1 Who we are
Devleka Technologies Limited ("Devleka", "we", "us") is a software company registered in Nigeria (RC 9868605). We build web, mobile and enterprise applications, provide cloud infrastructure and IT consultancy, and develop business automation and messaging solutions for our clients.
This policy explains how we handle personal data across our website, our own services, and the software we build and operate on behalf of clients.
Contact: hello@devleka.com
2 Our two roles
How we handle data depends on the context.
As a data controller. When you visit devleka.com, contact us, or engage us as a client, we decide how your data is used. This policy governs that data.
As a data processor. When we build or operate software for a client, including WhatsApp messaging systems, chatbots and customer engagement tools, the client is the data controller. We process end-user data only on that client's documented instructions. The client's own privacy policy governs how that data is used, and end users should direct requests to the client in the first instance.
3 Data we collect
Website visitors
- Technical data: IP address, browser type, device type, pages visited, referring URL
- Contact data you submit: name, email address, phone number, and the content of your message
Clients and prospective clients
- Name, business name, email address, phone number, billing address
- Project requirements, correspondence, contract and invoicing records
End users of systems we operate for clients
Where a client engages us to build or run a messaging or automation system, we may process the following on the client's behalf:
- Phone number and WhatsApp profile name
- Message content, including text, images, documents and other media sent to or from the client's business number
- Message metadata: timestamps, delivery and read status, message identifiers
- Any information an end user chooses to provide during a conversation, such as an order reference or a delivery address
- Records of automated or agent responses sent in reply
We do not collect this data for our own purposes and we do not use it to build profiles, train models or market to end users.
4 WhatsApp Business Platform
Some systems we build use the WhatsApp Business Platform (Cloud API) provided by Meta Platforms, Inc.
- The WhatsApp Business Account and phone number belong to our client, not to Devleka, unless expressly agreed otherwise in writing.
- Messages are transmitted through Meta's infrastructure and are subject to Meta's own terms and privacy practices. See Meta's WhatsApp Business Privacy Policy for details.
- End users initiate contact with the client's business number or opt in through the client's own channels. We do not send unsolicited messages.
- End users can stop receiving messages at any time by replying STOP, by blocking the business number, or by contacting the client directly.
- We use message data solely to deliver the messaging service the client has engaged us to provide.
5 Why we process data
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries | Legitimate interest, or steps prior to a contract |
| Delivering contracted services | Performance of a contract |
| Operating messaging systems for clients | Processing on a controller's instructions |
| Invoicing, accounting and tax records | Legal obligation |
| Securing and maintaining our systems | Legitimate interest |
| Marketing communications | Consent |
7 Retention
- Website enquiries: up to 24 months from last contact
- Client records and correspondence: for the life of the engagement, then as long as required for tax and legal purposes
- Financial records: at least 6 years
- End-user message data processed for clients: for the period the client specifies. On termination of the engagement, we return or delete it on the client's instruction, subject to any legal obligation to retain it.
8 Security
We apply measures appropriate to the data we handle, including encryption in transit (TLS), encryption of stored credentials and access tokens, role-based access control, restricted production access, logging, and regular patching of servers and dependencies.
No system is completely secure. If a breach affects your personal data, we will notify you and the relevant authority where the law requires it.
9 Your rights
Under the Nigeria Data Protection Act 2023, you have the right to:
- Request access to the personal data we hold about you
- Request correction of inaccurate or incomplete data
- Request deletion of your data, subject to our legal obligations
- Object to or restrict processing in certain circumstances
- Withdraw consent at any time, where processing relies on consent
- Request your data in a portable format
- Lodge a complaint with the Nigeria Data Protection Commission
To exercise a right, email hello@devleka.com. We respond within 30 days.
If your request concerns data we process on behalf of a client, we will refer you to that client, who is the controller of that data.
11 Children
Our services are not directed at children under 18, and we do not knowingly collect their personal data. If you believe a child has provided us with data, contact hello@devleka.com and we will delete it.
12 Changes
We may update this policy from time to time. The current version is always published at https://devleka.com/privacy, with the date of the last update shown at the top. Material changes will be communicated to clients directly.