Privacy Policy & Data Protection Notice
Last updated: October 22, 2026 • Effective Date: October 22, 2026 • Corporate Controller: Cyber Ultimax Limited
Compliance Foundation: Nigeria NDPA 2023 & Global Data Protection
Governing Spike Console, Cyber Ultimax Limited, and the NattyPad ecosystem.
1. Corporate Ownership & Holding Entity:Spike Console is an autonomous business operating subsidiary of Cyber Ultimax Limited ("Cyber Ultimax", "we", "us", or "our"), incorporated under the laws of the Federal Republic of Nigeria. Cyber Ultimax serves as the primary Data Controller for account, billing, and identity data across the group.
2. Cross-Ecosystem Synergy with NattyPad:NattyPad serves as the founder discovery engine and community top-of-funnel for Spike Console. User identities, startup benchmarks, and public company profiles registered on NattyPad seamlessly interconnect with Spike Console workspaces under unified Cyber Ultimax governance and single sign-on (SSO).
3. Statutory Rigor: We adhere stringently to the Nigeria Data Protection Act 2023 (NDPA 2023) under the supervisory oversight of the Nigeria Data Protection Commission (NDPC), the Cybercrimes (Prohibition, Prevention, etc.) Act 2015/2024, the European Union General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA).
4. Zero Unauthorized Sale of Data: We never sell, monetize, or lease your private personal, employee, or corporate financial data to third-party data brokers or advertisers.
Two Distinct Roles: Controller vs. Processor
To ensure strict regulatory compliance under Section 24 of the NDPA 2023 and GDPR Article 4, we define two clear capacities in which Cyber Ultimax operates:
A. Cyber Ultimax as Data Controller
We act as the Data Controller for your account identity, email addresses, password hashes, payment records, session telemetry, audit logs, and direct communications. We determine the legal purposes and lawful bases for processing this administrative information.
B. Cyber Ultimax as Data Processor
For all operational records you or your team enter into a Workspace (including employee personnel files, payroll and salary data, customer CRM leads, supplier invoices, and quotes), You (the Customer / Business) are the Data Controller, and Cyber Ultimax acts strictly as your Data Processor. We process this operational information solely in accordance with your explicit instructions, our Terms of Service, and our Data Processing Agreement (DPA).
Granular Data Categories We Collect
Depending on your interaction with the platform, we collect the following categories of data:
- Account & Workspace Profile: Full name, corporate email address, encrypted salted password hashes, phone number, company name, incorporation jurisdiction, sector, and workspace membership roles (Owner, Manager, Staff).
- People & Statutory Payroll Data: Employee names, national identification details (where required for tax remittances), remuneration amounts, bank account disbursement numbers, pension fund administrator (PFA) pins, and leave records.
- Financial & Commercial Records: Customer invoices, billing addresses, VAT tax calculations, accounts payable/receivable ledgers, order history, inventory movements, and quotation line items.
- Autonomous AI & Advisor Prompts: Business strategy prompts, SWOT analysis criteria, performance metrics, and workflow automation trigger configurations.
- Technical Telemetry & Security Audit Logs: IP address, device fingerprints, operating system, browser user-agent, session tokens, CSRF tokens, timestamped route navigation events, and chunk reload timestamps.
Lawful Bases for Processing (NDPA & GDPR Matrix)
In accordance with Section 25 of the NDPA 2023 and GDPR Article 6, we only process personal information where an established lawful basis applies:
| Processing Purpose | Data Category | NDPA 2023 Lawful Basis | GDPR Article 6 Basis |
|---|---|---|---|
| Account Creation & SSO | Identity & Credentials | Section 25(1)(b) Contractual Necessity | Article 6(1)(b) Contract Performance |
| Workspace Provisioning & RLS Isolation | Tenant Data & Role Assignments | Section 25(1)(b) Contractual Necessity | Article 6(1)(b) Contract Performance |
| Statutory Payroll & Tax Ledgering | Employee Compensation & Tax Info | Section 25(1)(c) Legal Obligation | Article 6(1)(c) Legal Obligation |
| Payment & Subscription Processing | Transaction Identifiers & Billing Records | Section 25(1)(b) Contractual Necessity | Article 6(1)(b) Contract Performance |
| Autonomous AI Advisor Strategy Tools | Operational Metrics & Prompts | Section 25(1)(a) Consent / Contract | Article 6(1)(b) Contract Performance |
| NattyPad Ecosystem Synergy & Benchmarks | Public Founder Traction & Deal Flow | Section 25(1)(a) Explicit Consent | Article 6(1)(a) Consent |
| Security Auditing & Fraud Prevention | IP Addresses, Logs & Telemetry | Section 25(1)(f) Legitimate Interest | Article 6(1)(f) Legitimate Interests |
Enterprise AI Inference & Zero Training on Customer Workspaces
When you utilize the AI Advisor, SWOT analysis, or automated summarization modules:
- Zero Foundational Training on Private Workspace Data: Your private workspace CRM data, employee records, and financials are transmitted via encrypted zero-retention enterprise API inference endpoints. They are NEVER ingested by third-party model providers (e.g. Anthropic) to train or tune public foundational models.
- Transient Ephemeral Context: Prompt payloads are discarded immediately following the generation of the response completion, save for encrypted caching directly inside your tenant's isolated database schema.
Subprocessors & Cross-Border Data Transfers
To provide high-availability cloud infrastructure, Cyber Ultimax utilizes vetted enterprise subprocessors:
- • Cloud Infrastructure: Amazon Web Services (AWS) - Encrypted compute & database hosting.
- • Payment Processing: Paystack (Nigeria/Africa), Flutterwave (Pan-Africa), Stripe (Global).
- • AI Inference: Anthropic Enterprise (Claude 3.5 Sonnet / Haiku inference clusters).
- • Communications: Termii, Twilio, Amazon SES, SendGrid.
Cross-Border Safeguards (NDPA Part VI & GDPR Chapter V): Where personal data is transferred across international borders from Nigeria or the European Economic Area (EEA), we enforce Standard Contractual Clauses (SCCs), data transfer impact assessments (DTIAs), and ensure destination adequacy standards satisfy NDPC and European Commission guidelines.
Your Statutory Data Subject Rights
Under Sections 34-39 of the NDPA 2023 and GDPR Articles 15-22, you possess enforceable rights over your personal data:
1. Right to Access & Portability
Obtain full copies of your stored personal and workspace data in structured, machine-readable format.
2. Right to Rectification
Rectify inaccurate, out-of-date, or incomplete personal data at any time from workspace settings.
3. Right to Erasure ("Forgotten")
Request permanent deletion of your account records, subject to statutory tax and financial retention laws.
4. Right to Object & Restrict
Object to processing based on legitimate interest or restrict automated analytical operations.
To exercise your rights, email our Data Protection Office directly at dpo@cyberultimax.com. We respond within thirty (30) days without undue delay.
Security Controls & 72-Hour Breach Notification
Cyber Ultimax employs defense-in-depth security architectures:
- Encryption Everywhere: AES-256 cryptographic encryption for all persistent data volumes at rest, and TLS 1.3 encryption for all data in transit across HTTPS and WSS connections.
- PostgreSQL Row-Level Security (RLS): Database-level tenant boundaries guaranteeing that unprivileged database roles are physically incapable of reading across workspace boundaries.
- Mandatory Incident Notification: Under Section 40 of the NDPA 2023 and GDPR Article 33, in the unlikely event of a security breach compromising your personal data, Cyber Ultimax will notify the Nigeria Data Protection Commission (NDPC) and affected Workspace Owners within seventy-two (72) hours of confirmation.
Data Protection Officer & Regulatory Recourse
For any questions, compliance audits, or data rights requests:
Cyber Ultimax Data Protection Office
Designated DPO: dpo@cyberultimax.com
General Compliance: legal@cyberultimax.com
If you are located in Nigeria and feel your privacy rights have not been adequately addressed, you have the statutory right to lodge an administrative complaint directly with the Nigeria Data Protection Commission (NDPC) at https://ndpc.gov.ng.