8MB Tech Services Limited (Corporate Affairs Commission (CAC) registration number RC 2005741)
Last updated: 27 October 2026
This policy explains what personal data we collect through 8mbtech.com, why we collect it, who we share it with and what your rights are. We have tried to keep it in plain English.
1. Who we are
8MB Tech Services Limited (“8MB Tech”, “we”, “us”) is a technology company based in Lagos, Nigeria. It provides software developers, development support, project management, workspace and AI services. It was incorporated on 30 November 2022 and is registered with the CAC under number RC 2005741.
- Place of business: Suite B6, 3 Military Street, Lagos Island, Lagos 101231, Nigeria
- Email: hello@8mbtech.com
- Phone: +234 707 622 7724
- Data Protection Officer: Data Protection Officer, 8MB Tech Services, at hello@8mbtech.com
We are the “data controller” of the personal data described in this policy. That means we decide how and why it is used.
The law that applies is the Nigeria Data Protection Act 2023 (the “NDPA”). The regulator is the Nigeria Data Protection Commission (the “NDPC”), at ndpc.gov.ng.
Section 44 of the NDPA requires a data controller of major importance to register with the NDPC, and section 32 requires one to have a Data Protection Officer. The NDPC’s Guidance Notice on Registration of Data Controllers and Data Processors of Major Importance, dated 19 December 2024, sets out who must register.
2. What personal data we collect
When you use our contact form
We collect what you type into the form:
- your name
- your email address
- the subject of your enquiry
- your message
With it, the form also sends the address and title of the page you sent it from, and whether you ticked the consent box, together with the wording of that box.
Your message may contain other personal data if you choose to include it. Please only include what we need to answer you.
When you pay for a workspace plan
If you choose a workspace plan and pay online, you give us your email address, and the payment is handled by Paystack. You enter your card details on Paystack’s own payment form; we do not see or store them. Paystack keeps a record of the payment, with your email address, the plan and a payment reference, which we can see.
When you chat with us
The site has a chat window provided by HubSpot. It appears only if you accept optional cookies. If you use it, what you write in the chat is sent to us through HubSpot.
When you book a call
Our “Book a call” buttons open a booking page run by HubSpot. When you book, you give us your name, your email address, the time you chose and anything you type in the booking form. HubSpot stores your details in our HubSpot account.
When you visit the website
When you first visit, a cookie banner asks whether you accept optional cookies. Google Analytics, HubSpot tracking, the HubSpot chat window, HubSpot form capture and the LinkedIn Insight Tag load only if you click Accept. If you click Reject, or do nothing, they do not load. You can change your choice at any time with the “Cookie settings” link at the bottom of every page.
- Google Analytics. If you accept, we use Google Analytics 4 to see how the site is used: the pages you visit, the page you came from, when you visit, your approximate location, and the device and browser you use. Google receives your IP address. We switch off Google’s advertising features and do not link Google Analytics data to your name or email address.
- Analytics and tracking data. If you accept, we use HubSpot tracking on the site. It records information about how you use the site: the pages you visit, the page you came from, when you visit and how many times, and the device and browser you use, including screen size, language and a code derived from your browser’s settings. HubSpot recognises your browser on later visits through the cookies listed below, and receives your IP address.
- Form capture. If you accept, HubSpot’s form-capture tool is loaded. It may record details you type into forms on the site, such as an email address, and HubSpot may link them to your browsing.
- Advertising measurement. If you accept, the site loads the LinkedIn Insight Tag, through HubSpot. It tells LinkedIn which pages you visit, so that we can measure our LinkedIn advertising and reach people who have visited the site. LinkedIn receives your IP address and can link your visit to your LinkedIn account if you have one.
- Spam protection data. The contact form uses Google reCAPTCHA to tell people from automated bots. reCAPTCHA collects information about your device and how you interact with the page, and sends it to Google. It loads when you open the contact page.
- Hosting and security. Every visit passes through Cloudflare, which protects and speeds up the site, and reaches our web server, hosted by IONOS. Both receive your IP address and the details your browser sends with each request.
Cookies
Our own website code sets one cookie, cc_cookie, which remembers your cookie choice. It holds no personal
data. The Google Analytics, HubSpot and LinkedIn cookies below are set only if you accept optional cookies in
the cookie banner. The reCAPTCHA and Paystack cookies are set when you open the contact form or the payment
form. If you change your choice to Reject, we delete the Google Analytics and HubSpot cookies we can reach
and reload the page. You can also block or delete cookies in your browser settings, or contact us (see
section 7).
| Cookie | Set by | Purpose | How long it lasts |
|---|---|---|---|
cc_cookie | 8MB Tech | Remembers your cookie choice | 6 months |
_ga, _ga_<ID> | Google Analytics | Tells visitors apart and counts sessions and page views | 2 years |
hubspotutk | HubSpot | Identifies your browser, so visits and form submissions from the same browser can be linked | 6 months |
__hstc | HubSpot | Main tracking cookie: records your first, last and current visit and how many sessions you have had | 6 months |
__hssc | HubSpot | Tracks the current session and how many pages you view in it | 30 minutes |
__hssrc | HubSpot | Tells HubSpot whether you have restarted your browser | Until you close your browser |
messagesUtk | HubSpot | Recognises you in the chat window, so a returning visitor sees their earlier conversation | 6 months |
LinkedIn cookies (for example bcookie, lidc) | LinkedIn, on linkedin.com | Advertising measurement and audiences, as described above. Lifetimes are listed in LinkedIn’s cookie table | Set by LinkedIn |
_GRECAPTCHA | Google, on google.com, contact page only | Spam protection (reCAPTCHA) | 6 months |
| Paystack cookies | Paystack, only when you open the payment form | Processing your payment. See Paystack’s privacy notice on its website | Set by Paystack |
3. Why we use your data and our lawful basis
We must have a lawful basis under section 25 of the NDPA to use your personal data. Ours are:
| What we do | Why | Lawful basis under the NDPA |
|---|---|---|
| Store your contact-form enquiry in HubSpot and reply to it | So we can answer the question you asked us and keep a record of it | Your consent (section 25(1)(a)). You give it by ticking the box on the form, which reads: “I agree that 8MB Tech may store my details in HubSpot (its servers are outside Nigeria) and use them to reply to this enquiry. I can withdraw this consent at any time by emailing hello@8mbtech.com.” |
| Take payment for a workspace plan (Paystack) | So we can provide the plan you bought | Performing our contract with you (section 25(1)(b)(i)) |
| Answer you in the chat window | So we can answer the question you asked us | Our legitimate interest in responding to people who contact us (section 25(1)(b)(v)) |
| Arrange and hold a call you booked (HubSpot Meetings) | So we can meet you at the time you chose and prepare for it | Taking steps at your request before a contract (section 25(1)(b)(i)) |
| Protect the form from spam and abuse (reCAPTCHA) | To keep the site secure and working | Our legitimate interest in keeping the site secure (section 25(1)(b)(v)) |
| Understand how the site is used (Google Analytics, HubSpot tracking and form capture) | To see which pages are useful and improve the site | Your consent (section 25(1)(a)), given by clicking Accept on the cookie banner |
| Measure our LinkedIn advertising and show our adverts on LinkedIn to people who have visited the site (LinkedIn Insight Tag) | To see whether our adverts work and to reach past visitors | Your consent (section 25(1)(a)), given by clicking Accept on the cookie banner |
Where we rely on legitimate interest, we have weighed it against your rights and interests, and you can object (see section 7). Where we rely on consent, you can withdraw it at any time, as easily as you gave it. Withdrawing consent does not affect what we did with your data before you withdrew it.
We do not use your contact-form details to send you marketing emails. The form does not sign you up to any mailing list. If we add a marketing sign-up in future, it will be optional and unticked, and we will update this policy.
4. Who we share your data with
We share personal data only with the service providers that help us run the site and handle enquiries. They process data on our behalf or for their own stated purposes, as described below.
| Provider | What it does | What data it receives |
|---|---|---|
| HubSpot | Stores contact-form submissions, provides site tracking, the chat window and form capture, loads the LinkedIn Insight Tag, and runs our call-booking page | The contact-form fields listed above, chat messages, tracking data, call-booking details and your IP address |
| Google (Analytics) | Shows us how the site is used, if you accept optional cookies | Pages visited, device and browser details, approximate location and your IP address |
| Google (reCAPTCHA) | Checks that form submissions come from a person | Device and interaction data from the contact page, and your IP address |
| Measures our advertising and builds audiences for it | The pages you visit, your IP address, and LinkedIn’s own cookies | |
| Paystack | Takes payment for workspace plans | Your email address, the plan, and the card details you enter on its payment form |
| Cloudflare | Protects the site and delivers it quickly | Your IP address and the details your browser sends with each request |
| IONOS | Hosts the web server | Your IP address and the details your browser sends with each request, in the server’s logs |
Contact-form enquiries are stored in HubSpot.
We do not sell your personal data.
We may also disclose personal data if the law requires it, for example to a court or a regulator.
5. Transfers outside Nigeria
HubSpot, Google, LinkedIn, Cloudflare and IONOS are companies based outside Nigeria, so the data you submit through the site’s forms and chat, and the analytics, tracking, advertising and reCAPTCHA data described above, will be processed outside Nigeria. Paystack operates in Nigeria.
- Where HubSpot stores our data: HubSpot’s data centre in the European Union.
- Safeguards: section 41(1)(a) of the NDPA allows personal data to leave Nigeria where the recipient is bound by contractual clauses that give an adequate level of protection. We rely on the standard contractual clauses in the data protection terms of HubSpot and Google. We record the basis for each transfer, as section 41(2) requires. In addition, where you tick the box on the contact form, that consent covers the transfer of the data concerned to HubSpot, and the box tells you before you agree that its servers are outside Nigeria. Countries outside Nigeria may not protect personal data to the same standard as Nigerian law. You can withdraw consent at any time (section 7).
If you do not want your data to leave Nigeria, please do not use the online forms or chat. Contact us instead by phone on +234 707 622 7724, by email at hello@8mbtech.com, or by post to our place of business in section 1.
6. How long we keep your data
- Contact-form enquiries in HubSpot: for 24 months after our last contact with you, then we delete them.
- Chat conversations: for 24 months after our last contact with you, then we delete them.
- Tracking and analytics data: for no longer than 26 months. Cookies expire on the dates in the table in section 2.
- Payment records: for as long as the law requires us to keep accounting records. Paystack keeps its own records under its own policy.
When a retention period ends we delete the data or make it anonymous.
7. Your rights
Under the NDPA you have the right to:
- be informed about how we use your personal data, which is what this policy is for (section 27)
- access the personal data we hold about you, and get a copy in a commonly used electronic format (section 34(1)(a) and (b))
- correct data that is wrong or incomplete (section 34(1)(c))
- ask us to delete your data, without undue delay, in the circumstances the law sets out (section 34(1)(d) and (2))
- restrict how we use your data while a request or objection is being resolved (section 34(1)(e))
- object to us using your data where we rely on legitimate interest. We will stop unless we can show grounds that override your rights (section 36(1) and (2)). You can object at any time to the use of your data for direct marketing, including LinkedIn advertising and related profiling, and we will then stop using it for that purpose (section 36(3) and (4))
- withdraw your consent at any time, as easily as you gave it (section 35)
- not be subject to a decision based only on automated processing, including profiling, that has legal or similarly significant effects on you (section 37). We do not make decisions of that kind. HubSpot tracking builds a record of your visits that we can link to an enquiry you send us, and LinkedIn can include you in an audience for our adverts. This is profiling, but it does not lead to decisions about you. You can block the cookies in your browser, and you can object to profiling for marketing at any time (section 36(3))
- data portability: to receive the data you gave us, where we use it on the basis of your consent or a contract, in a structured, commonly used, machine-readable format, and to have it sent to another provider where that is technically possible (section 38 of the NDPA and Article 37 of the NDPC’s General Application and Implementation Directive 2025)
To use any of these rights, contact us using the details in section 8. We may need to check your identity first. We aim to reply within 30 days. The NDPA requires us to act “without constraint or unreasonable delay” (section 34(1)), and we will not wait for the full 30 days if we can answer sooner.
If you are unhappy with how we have handled your data, you can complain to the Nigeria Data Protection Commission at ndpc.gov.ng (section 46(1)). We would appreciate the chance to put things right first.
8. How to contact us
For anything in this policy, or to use your rights:
- Email: hello@8mbtech.com, marked for the attention of the Data Protection Officer
- Post: 8MB Tech Services Limited, Suite B6, 3 Military Street, Lagos Island, Lagos 101231, Nigeria
- Phone: +234 707 622 7724
9. Other things to know
- Security. The site is delivered over an encrypted connection. We do not see or store card details. If a personal data breach is likely to put your rights and freedoms at risk, we will tell the NDPC within 72 hours of becoming aware of it, as section 40(2) of the NDPA requires. If the breach is likely to put you at high risk, we will tell you immediately, in plain language, with advice on what you can do to protect yourself (section 40(3)).
- Links to other sites. The site links to other websites, including Google’s. We are not responsible for their privacy practices. Google’s own privacy policy and terms apply to reCAPTCHA (policies.google.com/privacy, policies.google.com/terms).
- Changes to this policy. If we change it, we will post the new version on this page and update the date at the top. If a change is significant, we will also say so on the contact page.