funding, cohorts, or support. You can turn this off in Account & data.
- Anonymised aggregates. We share sector, country, and benchmark aggregates with our wider partner and research network. Individual businesses cannot be identified from these aggregates.
- Collaborators you invite. Anyone you invite to your portal can see the scan and role you grant them.
- Service providers that host, secure, email, and support the Service (for example, cloud infrastructure, authentication, and email delivery partners). They act on our instructions under written data-processing terms.
- Legal and safety. We may disclose information where required by law, court order, or to protect the rights, property, or safety of GLI Consults, our users, or the public.
- Corporate transactions. If GLI Consults is involved in a merger, acquisition, or asset sale, personal information may be transferred, subject to equivalent protections and notice to affected users.
We do not sell your personal information.
5. International transfers
Some of our service providers are located outside your country of residence, including outside Nigeria and the European Economic Area. When we transfer personal data internationally, we rely on appropriate safeguards such as adequacy decisions, Standard Contractual Clauses, or equivalent measures required under the NDPA and GDPR.
6. Retention
We keep your diagnostic data for as long as your account exists so you can revisit your reports and track progress over time. If you delete your account, we detach your identity from your scans within 30 days and retain only anonymised diagnostic answers for benchmarking, research, and legal-record purposes. Audit logs, billing records (if any), and security-incident records may be retained for up to seven years to comply with legal obligations.
7. Your rights
Under the NDPA and, where applicable, the GDPR, you have the right to:
- access the personal information we hold about you;
- correct information that is inaccurate or incomplete;
- delete your account and personal information ("right to erasure");
- export your data in a portable format;
- object to or restrict certain processing;
- withdraw consent at any time for processing based on consent;
- lodge a complaint with a supervisory authority. In Nigeria, the Nigeria Data Protection Commission (NDPC); in the EU/UK, your local data-protection authority.
You can exercise most of these rights directly from Account & data in your portal, or by contacting privacy@gliconsults.com. We will respond within 30 days.
8. Security
Data is transmitted over TLS and stored in access-controlled infrastructure with encryption at rest. Row-level security rules restrict access to your data to you and any collaborators you invite. We maintain audit logs, least-privilege access for staff, and incident-response procedures. No system is perfectly secure; if we become aware of a personal-data breach that is likely to affect you, we will notify you and the relevant authorities as required by law.
9. Cookies and similar technologies
We use strictly necessary cookies and local-storage entries to keep you signed in, remember your preferences, and secure the Service. We use limited analytics to understand aggregate usage. We do not use advertising or cross-site tracking cookies. You can control cookies through your browser settings; disabling strictly necessary cookies may break sign-in and portal features.
10. Children
STRATOSCAN is not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.
11. Automated decision-making
Your STRATOSCAN report is generated by algorithmic scoring and AI-assisted narrative. It does not produce legal or similarly significant decisions about you on its own; it is a decision-support tool. You can request human review of any output by contacting privacy@gliconsults.com.
12. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will update the "Effective date" above and, for material changes, notify you by email or through the portal before the changes take effect.
13. Contact
Data-protection queries: privacy@gliconsults.com. Security reports: security@gliconsults.com. Postal address is available on request.