Privacy Policy

Last Updated: August 19, 2026

1. Introduction

Welcome to Relantern ("we," "our," or "us"). We are committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy describes how we collect, use, process, and protect your information when you visit our website (relantern.com) or interact with our software, services, and diagnostic systems.

For the personal data described in this policy, Relantern is the data controller. This policy is written to meet the requirements of the European Union's General Data Protection Regulation (GDPR), the United Kingdom GDPR, and the Nigeria Data Protection Act 2023 (NDPA), which superseded the Nigeria Data Protection Regulation 2019 and established the Nigeria Data Protection Commission (NDPC) as the supervisory authority.

2. Information We Collect

We collect personal and professional information that you voluntarily provide to us when submitting forms on our website. This includes:

Contact Information: First name, last name, email address, and telephone number.
Professional Information: Company name, facility location/site name, industry sector, and job role.
Operational Information: Primary asset management and operational challenges, systems details, and interest in services or products.

We also automatically collect technical data when you navigate our site, such as your IP address, browser type, device information, operating system, and anonymous usage patterns via analytics engines.

3. Legal Bases for Processing

Under Article 6 of the GDPR and the corresponding provisions of the NDPA, we must have a lawful basis for every processing activity. Ours are as follows:

Performance of a contract (Art. 6(1)(b)): delivering the assessment you requested, provisioning and supporting your access to the IREAMS platform, and administering any services you have engaged us for.
Consent (Art. 6(1)(a)): setting analytics cookies, and sending you educational content, product updates, and marketing communications. You may withdraw consent at any time — see sections 5 and 10.
Legitimate interests (Art. 6(1)(f)): securing our website and systems against abuse, preventing fraud, maintaining service availability, and responding to business enquiries you initiate. We balance these interests against your rights and freedoms, and you may object at any time.
Legal obligation (Art. 6(1)(c)): retaining business and financial records, and responding to lawful requests from regulators or courts.

Where our basis is consent, refusing or withdrawing it will never affect your access to the core services you have contracted for.

4. How We Use Your Information

We use the data we collect for the following specific, legitimate business purposes:

To deliver your requested reliability assessment and provision your access to the IREAMS platform.
To seed and pre-populate your evaluation records inside our IREAMS platform.
To communicate with you regarding service inquiries, technical support, and account setup.
To send you educational content, case studies, and marketing communications about our asset management offerings (only with your explicit consent).
To monitor, analyze, and optimize website performance, security, and user experience.

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects concerning you.

We utilize cookies—small text files stored on your device—to enhance page loading speeds, save preferences, and track traffic. We classify our cookies into two groups:

Essential Cookies: Critical for navigation and basic security. These cannot be disabled.
Analytics Cookies (GA4): Google Analytics 4 tracks anonymous traffic behavior to help us improve the site. These cookies are loaded only after you click "Accept" on our cookie consent banner, and we enable IP anonymisation. No analytics cookie is set if you decline.

Withdrawing your cookie consent. You may change or withdraw your choice at any time, and it is as easy as giving it: use the Cookie Settings link here or in the footer of any page to reopen the banner and choose again. Withdrawal takes effect immediately for future page loads; to remove analytics cookies already stored, clear cookies for relantern.com in your browser.

6. Data Sharing and Sub-processors

We respect your privacy. We do not sell, rent, or trade your personal data with third parties. We share data only with the service providers below, each engaged under a written data processing agreement that restricts them to processing on our documented instructions:

Sub-processor	Purpose	Data involved
Supabase	Database hosting and application backend for lead records and platform access	Contact, professional and operational information
Resend	Transactional and marketing email delivery	Name, email address, company
Google (Analytics 4)	Website traffic analytics, loaded only on consent, with IP anonymisation	Anonymised technical and usage data

Our current and complete sub-processor list is available on request from privacy@relantern.com. We may also disclose data where required by law or to establish, exercise or defend legal claims.

7. International Transfers

Your information may be transferred to and processed in countries outside your country of residence, including the United States. Where personal data leaves the European Economic Area, the United Kingdom or Nigeria, we rely on the following safeguards:

Standard Contractual Clauses: the European Commission's SCCs (Implementing Decision 2021/914), together with the UK International Data Transfer Addendum where the UK GDPR applies.
Adequacy decisions: where the destination country has been formally recognised as providing an adequate level of protection.
NDPA transfer conditions: for transfers out of Nigeria, the conditions set out in Part VIII of the Nigeria Data Protection Act 2023.

You may request a copy of the safeguards applying to a specific transfer by writing to privacy@relantern.com.

8. Data Retention

We keep your personal information for no longer than is necessary to fulfill the purposes for which it was collected. Lead contact data captured through assessments is retained for a period of three (3) years from your last active interaction with us, after which it is securely deleted or anonymized, unless you request deletion earlier. Records we must keep to meet a legal or tax obligation are retained for the period that obligation requires.

9. Security of Your Data

We apply technical and organizational measures appropriate to the risk, including encryption of data in transit, role-based access control enforced at the database layer, least-privilege administrative access, and audit logging of changes to records. Our security controls are built against the control sets published in ISO/IEC 27001:2022 and the AICPA Trust Services Criteria; this is a self-attestation, and we have not yet completed independent third-party certification or attestation. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

To report a suspected vulnerability, see our security contact policy.

10. Your Rights

Under the GDPR, UK GDPR and the Nigeria Data Protection Act 2023, you hold the following rights regarding your personal data:

Access: The right to request copies of the personal data we hold on you.
Rectification: The right to request correction of inaccurate or incomplete information.
Erasure ("Right to be Forgotten"): The right to request deletion of your personal records.
Restriction: The right to request that we limit how we process your personal data.
Data Portability: The right to receive your data in a structured, commonly used, machine-readable format and to have it transferred to another organization.
Objection: The right to object to direct marketing at any time, and to object to processing carried out on the basis of our legitimate interests.
Withdraw consent: The right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal. Every marketing email carries a one-click unsubscribe link, and cookie consent can be changed via Cookie Settings.
Lodge a complaint: The right to complain to a supervisory authority — the Nigeria Data Protection Commission (NDPC) in Nigeria, your national data protection authority in the EEA, or the Information Commissioner's Office (ICO) in the United Kingdom. We would appreciate the chance to address your concern first.

To exercise any of these rights, please contact our Data Protection Officer at privacy@relantern.com. We will respond within 30 days, and we do not charge a fee for a reasonable request.

11. Data Processing Agreements

Where we process personal data on your behalf as part of delivering IREAMS or a professional service, we act as a data processor and you act as the controller. In those circumstances we will enter into a written Data Processing Agreement (DPA) covering the subject matter and duration of processing, our obligations of confidentiality and security, the use and approval of sub-processors, assistance with data-subject requests and breach notification, and the return or deletion of data at the end of the engagement.

To request our standard DPA — or to have us review yours — write to privacy@relantern.com. We can also supply our control mapping and a security posture summary for your procurement or vendor-risk process.

12. Children's Privacy

Our website, software, and services are directed exclusively at businesses and professionals. We do not knowingly collect personal data from individuals under the age of sixteen (16).

13. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will always be posted on this page with an updated revision date. Where a change materially affects how we handle your personal data, we will take reasonable steps to notify you directly. We encourage you to review this policy periodically.

14. Contact Us

If you have any questions or concerns about this Privacy Policy or our data management practices, please contact us at:

Relantern Data Privacy Team
Email: privacy@relantern.com