Data Protection and Privacy Policy

Smart DNA ("Smart DNA", "we", "our", or "us") is a DNA testing company providing relationship DNA testing, legal DNA testing, immigration DNA testing, prenatal DNA testing, maternity DNA testing, indirect relationship testing, wellness DNA testing, diagnostic genetic testing, and other related genetic services. Our website is available at https://www.smartdna.com.ng/ and our services may be accessed through our offices, partner collection centres, remote collection arrangements, phone, email, WhatsApp, Social Media, web forms, and other approved communication channels.

We are committed to protecting the privacy, confidentiality, and security of personal data entrusted to us, especially because our services involve sensitive personal data, including health data, genetic data, biometric identifiers, data relating to minors, and identification documents. This Policy explains how we collect, use, store, disclose, transfer, retain, and protect personal data in accordance with the Nigeria Data Protection Act, 2023 (NDPA) and other applicable legal and regulatory requirements.

By using our website, booking a test, submitting samples, communicating with us, or otherwise engaging our services, you acknowledge that you have read and understood this Policy.

Personal Data means any information relating to an identified or identifiable individual.

Sensitive Personal Data includes data relating to an individual's health, genetic data, biometric data, sex life, medical condition, biological and other relationships, and any other category protected under applicable law.

Genetic Data means personal data relating to inherited or acquired genetic characteristics of an individual obtained from biological samples or laboratory analysis.

Processing means any operation performed on personal data, including collection, recording, organisation, storage, use, disclosure, transfer, retention, deletion, or destruction.

Data Subject means the individual to whom personal data relates.

Minor means a child under the age at which they can lawfully give valid consent under applicable law or where parental or guardian consent is otherwise required.

Smart DNA processes personal data in line with the following principles:

• lawfulness, fairness, and transparency
• purpose limitation
• data minimisation
• accuracy
• storage limitation
• integrity and confidentiality
• accountability

Depending on the service requested, we may collect:

We may collect personal data directly from:

• the customer or applicant
• the person being tested
• a parent, guardian, or authorised representative
• healthcare providers, legal representatives, or partner collection centres where authorised
• forms completed on our website
• telephone, email, WhatsApp, and in-person communications
• cookies and analytics tools used on our website

We process personal data only where we have a valid lawful basis.

• Test booking and case management: contract and legitimate interests.
• Laboratory analysis and reporting: explicit consent and contract.
• Legal and immigration testing: explicit consent, legal obligation, and contract.
• Communicating results and support: contract and legitimate interests.
• Fraud prevention, audit, and dispute handling: legitimate interests and legal obligation.
• Website analytics and service improvement: consent where required and legitimate interests.
• Regulatory compliance: legal obligation.
• Safeguarding minors and validating authority: legal obligation and legitimate interests.
• Anonymized data for demographic and scientific research purposes

Because Smart DNA handles health and genetic data, we apply enhanced safeguards. We only process such data where:

• the data subject has given explicit consent
• a parent or legal guardian has provided valid consent for a minor
• processing is necessary for the requested service
• we are required to comply with a legal or regulatory obligation

We do not use customer genetic data for unrelated marketing, profiling unrelated to the requested service, or any unauthorised secondary purpose.

Many DNA tests involve children. Where a test concerns a minor, Smart DNA requires consent and authority from a parent, legal guardian, or other person lawfully entitled to provide such consent.

Where the test type requires additional documentation, witnessed consent, or chain-of-custody processes, Smart DNA may request further proof of authority before collection or processing begins.

We may share personal data only where necessary and only with appropriate safeguards, including:

• accredited partner laboratories within or outside Nigeria
• partner collection centres
• logistics and courier providers
• IT, hosting, CRM, cloud storage, and website service providers
• legal advisers, auditors, insurers, and regulators
• courts, embassies, immigration authorities, or law-enforcement bodies where legally required or authorised by the customer

We require service providers and partners who process personal data on our behalf to maintain appropriate confidentiality and security measures.

Some Smart DNA services involve the transfer of samples or related personal data to international partner laboratories, including laboratories outside Nigeria. Where this occurs, we take reasonable steps to ensure such transfers are subject to appropriate safeguards, contractual protections, confidentiality obligations, and standards consistent with applicable data protection requirements.

By booking or proceeding with a relevant test, you acknowledge that cross-border transfer may be necessary to deliver the requested service.

Our website may use cookies and similar technologies for:

• essential website functionality
• traffic measurement and analytics
• remembering preferences
• marketing and remarketing where implemented

Please see our separate Cookie Policy for more information.

We retain personal data only for as long as necessary for the purpose for which it was collected, including for:

• completion of the requested test
• regulatory and audit requirements
• resolution of disputes
• legal, tax, or evidentiary obligations
• customer support and service verification

Retention periods may differ depending on the type of test, whether the case is legal or immigration-related, whether the customer has requested future reissue of reports, and whether law or regulator guidance requires longer retention.

Biological samples, consent forms, chain-of-custody records, and digital reports may each have different retention periods.

Subject to applicable law, data subjects may have the right to:

• be informed about processing
• request access to their personal data
• request correction of inaccurate data
• request deletion where appropriate
• object to certain processing
• request restriction of processing
• withdraw consent, where consent is the basis
• request data portability where applicable
• complain to the Nigeria Data Protection Commission (NDPC)

Where a request relates to data that must be retained for legal, evidentiary, contractual, or regulatory reasons, Smart DNA may be unable to delete it immediately but will explain the limitation.

We use reasonable technical, organisational, and administrative safeguards to protect personal data against loss, misuse, unauthorised access, alteration, disclosure, or destruction. These measures may include:

• restricted access controls
• staff confidentiality obligations
• secure communications and password-protected systems
• document handling procedures
• secure sample handling procedures
• vendor due diligence
• incident response procedures

We may occasionally send service-related updates, reminders, educational material, or promotional messages where permitted by law. You can opt out of non-essential marketing communications at any time.

For privacy, data protection, or personal data requests, please contact:

Smart DNA
Email: care@smartdna.com.ng
Phone: +234 912981 3912 / +234 812 868 1270
Address: 1A Johnson Oguntuyo Street, Atunrase Estate, Gbagada, Lagos, Nigeria

If you are dissatisfied with our response, you may complain to the Nigeria Data Protection Commission (NDPC) through its official channels.

We may update this Policy from time to time. The latest version will be posted on our website with the updated effective date.