I
Who we are
Kofa Insights Limited is a software platform for practitioner intelligence in African markets. The platform structures practitioner engagements — brief, prep room, session, and decision asset — with a coordinator network sourcing and verifying practitioners behind it. We are registered under the laws of the Federal Republic of Nigeria.
For the purposes of this privacy policy, Kofa Insights Limited is the data controller for personal data collected through the website and Platform. For engagement-specific data — briefs, session recordings, and decision assets — Kofa acts as a data processor on behalf of the seeker, as described in the Data & Confidentiality Policy.
II
What this policy covers
This policy covers personal data collected through:
- The Kofa website at kofa.network and its subdomains
- The Kofa platform — account registration, brief submission, prep room, and notes delivery
- Communications with Kofa by email, phone, or any other channel
- Participation in the Kofa coordinator network
- Participation in a Kofa session as a practitioner
This policy does not cover the handling of engagement-specific data — brief content, session recordings, transcripts, and decision assets. That is covered by the Data & Confidentiality Policy, which forms part of the terms governing every engagement.
This policy does not cover third-party websites linked from the Kofa site. We are not responsible for the privacy practices of third parties.
III
Data we collect
Data you give us directly
Account dataName, email address, organisation name, job title, and password when you register as a seeker.
Brief dataThe content of briefs you submit, including any personal data contained within the brief (for example, names of contacts or colleagues mentioned in the decision context). See the Data & Confidentiality Policy for how brief content is handled. Payment dataBilling name, address, and payment method. Card numbers are processed by our payment sub-processor and never stored by Kofa directly.
CommunicationsThe content of emails, support requests, and other communications you send to Kofa.
Practitioner profileFor practitioners: name, contact details, employment history, geographic experience, and the content of the verification interview.
Coordinator profileFor coordinators: name, contact details, location, and the content of the onboarding process.
Newsletter subscriptionsYour email address when you subscribe to The Brief, Kofa's publication newsletter. Subscriptions require your consent, are managed through our newsletter provider (EmailOctopus), and every newsletter includes an unsubscribe link.
Data collected automatically
Usage dataPages visited, time spent, actions taken within the Platform. Used to operate and improve the service.
Device dataBrowser type, operating system, IP address, and general location (country/city level). Used for security and service delivery.
Session technical dataConnection quality, timestamps, and technical logs generated during a Kofa session. Used for quality assurance and dispute resolution.
IV
Why we collect it
To deliver the serviceAccount data, brief data, and session data are necessary to match practitioners, run sessions, and deliver decision assets. Without this data, we cannot provide the service.
To process paymentsBilling data is required to charge for engagements and to pay practitioners and coordinators.
To verify practitionersPractitioner profile data and verification interview content are necessary to maintain the quality and integrity of the practitioner network.
To communicate with youYour email address is used to send engagement updates, delivery notifications, and responses to your support requests. With your consent, it may be used to send publication updates (The Brief) and platform announcements.
To improve the PlatformAggregated, anonymised usage data is used to understand how the Platform is used and to improve it. This data does not identify individual users.
AI-assisted platform featuresWhere the platform uses AI-assisted features — such as supporting brief creation or retrieving decision assets through Ask Kofa — content is processed within the platform to provide the feature to you. Kofa does not use client briefs, session content, or decision assets to train, fine-tune, or evaluate any AI or machine learning model. See the Data & Confidentiality Policy, Section VII.
To comply with legal obligationsPayment records, tax records, and NDA execution records are retained for the periods required by applicable law.
V
Lawful basis for processing
Kofa processes personal data on the following lawful bases under the Nigeria Data Protection Act 2023 and, where applicable, the GDPR:
ContractProcessing necessary to fulfil our obligations to you — delivering engagements, paying practitioners, managing accounts. This is the primary basis for all engagement-related processing.
Legitimate interestsProcessing for security, fraud prevention, and platform improvement — where our interests do not override your rights. We carry out legitimate interests assessments for processing in this category.
Legal obligationProcessing required by law — tax records, statutory retention obligations, responses to lawful orders.
ConsentMarketing communications and non-essential cookies. You may withdraw consent at any time without affecting processing already carried out.
VI
Who we share data with
Kofa does not sell personal data. We share personal data only in the following circumstances:
Sub-processorsThird-party services used to deliver the Platform — cloud storage, video conferencing, payment processing, and document delivery. All sub-processors are contractually bound by confidentiality and data protection obligations. See Section XIII of the Data & Confidentiality Policy for details. CoordinatorsBrief summaries (not full briefs, not seeker identity) shared with coordinators during matching. Governed by coordinator confidentiality agreements. See the Data & Confidentiality Policy, Section VIII. Legal requirementsWhere required by a court order, regulatory requirement, or applicable law. Kofa will notify the affected user where legally permitted to do so before complying.
Business transfersIn the event of a merger, acquisition, or sale of substantially all of Kofa's assets, personal data may be transferred to the acquiring entity. Affected users will be notified before the transfer takes effect and will have the opportunity to request deletion.
Newsletter providerEmailOctopus, used to deliver The Brief newsletter to subscribers. It receives only your email address and subscription status, and does not access any platform or engagement data.
We never share personal dataWith other Kofa clients or seekers
With data brokers or advertising networks
For marketing purposes by third parties
To train, fine-tune, or evaluate AI or machine learning models operated by third parties
VII
International transfers
Kofa is based in Nigeria. Our sub-processors may process data in other jurisdictions, including the European Economic Area. Where personal data is transferred outside Nigeria, Kofa ensures that appropriate safeguards are in place — including standard contractual clauses where required by applicable law.
For clients operating under GDPR who require confirmation of transfer mechanisms, contact privacy@kofa.network. Kofa will provide the relevant documentation within five business days.
VIII
How long we keep personal data
Account dataRetained for the duration of the account and for 12 months after account closure, then deleted — unless a longer period is required for ongoing dispute resolution or legal obligation.
Engagement dataGoverned by the retention schedule in the Data & Confidentiality Policy, Section XII. Engagement data is not personal data in the conventional sense but may contain personal data — that policy's retention rules apply. Practitioner profilesRetained for the duration of the practitioner's active status and for 24 months thereafter. Practitioners may request deletion of their profile at any time — subject to the retention of NDA execution records for the NDA term.
Payment recordsRetained for 7 years as required by Nigerian tax law.
CommunicationsSupport emails and other direct communications retained for 24 months, then deleted.
Marketing consent recordsRetained for 5 years from the date of consent or withdrawal, to demonstrate compliance.
Newsletter subscriber dataRetained until you unsubscribe. Unsubscribes are processed immediately and the record of your unsubscribe is kept solely to honour it.
IX
Cookies and analytics
The Kofa website uses cookies and similar technologies. We use the minimum number of cookies necessary to operate the site.
Strictly necessarySession cookies required to keep you logged in and to remember preferences within a session. These cannot be disabled without breaking core functionality. No consent required.
AnalyticsUsed to understand how the website is used — pages visited, time on page, and navigation patterns. We use Google Analytics, configured without advertising features, and we do not use or share analytics data for advertising purposes. Analytics cookies are set only with your consent.
MarketingKofa does not use advertising cookies or tracking pixels. We do not run retargeting campaigns. No marketing cookies are set on the Kofa site.
You can manage cookies through your browser settings. Disabling strictly necessary cookies will prevent core platform functionality from working. Disabling analytics cookies will not affect your use of the Platform.
X
Your rights
Under the Nigeria Data Protection Act 2023 and, where applicable, the GDPR, you have the following rights with respect to your personal data.
AccessRequest a copy of the personal data Kofa holds about you. We will respond within 30 days.
CorrectionRequest correction of inaccurate personal data. We will correct and confirm within 10 business days.
DeletionRequest deletion of your personal data where we have no legitimate reason to continue holding it. Some data must be retained for legal or contractual reasons — we will tell you what cannot be deleted and why.
RestrictionRequest that we restrict processing of your data while a complaint or correction request is being resolved.
PortabilityRequest a copy of your personal data in a structured, machine-readable format where processing is based on consent or contract.
ObjectionObject to processing based on legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests.
Withdraw consentWithdraw consent for marketing communications or non-essential cookies at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, contact privacy@kofa.network. We will respond to all rights requests within 30 days. If we are unable to fulfil a request, we will explain why.
If you are not satisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission or, where GDPR applies, with the supervisory authority in your country.
XI
Children
The Kofa Platform is intended for use by adults in a professional context. We do not knowingly collect personal data from anyone under the age of 18. If we become aware that we have collected personal data from a minor, we will delete it immediately. If you believe we may have collected data from a minor, contact privacy@kofa.network.
XII
Security
Kofa takes reasonable technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, and destruction. These measures include encryption at rest and in transit, access controls, and regular security reviews.
No system is entirely secure. In the event of a personal data breach, Kofa will notify affected users within 72 hours of becoming aware of the breach, as required by the Nigeria Data Protection Act and, where applicable, the GDPR. Notification will include what data was affected, what we are doing about it, and what steps you may wish to take.
Full details of Kofa's security measures are set out in Section XI of the Data & Confidentiality Policy.
XIII
Changes to this policy
Kofa may update this policy to reflect changes in our data practices or applicable law. Material changes — those that affect your rights or how your data is used in a meaningful way — will be communicated by email at least 30 days before they take effect.
The version number and last-updated date at the top of this page reflect the current version. The previous version will be available on request for 12 months after any update.