Preamble and Regulatory Framework
M360 Solutions Group Limited (“M360”, “we”, “us”, or “our”) is committed to processing personal data lawfully, fairly, transparently, and securely.
This Privacy Policy governs the processing of personal data in connection with M360’s white label advertising technology platform hereinafter refers as (the “Platform”). The Platform is powered by technology proprietary to Eskimi (“Eskimi”) and made available to clients and partner agencies under the M360 brand.
Issued in accordance with Applicable Nigerian Legal Instruments:
- The Constitution of the Federal Republic of Nigeria, 1999 (as amended), particularly Section 37;
- The Nigeria Data Protection Act, 2023 (“NDPA”);
- The Nigeria Data Protection Act General Application and Implementation Directive, 2025 (“GAID”);
- All regulations, guidance notices, directives, and orders issued by the Nigeria Data Protection Commission (“NDPC”); and
- Other applicable Nigerian laws and regulations.
Together, these are referred to as the “Applicable Data Protection Laws.”
Scope
This Policy applies to:
Advertisers and other entities for whom M360 executes advertising campaigns through the Platform.
Third party agencies granted access to the Platform through M360 to provide advertising services to their own clients.
Natural persons whose personal data is processed in connection with advertising campaigns delivered through the Platform.
Directors, officers, employees, agents, and contact persons of Clients and Partner Agencies.
Individuals who access M360's website, dashboards, reporting tools, or support channels.
Individuals whose personal data is collected during commercial engagement with M360.
Policy Hierarchy
This Policy forms part of M360’s data protection governance framework. Where a written Data Processing Agreement (“DPA”), Joint Controller Arrangement, campaign terms, client agreement, or agency agreement contains more specific data protection obligations, those terms shall prevail over this Policy to the extent of any inconsistency.
Nothing in this Policy limits or excludes any right available to a Data Subject under the NDPA or GAID.
Definitions and Interpretation
In this Policy, unless the context otherwise requires:
- a. Data Controller
- A person or entity that, alone or jointly with others, determines the purposes and means of the processing of personal data.
- b. Data Processor
- A person or entity that processes personal data on behalf of, and on the documented instructions of, a Data Controller.
- c. Data Subject
- An identified or identifiable natural person to whom personal data relates.
- d. Joint Controllers
- Two or more entities that jointly determine the purposes and means of a processing activity.
- e. Personal Data
- Any information relating to an identified or identifiable natural person, including pseudonymized data capable of reidentification.
- f. Sensitive Personal Data
- Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, sex life, sexual orientation, or other categories prescribed under applicable law.
- g. Processing
- Any operation performed on personal data, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, transmission, dissemination, restriction, erasure, or destruction.
- h. Sub-Processor
- A third party engaged by M360 or a Data Processor to process personal data on behalf of a Data Controller.
- i. Consent
- A freely given, specific, informed, and unambiguous indication of a Data Subject’s agreement to the processing of personal data.
- j. Data Privacy Impact Assessment (DPIA)
- An assessment conducted to identify and minimize data protection risks arising from processing activities likely to result in a high risk to the rights and freedoms of Data Subjects.
- k. SNAG
- A Data Subject’s Standard Notice to Address Grievance issued under the GAID.
- l. General Rule of Interpretation
- Words importing the singular include the plural and vice versa. Headings are for convenience only and do not affect interpretation.
Data Controller & Processor Roles in the White Label Arrangement
5.1 White Label Structure
M360 operates the Platform as a white label solution. Eskimi’s advertising technology is presented and made commercially available under the M360 brand.
M360 maintains a parent account through which it provides and administers sub accounts for Clients and Partner Agencies. Clients and Partner Agencies access Eskimi’s advertising services through M360, while M360 retains administrative oversight of their accounts and campaigns.
5.2 Allocation of Roles
The classification of M360, Clients, Partner Agencies, and Eskimi as Data Controllers, Data Processors, or Joint Controllers depends on the actual processing activity and the degree of control exercised over the purposes and means of processing, rather than contractual labels alone.
(a) M360 as Data Controller
M360 acts as a Data Controller in respect of:
- The establishment, administration, security, and oversight of the parent account and sub accounts;
- The management of its commercial relationships with Clients, Partner Agencies, Eskimi, vendors, and prospective business partners;
- The processing of registration, account, billing, communication, and support data relating to Client and Partner Agency representatives;
- Campaign execution where M360 determines or materially influences the campaign objective, audience selection, targeting parameters, creative deployment, optimization strategy, or measurement methodology;
- Compliance with M360’s own legal, tax, regulatory, and corporate obligations; and the operation, improvement, and protection of the Platform.
(b) M360 as Data Processor
M360 acts as a Data Processor where it processes End User personal data solely on the documented instructions of a Client or Partner Agency for the purpose of executing an advertising campaign, and where M360 does not determine the purposes or essential means of that processing.
In such circumstances, the Client or Partner Agency remains responsible for ensuring that it has a lawful basis for the processing, that appropriate notices and consents have been obtained where required, and that the personal data supplied to M360 is accurate, lawful, and permitted for the intended use.
(c) Joint Controllership
M360 and a Client or Partner Agency may act as Joint Controllers where they jointly determine the purposes and means of a particular processing activity, including collaborative decisions relating to campaign targeting, audience segmentation, measurement, or data enrichment.
Where Joint Controllership applies, the parties shall document their respective responsibilities in a Joint Controller Arrangement or applicable campaign terms, including responsibility for providing privacy information to Data Subjects; responding to Data subject requests; handling complaints and SNAG notices; securing personal data; notifying the NDPC and affected Data subjects of personal data breaches; and allocating liability between the parties.
(d) Eskimi’s Role
Eskimi acts as a Sub Processor to M360 in respect of personal data processed through the Platform technology on M360’s documented instructions. Eskimi shall process such personal data only in accordance with a written sub processing agreement imposing data protection obligations no less protective than those applicable to M360 under the NDPA, GAID, and this Policy.
Where Eskimi independently determines the purposes or means of processing, including for platform-level analytics, fraud prevention, security, product improvement, or compliance with its own legal obligations, Eskimi may act as an independent Data Controller or Joint Controller. In such cases, Eskimi’s own privacy notice and applicable agreements shall govern that processing to the extent disclosed to M360 and permitted under the commercial arrangement.
(e) Partner Agencies
A Partner Agency acts as a Data Controller where it determines the purposes and means of processing personal data for its own business or its own clients; and a Data Processor where it processes personal data solely on behalf of its own clients.
As a condition of access to the Platform, each Partner Agency shall:
- Maintain a lawful basis for processing personal data;
- Provide compliant privacy notices to its clients and End Users where required;
- Obtain all necessary consents and permissions;
- Ensure that audience lists and campaign data are lawfully sourced;
- Comply with the NDPA, GAID, and applicable advertising regulations;
- Not upload, target, or process Sensitive Personal Data without M360’s prior written approval; and
- Indemnify M360 against losses, claims, penalties, and liabilities arising from the Partner Agency’s unlawful or unauthorised processing.
Data Protection Principles
M360 processes personal data in accordance with the core principles of the NDPA and GAID:
Personal data is processed only on a valid legal basis and in a manner transparent to Data Subjects.
Personal data is collected for specified, explicit, and legitimate purposes and is not further processed incompatibly with those purposes.
M360 collects only personal data that is adequate, relevant, and limited to what is strictly necessary.
Reasonable steps are taken to ensure personal data is accurate, complete, and kept up to date.
Personal data is retained only for as long as necessary for its intended legitimate purposes.
Appropriate technical and organizational safeguards protect personal data against unauthorized or unlawful access.
M360 maintains records, policies, assessments, and controls to demonstrate compliance with Applicable Data Protection Laws.
Categories of Personal Data Collected
7.1 Account, Commercial & Campaign Data
a. Account and Commercial Data:
Identity and contact data, including name, company name, job title, email address, telephone number, and business address; account credentials, authentication data, user roles, and access permissions; billing, invoicing, payment, and transaction data; commercial communications, proposals, contracts, instructions, campaign briefs, and support records; KYC, onboarding, tax, and regulatory information where required.
b. Campaign and Platform Data:
In connection with advertising campaigns, M360 or Eskimi may process: device and technical data, including IP address, device identifiers, browser type and version, operating system, language settings, and network information; advertising interaction data, including impressions, clicks, views, conversions, engagement events, and campaign performance metrics; audience and targeting data, including inferred or supplied demographic segments, interest categories, behavioral signals, and location data where enabled and lawful; Cookie, pixel, SDK, mobile advertising identifier, and other tracking data; fraud prevention, security, and abuse detection data.
7.2 Website and Support Data
M360 may collect website usage data, including pages visited, links clicked, session duration, and referral sources; login and audit logs; support enquiries, complaints, and correspondence.
7.3 Sensitive Personal Data
M360 does not intentionally collect or process Sensitive Personal Data through the Platform. Clients and Partner Agencies are prohibited from configuring campaigns or uploading audience data involving Sensitive Personal Data without M360’s prior written consent and the implementation of enhanced safeguards required under the NDPA and GAID.
Where Sensitive Personal Data is knowingly or inadvertently received, M360 may restrict access, suspend the relevant campaign or account, delete the data where appropriate, and require the Client or Partner Agency to provide written confirmation of the lawful basis for processing.
Lawful Bases for Processing
M360 processes personal data only where one or more lawful bases apply under the NDPA and GAID:
8.1 Contractual Necessity
Processing is necessary for the performance of a contract with a Client, Partner Agency, vendor, or other business partner, including Platform access, campaign execution, reporting, invoicing, and customer support.
8.2 Legitimate Interests
Processing is necessary for M360’s legitimate interests, provided such interests are not overridden by the rights and freedoms of Data Subjects. These interests include:
- Administration and security of the Platform;
- Fraud detection, prevention, and investigation;
- Service improvement and product development;
- Business continuity and risk management;
- Enforcement of contractual rights and defence of legal claims;
- Business to business communications concerning services relevant to the recipient’s professional role;
- Where M360 relies on legitimate interests, it conducts and documents a Legitimate Interest Assessment (“LIA”).
8.3 Consent
Where consent is required, including for non-essential cookies, tracking technologies, direct marketing, or certain audience targeting activities, M360 ensures that consent is freely given, informed, and unambiguous. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
8.4 Legal Obligation
Processing may be necessary to comply with legal or regulatory obligations, including tax, accounting, anti-money laundering, consumer protection, advertising, and data protection requirements.
8.5 Vital Interests and Public Interest
M360 may process personal data where necessary to protect the vital interests of a Data subject or another person, or where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority, where applicable.
Purposes of Processing
M360 processes personal data for the following specific purposes:
Creating and managing the parent account, provisioning and administering sub accounts, managing user access, and maintaining Platform security.
Configuring, launching, delivering, targeting, optimizing, and measuring advertising campaigns.
Generating performance reports, providing campaign insights, and conducting Platform-level analytics.
Processing payments, issuing invoices, reconciling accounts, and maintaining financial records.
Responding to enquiries, resolving technical issues, and managing complaints.
Complying with legal obligations, responding to lawful requests, preventing fraud, and protecting M360’s rights and safety.
Sending administrative, operational, security, and service-related communications.
Communicating with existing and prospective Clients and Partner Agencies about relevant services, subject to applicable consent and opt-out rights.
Detecting unauthorised access, suspicious activity, invalid traffic, and abuse of the Platform.
M360 will not use personal data for purposes that are incompatible with the original purposes without a valid lawful basis and, where required, appropriate notice or consent.
Data Sharing and Disclosure
10.1 Sharing with Eskimi
M360 shares personal data with Eskimi only to the extent necessary for the operation of the Platform and the delivery of advertising services. Eskimi processes such data as a Sub Processor in accordance with the applicable sub-processing agreement. Eskimi shall not use personal data received from M360 for its own independent purposes except as expressly permitted under the agreement, permitted by law, or disclosed in Eskimi’s own privacy documentation where Eskimi acts as an independent Controller.
10.2 Sharing with Clients and Partner Agencies
M360 makes available to Clients and Partner Agencies the campaign data and reporting necessary for them to assess the performance of their advertising activities. Where a client or partner agency is a Data Controller or Joint Controller, its subsequent processing of that data is governed by its own privacy notice and legal obligations. M360 does not authorize any Client or Partner Agency to use data received through the Platform for incompatible purposes.
10.3 Sharing with Service Providers
M360 may engage third party service providers, including cloud hosting providers, payment processors, analytics providers, cybersecurity providers, communication tools, and customer support platforms. Such providers are engaged under written agreements imposing confidentiality, security, data protection, and sub processing obligations consistent with the NDPA and GAID. A current list of material Sub Processors is available upon written request to the Data Protection Officer.
10.4 Advertising and Technology Partners
Where necessary for campaign delivery, measurement, frequency capping, fraud prevention, or performance reporting, personal data may be shared with advertising exchanges, publishers, demand-side or supply-side platforms, measurement providers, and data providers. Such sharing occurs only where permitted by law, supported by appropriate contractual safeguards, and subject to applicable consent, opt-out, or transparency requirements.
10.5 Legal & Regulatory Disclosures
Disclosures may be made where required by law, regulation, court order, or lawful request from a competent authority, including the NDPC. Where legally permissible, M360 will notify affected Data Subjects.
10.6 Corporate Transactions
In mergers, acquisitions, or restructuring, personal data may be transferred subject to confidentiality obligations and protections no less protective than those in this Policy.
10.7 No Sale of Personal Data
M360 does not sell personal data. M360 does not disclose personal data to third parties for their independent direct marketing purposes without a valid lawful basis and, where required, the Data Subject’s consent.
International Data Transfers
Personal data processed through the Platform may be transferred to, stored in, or accessed from jurisdictions outside Nigeria, including where Eskimi, its affiliates, cloud providers, or other Sub Processors are located.
M360 ensures that cross-border data transfers comply with the provisions of the NDPA and GAID, implementing appropriate contractual safeguards, standard data protection clauses, and security protocols to protect data subjects’ rights across all processing territories.
Direct Marketing and Opt-Outs
M360 may send marketing communications to business contacts and prospective Clients or Partner Agencies where permitted by law. Every marketing communication shall include a clear and accessible opt-out mechanism.
Data Subjects may object to direct marketing at any time by:
- Clicking the unsubscribe link in the communication;
- Contacting the Data Protection Officer; or
- Updating communication preferences through the Platform, where available.
Upon receipt of a valid opt-out request, M360 shall cease marketing communications without undue delay. This does not apply to essential service, security, billing, legal, or administrative communications.
Children’s Data
The Platform and M360’s advertising services are not directed to children.
- M360 does not knowingly collect personal data from children without the consent of a parent or legal guardian where such consent is required under applicable law.
- Clients and Partner Agencies must not target children or upload children’s personal data through the Platform without M360’s prior written approval and compliance with all applicable legal requirements.
- If M360 becomes aware that it has collected a child’s personal data without appropriate consent, it will take reasonable steps to delete the data and suspend any related processing.
Automated Decision Making and Profiling
The Platform may use automated processes, algorithms, machine learning tools, and profiling techniques to support advertising delivery, audience segmentation, bid optimization, conversion measurement, fraud detection, and campaign performance analysis.
Such processing may involve automated decisions regarding the advertisements shown to End Users, the frequency of exposure, or the audience categories to which an advertisement is delivered.
Safeguards for significant automated decisions:
- Meaningful information about the logic involved;
- Information on the significance and envisaged consequences of the processing;
- The right to obtain human intervention where applicable;
- The right to express a point of view;
- The right to contest the decision; and
- The right to object to profiling for direct marketing.
Where required by the NDPA or GAID, M360 shall conduct a DPIA before commencing high risk profiling or automated decision making activities.
Data Retention
M360 retains personal data only for as long as necessary to fulfil the purposes for which it was collected or as required by law. Retention periods are determined by reference to:
- The duration of the contractual relationship with the relevant Client or Partner Agency;
- The duration of the advertising campaign and any post-campaign reporting or reconciliation period;
- Statutory retention obligations relating to financial, tax, accounting, employment, and corporate records;
- Limitation periods for potential legal claims;
- Security, fraud prevention, and dispute-resolution requirements; and
- Operational requirements of the Platform.
Upon expiry of the applicable retention period, personal data shall be securely deleted or irreversibly anonymized. Where immediate deletion is technically impracticable, including data in backup archives, M360 isolates and protects the data, prevents further processing, and deletes it once practicable.
Data Security
M360 implements comprehensive technical and organizational measures appropriate to the risk level:
M360 reviews and updates security measures regularly in light of technological developments, emerging threats, and NDPC guidance.
Data Breach Notification
In the event of a personal data breach, M360 shall:
- Promptly investigate, contain, and assess the breach;
- Notify the NDPC within 72 hours of becoming aware of a breach likely to result in a risk to the rights and freedoms of Data Subjects;
- Notify affected Data Subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms;
- Where M360 acts as a Data Processor, notify the relevant Data Controller without undue delay;
- Maintain a breach register documenting the facts, effects, remedial actions, and notifications made;
- Cooperate with the NDPC, Data Controllers, and other relevant authorities as required.
Complaints & SNAG Process
Standard Notice to Address Grievance (SNAG)
Data Subjects are encouraged to contact M360’s Data Protection Officer in the first instance. Where a Data Subject believes that M360 has violated Applicable Data Protection Laws, the Data Subject may submit a Data Subject’s Standard Notice to Address Grievance (“SNAG”) in accordance with the GAID.
M360 shall acknowledge and address valid SNAG notices in accordance with the applicable regulatory procedure. A Data Subject retains the right to escalate a complaint directly to the NDPC after officially writing to M360 severally and M360 ignored to attend to them.
Data Protection Governance
20.1 Data Protection Officer
M360 has designated a Data Protection Officer (“DPO”) to oversee compliance with this Policy and Applicable Data Protection Laws. The DPO advises on NDPA/GAID obligations, monitors compliance, serves as contact point for the NDPC and Data Subjects, coordinates DPIAs and breach responses, and maintains records of processing activities.
20.2 Privacy by Design
Applied across development and configuration, embedding privacy controls into workflows.
20.3 DPIAs
Conducted where processing poses a high risk to rights and freedoms, including large scale profiling.
20.4 Records
Maintained with categories, purposes, recipients, cross-border transfers, and retention schedules.
Contact Details
Data Protection Officer
M360 Solutions Group Limited
Omole Phase 1, Lagos, Nigeria.
Data Subjects are encouraged to contact M360’s DPO in the first instance. Data Subjects also have the right to lodge a complaint directly with the DPO.
Third Party Websites and Services
The Platform, M360’s website, and campaign materials may contain links to third-party websites, applications, or services. This Policy does not apply to third party websites or services that are not owned or controlled by M360. M360 is not responsible for the privacy practices of third parties. Data Subjects are encouraged to review the privacy policies of any third-party website or service before providing personal data.
Changes to this Privacy Policy
M360 may update this Policy from time to time to reflect changes in Applicable Data Protection Laws, regulatory guidance, technology, business arrangements, or processing activities. The updated Policy will be published with a revised copy effective date and version number. Material changes affecting Clients, Partner Agencies, or Data Subjects will be communicated through the Platform, email, or another appropriate channel. Where changes affect processing based on consent, M360 will obtain fresh consent where required.
Governing Law and Dispute Resolution
This Policy shall be governed by and construed in accordance with the laws of the Federal Republic of Nigeria.
Any dispute arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the courts of Nigeria, without prejudice to:
- A Data Subject’s right to lodge a complaint with the NDPC;
- Any applicable alternative dispute resolution mechanism; and
- Any mandatory regulatory process under the NDPA or GAID.
Severability and Interpretation
If any provision of this Policy is held invalid, illegal, or unenforceable, the remaining provisions shall remain in full force and effect. The invalid provision shall be modified to the minimum extent necessary to make it valid and enforceable, while preserving the commercial and legal intent of the Policy.
Policy Review
M360 shall review this Policy where required by:
- A change in law or regulatory guidance;
- A material change in the Platform or data flows;
- A new Sub Processor arrangement;
- A personal data breach or security incident;
- A material change in the M360/Eskimi white label arrangement; or
- A direction from the NDPC.