Privacy Policy

Last updated: 24/10/2026

This policy explains what personal data Mastermind Creative Company Ltd (“Mastermind CC”, “we”, “us”) collects through themastermind.cc, on WhatsApp and when you rent gear or book a studio with us, why we collect it, and the choices you have. We follow the Nigeria Data Protection Act 2023 (NDPA) and, for visitors in the UK and EU, the GDPR.

Who we are

Mastermind Creative Company Ltd is a creative production company in Lagos, Nigeria. We make video and podcast content, rent out camera and production gear, and rent studio spaces by the hour. We are the data controller for the personal data described here.

Questions about your data or this policy: email [email protected] with “Privacy” in the subject line, or call +234 814 542 1338.

What we collect

Information you give us

• Contact form: your name, email, phone number, company or brand name, how you heard about us and your message.
• Quote request: your contact details plus your project details, the type of video you need, location, timeline, budget range, reference links and any brief, script or moodboard you upload.
• Meeting request: your contact details, website, what you tell us about you or your company and the services you are interested in.
• Gear and studio bookings: your name, phone number, the items or studio you want, your dates and times and the estimated total. When you confirm a rental we may also ask for a valid photo ID, your address and payment details (see Rental and Studio Terms).
• WhatsApp: before we open WhatsApp we ask for your name and number (you can skip this). We save what you tapped and the first message, so we can reply even if the chat does not go through. Once you are on WhatsApp, the conversation is also handled by WhatsApp (Meta) under its own privacy policy.

Information collected automatically

• Device and usage data: pages you visit, how you arrived (including campaign tags in the link), your approximate location from your IP address, your browser and device type. We collect this through Google Analytics, only if you accept analytics cookies.
• Security data: your IP address is used briefly to stop spam and abuse on our forms, and by our hosting and Cloudflare to protect the site.
• Cookies and similar storage: see our Cookie Policy.

We do not collect payment card details on this website. We do not knowingly collect data from anyone under 18; please ask a parent or guardian to contact us for you.

Why we use it, and our legal basis

Purpose	Legal basis (NDPA s.25, GDPR art. 6)
Answering your enquiry, preparing quotes and arranging meetings	Steps you ask for before a contract
Managing gear rentals and studio bookings, payments, pickups, returns and disputes	Performance of a contract
Checking identity for gear rentals and preventing fraud, theft and spam	Our legitimate interest in protecting our equipment and business
Keeping accounting and tax records	Legal obligation
Measuring how the site is used so we can improve it	Your consent (analytics cookies)
Sending you news or offers	Your consent; you can opt out at any time

Who we share it with

We do not sell your personal data. We share it only with service providers who help us run the business, under contracts that require them to protect it:

• Our hosting provider (Namecheap) and Cloudflare, which host and protect the website.
• Email providers (Zoho Mail and Google Workspace or Gmail), which deliver and store our email.
• WhatsApp (Meta), when you choose to chat with us there.
• Google Analytics (Google), if you accept analytics cookies.
• Vimeo, when you play our showreel.
• Payment providers such as your bank or a payment gateway, when you pay us.
• Professional advisers, insurers and authorities, where needed to settle a claim, recover lost or damaged gear, or meet a legal requirement.

Transfers outside Nigeria

Some of these providers store data outside Nigeria, for example in the United States or the European Union. Where we transfer data abroad we rely on the safeguards allowed by the NDPA (Part VIII), such as the provider’s contractual commitments and adequate data protection laws in the destination country.

How long we keep it

• Enquiries, quotes and meeting requests: up to 2 years after our last contact, unless they become a project.
• Client, rental and booking records, including invoices: 6 years after the end of the year they relate to, as Nigerian tax law requires.
• ID copies taken for gear rentals: until the rental is closed and any claim is settled, then deleted.
• WhatsApp chat leads with no follow up: up to 12 months.
• Analytics data: 14 months in Google Analytics.

How we protect it

Leads and bookings are stored in our private website admin, which only our team can open, over an encrypted (HTTPS) connection. Each team member has their own login with only the access their role needs. No system is perfectly secure; if a breach puts your rights at risk we will tell the Nigeria Data Protection Commission within 72 hours and tell you without undue delay.

Your rights

Under the NDPA (sections 34 to 38) and the GDPR you can:

• ask for a copy of the personal data we hold about you;
• ask us to correct data that is wrong or incomplete;
• ask us to delete your data, or to restrict how we use it;
• object to our use of your data, including for marketing;
• ask for your data in a portable format;
• withdraw your consent at any time (for cookies, use “Cookie settings” in the site footer). This does not affect anything we did before you withdrew it.

Email us to use any of these rights. We will reply within 30 days and may need to confirm your identity first. If you are not happy with our answer you can complain to the Nigeria Data Protection Commission (or your local data protection authority if you live outside Nigeria).

Changes to this policy

We will update this page when our practices change and show the date at the top. If a change is significant we will make it clear on the site.