POLICIES
Privacy Policy
We are committed to protecting the privacy, confidentiality, integrity and security of personal information entrusted to us by our clients, partners, employees and the communities we serve.
Effective Date: 1 July 2026
At Ganttory Ltd ("Ganttory", "we", "our", or "us"), we recognize that trust is fundamental to every relationship we build—with our clients, employees, suppliers, consultants, contractors, investors, development partners, regulators, and the communities we serve.
This Privacy Policy explains how Ganttory collects, uses, stores, secures, transfers, discloses, and otherwise processes personal information in connection with our business operations, professional services, infrastructure projects, digital platforms, supplier relationships, recruitment activities, and stakeholder engagement.
1.1 Purpose
At Ganttory Ltd ("Ganttory", "we", "our", or "us"), we recognize that trust is fundamental to every relationship we build—with our clients, employees, suppliers, consultants, contractors, investors, development partners, regulators, and the communities we serve.
As an integrated infrastructure development company operating across Sub-Saharan Africa, we understand that responsible stewardship of information is essential to delivering projects with integrity, professionalism, and accountability.
This Privacy Policy explains how Ganttory collects, uses, stores, secures, transfers, discloses, and otherwise processes personal information in connection with our business operations, professional services, infrastructure projects, digital platforms, supplier relationships, recruitment activities, and stakeholder engagement.
Privacy is embedded into the way we conduct business. We are committed to protecting personal information through robust governance, internationally recognized security practices, and compliance with applicable data protection laws wherever we operate.
1.2 Objectives
This Policy aims to:
- Explain what personal information Ganttory collects.
- Describe how and why personal information is processed.
- Outline the legal basis upon which personal information is processed.
- Describe how information is protected.
- Explain the circumstances in which information may be shared.
- Inform individuals of their rights.
- Demonstrate Ganttory's commitment to internationally recognized privacy principles.
1.3 Applicability
This Policy applies to:
- Website visitors
- Clients
- Prospective clients
- Suppliers
- Contractors
- Consultants
- Employees
- Job applicants
- Investors
- Development partners
- Government agencies
- Community stakeholders
- Individuals interacting with Ganttory in any capacity
Privacy is fundamental to maintaining trust. Ganttory is committed to ensuring that all personal information entrusted to us is processed responsibly, securely, transparently, and in accordance with applicable legal and ethical standards.
Commitment | Description |
|---|---|
Lawfulness | Process information only where a lawful basis exists. |
Fairness | Handle information in ways individuals reasonably expect. |
Transparency | Clearly explain how information is collected and used. |
Data Minimization | Collect only information necessary for legitimate business purposes. |
Security | Protect information through appropriate technical and organizational safeguards. |
Accountability | Hold ourselves accountable for responsible information management. |
Integrity | Process information honestly and ethically. |
Confidentiality | Restrict access to authorized personnel only. |
Continuous Improvement | Regularly review and strengthen our privacy programme. |
Privacy considerations are incorporated into project planning, digital systems, procurement processes, supplier management, and operational decision-making.
3.1 Business Activities
This Privacy Policy applies to all personal information processed by Ganttory in connection with:
- Infrastructure development
- Engineering
- Procurement
- Engineering, Procurement & Construction (EPC)
- Project Development
- Project Management
- Infrastructure Advisory
- Operations Support
- Renewable Energy Development
- Technical Consulting
- Commercial Advisory
- Business Development
- Corporate Administration
3.2 Channels Covered
This Policy applies regardless of how information is collected, including through:
- Corporate website
- Project enquiry forms
- Contact forms
- Proposal submissions
- Client engagements
- Procurement portals
- Recruitment portals
- Email correspondence
- Telephone communications
- Social media
- Events
- Conferences
- Mobile applications
- Collaboration platforms
- Physical documentation
- Site visits
- Security systems
- CCTV (where applicable)
3.3 Geographic Scope
This Privacy Policy applies across all jurisdictions in which Ganttory operates or conducts business.
Where local legislation imposes additional privacy obligations, Ganttory will comply with those requirements in addition to this Policy.
Ganttory is an integrated infrastructure development company that develops and delivers infrastructure to power economies, strengthen industries, and improve communities across Sub-Saharan Africa.
We help governments, businesses, investors, and development partners transform ambitious ideas into resilient, commercially viable infrastructure through a disciplined approach to project development, engineering, procurement, construction (EPC), project management, infrastructure advisory, and long-term operational support.
Our multidisciplinary capabilities span the entire infrastructure lifecycle—from strategic planning, feasibility studies, commercial structuring, engineering, procurement, construction, commissioning, operations support, and asset optimization.
We provide integrated infrastructure solutions across a broad range of sectors including:
Sector | Examples |
|---|---|
Energy | Renewable Energy, Grid Infrastructure, Battery Energy Storage |
Industrial | Manufacturing Facilities, Industrial Utilities |
Commercial | Commercial Buildings, Mixed-Use Developments |
Public Infrastructure | Government Projects, Public Facilities |
Telecommunications | Communications Infrastructure |
Water | Water Supply and Treatment |
Healthcare | Hospitals and Medical Facilities |
Education | Schools and Universities |
Mining | Mining Infrastructure |
Agriculture | Agricultural Infrastructure |
Real Estate | Infrastructure for Property Developments |
As a trusted infrastructure partner, Ganttory is committed to delivering projects safely, responsibly, and sustainably while upholding the highest standards of governance, engineering excellence, environmental stewardship, ethical conduct, and data protection.
Ganttory's privacy programme is founded on internationally recognized principles.
Principle | Description |
|---|---|
Lawfulness | Personal information is processed only where an appropriate legal basis exists. |
Fairness | Information is handled fairly and without prejudice. |
Transparency | Individuals are informed about how their information is used. |
Purpose Limitation | Information is collected only for specific, explicit, and legitimate purposes. |
Data Minimization | Only the minimum information necessary is collected. |
Accuracy | Information is maintained accurately and kept up to date where practical. |
Storage Limitation | Information is retained only as long as necessary. |
Integrity & Confidentiality | Appropriate safeguards protect information against unauthorized access or misuse. |
Accountability | Ganttory accepts responsibility for compliance with this Policy. |
Privacy by Design | Privacy considerations are incorporated into systems, processes, and projects from the outset. |
Privacy by Default | Systems are configured to collect and process only the information necessary for their intended purpose. |
Depending on the nature of your relationship with Ganttory, we may collect the following categories of personal information.
Category | Examples |
|---|---|
Identity Information | Name, title, nationality, government-issued identification (where required), photograph |
Contact Information | Email address, telephone number, mailing address, business address |
Professional Information | Employer, job title, qualifications, certifications, licenses, professional memberships |
Commercial Information | Contracts, invoices, quotations, purchase orders, financial records |
Project Information | Project enquiries, technical specifications, budgets, project documentation |
Recruitment Information | CVs, references, qualifications, interview notes, employment history |
Supplier Information | Company details, contact persons, banking information, tax information |
Technical Information | IP address, browser type, operating system, device information, cookies |
Website Usage Information | Pages visited, referral source, session duration, downloads |
Marketing Information | Event registrations, newsletter preferences, communication preferences |
Security Information | Visitor logs, access records, CCTV footage where applicable |
Other Information | Any information voluntarily provided through correspondence or project engagements |
Special Categories of Personal Information
Where required for legitimate business purposes and permitted by law, Ganttory may process limited categories of sensitive personal information, such as health or accessibility information required for workplace safety, project site access, or legal compliance. Such information will be subject to enhanced safeguards and processed only where there is an appropriate legal basis.
7.1 General Principles
Ganttory collects personal information in a transparent and lawful manner and only where it is necessary for legitimate business purposes.
Where required by applicable law, we will inform individuals about the collection of their personal information before or at the time of collection.
We do not knowingly collect information using deceptive or misleading practices.
7.2 Information You Provide
We collect information directly from you when you voluntarily provide it, including when you:
- Complete contact or enquiry forms
- Request a proposal or quotation
- Engage our professional services
- Submit project documentation
- Register for events or webinars
- Subscribe to newsletters
- Download publications
- Apply for employment
- Register as a supplier
- Participate in surveys
- Contact us by telephone or email
- Visit our offices
- Participate in meetings or workshops
7.3 Information Collected Automatically
When you visit our website, certain information may be collected automatically through technologies such as cookies, server logs, and analytics tools.
Category | Examples |
|---|---|
Device Information | Device type, operating system |
Browser Information | Browser version and language |
Technical Information | IP address, session ID |
Usage Information | Pages visited, time spent, clicks |
Location Information | Approximate geographic location derived from IP address |
Security Information | Failed login attempts, suspicious activity |
7.4 Information from Third Parties
Where appropriate and lawful, we may receive information from:
- Clients
- Government agencies
- Regulatory authorities
- Professional advisers
- Recruitment partners
- Business partners
- Public company registers
- Credit reference agencies
- Financial institutions
- Development finance institutions
- Professional networking platforms
- Due diligence providers
Such information will only be processed where there is a lawful basis.
7.5 CCTV and Physical Security
Where CCTV systems operate at our offices, project sites, or facilities, recordings may be collected for purposes including:
- Security
- Incident investigation
- Health & Safety
- Asset protection
- Regulatory compliance
Appropriate signage will be displayed where CCTV monitoring is in operation.
7.6 Recruitment
Applicants may provide:
- Curriculum Vitae
- Cover Letters
- Academic qualifications
- Professional certifications
- Employment history
- References
- Background verification information (where applicable)
Recruitment information is processed solely for evaluating employment opportunities and workforce planning.
Personal information is processed only where necessary to conduct our business and fulfil our legal, contractual, and professional responsibilities.
8.1 Service Delivery
We use information to:
- Deliver engineering services
- Manage EPC projects
- Develop infrastructure projects
- Conduct technical assessments
- Deliver advisory services
- Execute procurement activities
- Manage contracts
- Coordinate project teams
- Commission completed assets
- Provide operations support
8.2 Relationship Management
Information enables us to:
- Respond to enquiries
- Prepare proposals
- Maintain client relationships
- Communicate project updates
- Manage stakeholder engagement
- Provide customer support
8.3 Supplier Management
We process supplier information to:
- Conduct due diligence
- Evaluate capability
- Administer procurement
- Manage contracts
- Process payments
- Monitor supplier performance
8.4 Recruitment
Information is used to:
- Evaluate candidates
- Verify qualifications
- Conduct interviews
- Contact references
- Perform background screening where lawful
- Make employment decisions
8.5 Business Development
Information may be used to:
- Share industry insights
- Invite individuals to events
- Respond to partnership opportunities
- Communicate company updates
- Send newsletters (where consent has been provided where required)
8.6 Legal & Regulatory Compliance
We process information where necessary to:
- Comply with legislation
- Respond to lawful requests
- Meet contractual obligations
- Maintain financial records
- Conduct audits
- Meet tax obligations
- Prevent fraud
8.7 Security
Information helps us:
- Protect systems
- Detect cyber threats
- Investigate incidents
- Protect personnel
- Secure project sites
- Maintain business continuity
8.8 Analytics and Improvement
Information may be analysed to improve:
- Website performance
- Digital services
- Customer experience
- Project delivery
- Operational efficiency
- Cybersecurity
Analytics are generally performed using aggregated or anonymized information wherever practicable.
Where applicable, including under the General Data Protection Regulation (GDPR), Ganttory processes personal information only where an appropriate legal basis exists.
Legal Basis | Examples |
|---|---|
Contract | Delivering engineering or EPC services, supplier agreements, employment contracts |
Legal Obligation | Tax reporting, health & safety compliance, anti-money laundering requirements |
Legitimate Interests | Business development, fraud prevention, cybersecurity, stakeholder engagement |
Consent | Marketing communications, optional cookies, event registrations where required |
Vital Interests | Emergency situations involving health or safety |
Public Interest | Activities undertaken in support of government infrastructure or statutory obligations where applicable |
Where processing is based on consent, consent may be withdrawn at any time. Withdrawal does not affect processing carried out before withdrawal.
As an infrastructure company operating across multiple jurisdictions, personal information may be transferred to or accessed from countries outside the jurisdiction in which it was originally collected.
International transfers may occur where necessary to:
- Deliver projects
- Support multinational clients
- Engage international consultants
- Utilize secure cloud services
- Coordinate cross-border teams
- Meet legal or contractual obligations
Where transfers occur, Ganttory implements appropriate safeguards, including:
- Standard Contractual Clauses (SCCs)
- Data Processing Agreements
- Confidentiality obligations
- Encryption in transit and at rest where appropriate
- Vendor security assessments
- International transfer impact assessments where required
- Other lawful transfer mechanisms recognized under applicable legislation
We take reasonable measures to ensure that transferred personal information receives a level of protection substantially equivalent to that provided under this Policy.
Ganttory does not sell personal information.
Personal information may be shared only where necessary and subject to appropriate contractual, legal, or regulatory safeguards.
Information may be disclosed to:
Employees: Project delivery and administration
Consultants: Professional services
Contractors: Project execution
Suppliers: Procurement activities
Financial Institutions: Payment processing
Auditors: Financial and compliance audits
Insurers: Insurance administration
Cloud Service Providers: Secure hosting and collaboration
IT Providers: System administration
Legal Advisers: Legal representation
Regulators: Compliance with legal obligations
Courts and Law Enforcement: Where legally required
Development Finance Institutions: Due diligence, financing, monitoring
Investors and Lenders: Transaction due diligence, subject to confidentiality obligations
Every third party processing personal information on behalf of Ganttory is expected to implement security measures appropriate to the nature of the information processed and comply with applicable contractual and legal obligations.
Protecting personal information is a fundamental responsibility across Ganttory.
We maintain administrative, technical, physical, and organizational safeguards designed to protect information against unauthorized access, disclosure, alteration, destruction, loss, or misuse.
Our information security framework includes:
Governance: Information security policies and oversight
Access Control: Role-based access, least-privilege principles, multi-factor authentication where appropriate
Network Security: Firewalls, intrusion detection, secure remote access
Encryption: Encryption during transmission and, where appropriate, at rest
Monitoring: Security logging, vulnerability monitoring, threat detection
Physical Security: Controlled office and project site access, visitor management
Vendor Management: Security assessments and contractual obligations for third-party providers
Incident Response: Procedures for detecting, responding to, and recovering from security incidents
Training: Regular employee awareness and privacy training
Business Continuity: Backup, disaster recovery, and resilience planning
Despite these safeguards, no method of transmission over the internet or electronic storage is completely secure. Ganttory therefore cannot guarantee absolute security but continually reviews and enhances its controls to address evolving risks.
Security Incident Management
Where a security incident involving personal information occurs, Ganttory will:
- Assess the nature and scope of the incident.
- Contain and mitigate the impact.
- Investigate the root cause.
- Notify affected individuals and competent authorities where required by applicable law.
- Implement corrective actions to reduce the likelihood of recurrence.
13.1 Retention Principles
Ganttory retains personal information only for as long as necessary to fulfil the purposes for which it was collected, including the delivery of professional services, compliance with contractual obligations, protection of legitimate business interests, and compliance with applicable legal and regulatory requirements.
Personal information will not be retained indefinitely. Once retention is no longer necessary, information will be securely deleted, anonymized, or destroyed using methods appropriate to the sensitivity of the information.
Retention decisions are based on:
- Applicable legal and regulatory requirements
- Contractual obligations
- Statutory limitation periods
- Business and operational needs
- Ongoing litigation, investigations, or audits
- Information security requirements
- Industry best practices
13.2 Typical Retention Periods
Client Contracts: Duration of contract plus applicable statutory limitation period
Project Documentation: Project lifecycle plus contractual and legal retention requirements
Financial Records: In accordance with applicable tax and financial reporting laws
Recruitment Records: As permitted under applicable employment laws
Supplier Records: Duration of supplier relationship plus legal retention period
Marketing Records: Until consent is withdrawn or the information is no longer required
Website Analytics: In accordance with our Cookie Policy and operational requirements
Security Logs: Based on operational and cybersecurity requirements
CCTV Recordings: As required for security purposes unless retained for investigations
Retention periods may be extended where reasonably necessary to establish, exercise, or defend legal claims.
Ganttory respects the privacy rights of individuals.
Subject to applicable law, individuals whose personal information we process may have the following rights.
14.1 Right of Access
You may request confirmation as to whether Ganttory processes your personal information and obtain access to that information together with certain additional information regarding its processing.
14.2 Right to Rectification
You may request that inaccurate or incomplete personal information be corrected or updated.
14.3 Right to Erasure
Where permitted by applicable law, you may request the deletion of your personal information where:
- The information is no longer required.
- Consent has been withdrawn and no alternative legal basis exists.
- Processing is unlawful.
- Deletion is required by law.
This right may be limited where Ganttory has overriding legal or contractual obligations requiring continued retention.
14.4 Right to Restrict Processing
You may request that processing be restricted under circumstances prescribed by applicable law.
14.5 Right to Object
You may object to certain processing activities, including processing based upon legitimate interests or direct marketing.
Ganttory will carefully consider every objection in accordance with applicable legislation.
14.6 Right to Data Portability
Where applicable, you may request that personal information be provided in a structured, commonly used, and machine-readable format or transmitted to another organization where technically feasible.
14.7 Right to Withdraw Consent
Where processing relies upon consent, you may withdraw consent at any time.
Withdrawal does not affect the lawfulness of processing undertaken before consent was withdrawn.
14.8 Exercising Your Rights
Requests relating to personal information should be submitted to:
Legal & Compliance
Email: privacy@ganttory.com
Ganttory may request additional information necessary to verify identity before responding.
Ganttory may communicate with clients, suppliers, investors, partners, and other stakeholders regarding:
- Company news
- Industry insights
- Technical publications
- Events
- Webinars
- Service updates
- Business opportunities
Where required by applicable law, such communications will only be sent with appropriate consent.
Recipients may unsubscribe at any time using the unsubscribe link included in electronic communications or by contacting us directly.
Operational communications relating to projects, contracts, safety, regulatory matters, or legal obligations may continue where necessary.
Our website uses cookies and similar technologies to enhance functionality, improve user experience, understand website usage, maintain security, and support analytics.
Cookies may include:
Essential Cookies: Enable core website functionality
Functional Cookies: Remember user preferences
Performance Cookies: Improve website performance
Analytics Cookies: Measure website usage and effectiveness
Security Cookies: Detect suspicious activity and maintain website security
Users may manage cookie preferences through their browser settings or our Cookie Preference Centre where available.
Our website may contain links to third-party websites operated independently from Ganttory.
These websites maintain their own privacy practices and policies.
Ganttory is not responsible for:
- Third-party privacy practices
- Third-party security controls
- Third-party content
- Information collected after leaving our website
Users are encouraged to review the privacy policies of all third-party websites before providing personal information.
Ganttory's services are designed primarily for governments, businesses, institutions, investors, suppliers, and professional stakeholders.
We do not knowingly collect personal information from children unless required in connection with community development initiatives or where authorized by applicable law.
Where we become aware that personal information relating to a child has been collected unintentionally without appropriate authorization, reasonable steps will be taken to delete the information promptly.
This Privacy Policy may be updated periodically to reflect changes in:
- Applicable legislation
- Regulatory guidance
- Technology
- Business operations
- Information security practices
- International best practice
The latest version will always be published on the Ganttory website.
Where material changes significantly affect the way personal information is processed, Ganttory may provide additional notice where appropriate.
Ganttory's privacy programme is informed by internationally recognized legal, regulatory, and governance frameworks, including, where applicable:
- General Data Protection Regulation (GDPR)
- UK General Data Protection Regulation
- Nigeria Data Protection Act (NDPA)
- OECD Privacy Guidelines
- ISO/IEC 27001 – Information Security Management Systems
- ISO/IEC 27701 – Privacy Information Management Systems
- ISO 37301 – Compliance Management Systems
- ISO 31000 – Risk Management
- ISO 9001 – Quality Management Systems
- United Nations Global Compact Principles
- Applicable privacy legislation in jurisdictions where Ganttory operates
Where local legislation imposes more stringent requirements than this Policy, Ganttory will comply with those requirements.
Questions regarding this Privacy Policy or Ganttory's privacy practices may be directed to:
Legal & Compliance
Ganttory Ltd
Email: privacy@ganttory.com
Website: www.ganttory.com
Correspondence relating to privacy matters should include sufficient information to enable Ganttory to identify the request and verify the identity of the requester where appropriate.
This Privacy Policy is effective from July 1st 2026 and supersedes all previous versions relating to the processing of personal information by Ganttory.
This Policy shall be reviewed at least annually or more frequently where changes in law, regulation, technology, or business operations require amendment.
APPENDIX A – Personal Information Processing Schedule
Category of Personal Information | Examples | Purpose of Processing | Lawful Basis (where applicable) | Typical Recipients | Typical Retention |
|---|---|---|---|---|---|
Identity Information | Name, title, identification documents | Identity verification, contracts | Contract, Legal Obligation | Internal project teams | Contract period + statutory retention |
Contact Information | Email, telephone, address | Communications | Contract, Legitimate Interest | Employees, service providers | Duration of relationship |
Professional Information | Employer, qualifications, certifications | Project delivery | Contract, Legitimate Interest | Project teams | Business relationship |
Commercial Information | Contracts, invoices, purchase orders | Financial administration | Contract, Legal Obligation | Finance, auditors | Statutory financial retention |
Recruitment Information | CVs, interview notes | Recruitment | Consent, Legitimate Interest | HR | Recruitment retention period |
Supplier Information | Banking details, company records | Procurement | Contract | Procurement & Finance | Supplier relationship |
Technical Information | IP address, browser | Website administration | Legitimate Interest | IT providers | Operational retention |
Website Usage | Analytics | Website improvement | Legitimate Interest, Consent | Analytics providers | Cookie retention schedule |
Security Information | Visitor logs, CCTV | Security | Legitimate Interest | Security personnel | Security retention period |
APPENDIX B – Definitions
Category of Personal Information | Examples |
|---|---|
Applicable Data Protection Laws | All privacy and data protection legislation applicable to Ganttory's operations, including GDPR, UK GDPR, NDPA, and equivalent laws. |
Business Partner | Any client, government entity, contractor, consultant, supplier, investor, financier, or development partner with whom Ganttory conducts business. |
Consent | A freely given, specific, informed, and unambiguous indication of an individual's agreement to the processing of personal information. |
Controller | The natural or legal person determining the purposes and means of processing personal information. |
Data Subject | An identified or identifiable natural person whose personal information is processed. |
Personal Information | Any information relating to an identified or identifiable individual. |
Processing | Any operation performed on personal information, including collection, storage, use, disclosure, transfer, restriction, deletion, or destruction. |
Processor | A natural or legal person that processes personal information on behalf of a Controller. |
Professional Services | Infrastructure development, engineering, procurement, EPC, project management, infrastructure advisory, operations support, and related services provided by Ganttory. |
Sensitive Personal Information | Categories of personal information requiring enhanced protection under applicable law, such as health information or biometric data |
Third Party | Any individual or organization other than the Data Subject, Ganttory, or persons acting under Ganttory's direct authority. |