Privacy Policy

Last updated: 17 July 2026

First Pavilion Technologies ("we", "us", "our") respects your privacy. This policy explains what personal data we collect through our website at firstpavitech.com, why we collect it, the lawful grounds we rely on, who we share it with, how long we keep it, and the rights you have — with the Nigeria Data Protection Act 2023 (NDPA) as the primary legal framework, alongside regulations and guidance issued by the Nigeria Data Protection Commission (NDPC).

Effective date: 17 July 2026 · Last meaningful update: 17 July 2026 (consent-based analytics, AI-assistant disclosure, NDPA alignment).

1. Who We Are

First Pavilion Technologies is a technology consultancy and product-engineering company based in Abeokuta, Ogun State, Nigeria. For anything in this policy, contact us at:
First Pavilion Technologies
4, Law Castle, Taiwo Street, Omida - Ibara, Abeokuta, Ogun State, Nigeria
[email protected] (use the subject "Privacy Request" for data-protection matters)
0901 461 4613

2. Information We Collect

Information you give us directly:

• Enquiry details — name, email address, and message content, plus optional phone number, organisation, budget range, timeline, and preferred contact method, when you use our contact form.
• Assistant conversations — the messages you type to the Pavilion Assistant chat widget (see section 6).
• Business communications — information you share with us by email, phone, or WhatsApp when discussing or running a project.

Information collected automatically:

• Server logs — our hosting infrastructure records standard technical logs (such as IP address, request URL, and timestamp) used for security and reliability.
• Analytics data — pages visited, clicks, device and browser type, approximate location derived from IP address, and session replays with all form inputs masked. Analytics run only if you allow them in our cookie banner (see section 5).

We do not run user accounts, newsletters, job-application forms, or payment collection on this website, and we do not knowingly collect sensitive personal data through it.

3. Purposes and Lawful Grounds

Under the NDPA, we rely on the following grounds:

• Steps at your request before a contract, and contract performance — responding to your enquiry, preparing proposals, and delivering engagements.
• Consent — optional analytics cookies and the optional embedded map. You can decline or withdraw at any time (section 5), and declining does not affect your use of the site.
• Legitimate interests — keeping the website secure and reliable (server logs, spam protection) and managing business relationships, balanced against your rights.
• Legal obligation — where we must retain or disclose information to comply with applicable law.

We do not sell or rent personal data, and we do not share it with third parties for their marketing.

4. Contact-Form Processing

Contact-form submissions are delivered to us by Formspree, a third-party form-processing service (United States), under its own privacy policy. We use your submission to respond to your enquiry and manage any resulting business relationship. The form includes an invisible anti-spam field and client-side validation; analytics events about the form never include what you typed.

5. Cookies, Analytics, and Your Choice

When you first visit, a consent banner asks whether to allow optional analytics. No analytics scripts load before you choose, refusing is as easy as accepting, and you can change your choice at any time via Cookie Settings in the footer. Withdrawing consent reloads the page so trackers are actually removed.

Strictly necessary (no consent needed):

• fp-theme (local storage) — remembers your light/dark theme choice.
• fp-consent (local storage) — remembers your cookie decision.

Analytics (load only if you allow them):

• PostHog (processed in the United States) — pages visited, clicks, device and browser type, approximate location from IP, referrer, session duration, and session replays in which all form inputs are masked. PostHog sets cookies/local storage to distinguish visitors. We also honour your browser's Do Not Track signal.
• Metricool (European Union) — aggregate visit statistics for our marketing reporting.

We use no advertising, retargeting, or cross-site tracking cookies. Analytics are disabled in our development environment.

6. The Pavilion Assistant (AI Chat)

The chat widget on this site is an automated AI assistant, not a person, and it says so when it greets you. Your messages are sent to our server, which retrieves relevant published website content and forwards the conversation to Groq (United States) to generate a reply; if the AI service is unavailable, a scripted helper answers directly in your browser instead. We do not store chat transcripts on our servers — only anonymous usage metrics (timestamps, token counts, model used, error types). The conversation itself lives in your browser for the current page visit and is gone when you leave or clear the chat.

• Please don't share passwords, financial details, or other sensitive personal data in the chat.
• Assistant answers are informational — they are not quotes, contracts, or binding commitments.
• You can download a copy of your conversation from the chat window at any time. The file is generated in your browser and is never sent to or stored on our servers.
• A human alternative is always available: the assistant can hand you to our phone, WhatsApp, and contact-form channels at any time.

7. Third-Party Services and Hosting

The website relies on these providers:

• Hetzner (Germany) — server hosting for this website and the assistant endpoint (managed via Coolify), including standard server logs.
• Formspree (US) — contact-form delivery (section 4).
• PostHog (US) and Metricool (EU) — consent-based analytics (section 5).
• Groq (US) — AI replies for the chat assistant (section 6).
• Google Fonts — the Raleway typeface is loaded from Google's servers, which receive your IP address as part of serving the files.
• Google Maps — the map on our contact page loads only after you press "Load map"; Google then receives your IP address and may set cookies.
• Content delivery networks — static images are served from DigitalOcean Spaces, and technology logos from jsDelivr; CDNs receive the IP address making the request.
• WhatsApp (Meta) — "Chat on WhatsApp" links open WhatsApp; anything you send there is processed under Meta's terms and privacy policy.

8. International Processing

Some providers above process data outside Nigeria (mainly the United States and the European Union). Where that happens, we use established providers with published security and data-protection commitments, and we review those arrangements as part of our ongoing compliance programme in line with the NDPA's provisions on cross-border transfers.

9. How We Protect Information

We apply reasonable organisational and technical safeguards: encrypted HTTPS connections, access limited to authorised people, server-side API keys that never reach the browser, masked form inputs in any session replay, and minimal data collection by design. No method of transmission or storage is completely secure, so we cannot promise absolute security — but we work to protect the information entrusted to us and to improve these measures over time.

10. How Long We Keep Data

We keep personal data only as long as needed for the purpose it was collected:

• Enquiries — for as long as needed to respond and, where a business relationship follows, for its duration plus any legally required period.
• Analytics — subject to the retention settings of our analytics providers; you can prevent collection entirely by declining consent.
• Chat conversations — not stored by us; they end with your page visit.
• Server logs — kept for a limited period for security and troubleshooting, then rotated.

11. Your Rights

Under the NDPA you may, subject to its conditions:

• Ask what personal data we process about you, and request a copy (access).
• Ask us to correct inaccurate or incomplete data.
• Ask us to delete your data.
• Ask us to restrict processing, or object to processing based on legitimate interests.
• Receive data you provided in a portable format, where applicable.
• Withdraw consent at any time (for analytics, use Cookie Settings in the footer — withdrawal is immediate).
• Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects — we do not make such decisions with your data.
• Lodge a complaint with the Nigeria Data Protection Commission.

To exercise any of these rights, email [email protected] with the subject "Privacy Request". We may need to verify your identity, and we respond without undue delay. If you are unhappy with our response, you can complain to us directly or to the NDPC.

12. Privacy Incidents

If a personal-data breach occurs, we assess its impact and notify the NDPC and affected individuals where the NDPA requires it, and we document what happened and what we changed as a result.

13. Children's Privacy

Our services are not directed at individuals under 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such information, please contact us and we will delete it.

14. Changes to This Policy

When we make meaningful changes to this policy, we update the dates at the top of this page and summarise what changed. Significant changes to how we process personal data take effect from the stated effective date, not retroactively.

15. Our Data-Protection Position