Last reviewed: July 2026
Effective: 6 July 2026Plain English summary: We collect the minimum data needed to run your account. We never sell your data. Your client data belongs to you. You can request deletion at any time.
Ngozi CRM is operated by A-One Global Resourcing Ltd (AOGRL), a company incorporated in Mauritius (Business Registration No. C23014789). References to "we", "us", or "our" mean AOGRL.
For data protection purposes, AOGRL is the data controller for account and billing data. You (the clinic owner) are the data controller for your clients' personal data stored within the platform.
Contact: compliance@aogrl.com
Data you enter about your own clients — names, contact details, treatment notes, appointment history, invoices, photos — is your data. We process it on your behalf as a data processor, not a data controller. We do not access, analyse, or share it except to provide the service.
If you submit a contact or trial request form on our website, we collect your name, email, phone, and clinic name to follow up with you about Ngozi CRM.
For users in Nigeria, we comply with the Nigeria Data Protection Regulation (NDPR) 2019 and its Implementation Framework, as administered by the National Information Technology Development Agency (NITDA). We conduct Data Protection Impact Assessments for high-risk processing and appoint a Data Protection Compliance Organisation (DPCO) as required.
For users in South Africa, we comply with the Protection of Personal Information Act 4 of 2013 (POPIA). We process personal information lawfully and only for the purposes set out in this policy. You have the right to object to processing and to lodge a complaint with the Information Regulator at inforegulator.org.za.
For users in Kenya, we comply with the Kenya Data Protection Act 2019 and the regulations thereunder. You have the right to access, correct, and delete your personal data. Complaints may be lodged with the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.
As a company incorporated in Mauritius, we are subject to the Mauritius Data Protection Act 2017. We are registered with the Data Protection Office (DPO) of Mauritius. Complaints may be directed to the Data Protection Office at dataprotection.govmu.org.
We respect applicable data protection laws in all markets where we operate, including the Ghana Data Protection Act 2012, the Senegal Law on Personal Data Protection (Law 2008-12), and the Ethiopia Personal Data Protection Proclamation. Users in these markets have equivalent rights to access, correct, and delete their data by contacting us at compliance@aogrl.com.
Your data is stored on:
All data is encrypted in transit (TLS 1.2+) and at rest. Access is role-based — staff members only see data belonging to their own organisation. We perform regular backups.
Payment data never touches our servers. PayPal processes all card and payment information directly under their own PCI-DSS compliance programme.
We do not sell, rent, or trade your personal data. We share it only with:
All sub-processors are bound by data processing agreements and operate under equivalent data protection standards.
NgoziCRM offers an optional Google Calendar integration. It is off until you connect it, and you can disconnect it at any time.
What we access: When you connect your Google Calendar, NgoziCRM asks Google for two permissions (scopes):
https://www.googleapis.com/auth/calendar.events: to create, update and delete the calendar events that mirror your NgoziCRM appointments. An event is created when a booking is made, updated when it is rescheduled or changed, and deleted when the appointment is deleted in NgoziCRM. The events we create contain the appointment time, a title with the service and client name, and the appointment notes if there are any. We also read the events on your calendar to show them alongside your bookings in the NgoziCRM diary.https://www.googleapis.com/auth/calendar.freebusy: to read only the times you are busy or free on your connected calendar (no event details), so that times when you are already busy are treated as unavailable and clients cannot book online over them.What we do with calendar data we read: Events we read are used only to show them to you in NgoziCRM and to work out availability when a page or booking slot is requested. We do not keep copies of them, and we do not share them, sell them, use them for advertising, or use them to train any AI model. Beyond the identifier of each event we create (so we can update or delete it later), we store nothing from your calendar.
Token storage: The access we hold to your calendar (OAuth tokens) is encrypted in our database and used solely to maintain the connection. It is never shared with third parties.
Revoking access: You can disconnect from NgoziCRM's Settings page; we then revoke the access at Google and delete our stored tokens immediately. You can also remove NgoziCRM on your Google Account permissions page; in that case we delete our stored tokens the next time we try to use them. Disconnecting never deletes events from your Google Calendar.
NgoziCRM's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
When you use NgoziCRM's WhatsApp reminder and re-engagement features, your clients' phone numbers are transmitted to Meta Platforms (WhatsApp) to deliver messages on your behalf. This transmission is governed by WhatsApp's own Privacy Policy and Meta's Terms of Service. We only send WhatsApp messages to clients who have provided their phone number to your clinic — we do not use these numbers for any other purpose. You are responsible for ensuring you have appropriate consent from your clients to contact them via WhatsApp.
Your data may be processed in the EU, UK, and USA (via our infrastructure providers). Where transfers occur outside the EEA, we rely on Standard Contractual Clauses (SCCs) or equivalent safeguards as required by UK and EU GDPR.
Under UK GDPR, EU GDPR, and applicable data protection laws, you have the right to:
To exercise any of these rights, email compliance@aogrl.com. We will respond within 30 days.
You also have the right to lodge a complaint with your local supervisory authority:
We use essential cookies only for session management and authentication. No advertising or tracking cookies. See our Cookie Policy for full details.
Ngozi CRM is a B2B platform for business owners. We do not knowingly collect data from anyone under 18. If you believe a minor has submitted data to us, please contact us immediately.
We will notify active users by email of any material changes at least 14 days before they take effect. The "Last reviewed" date at the top of this page reflects the most recent update.
A-One Global Resourcing Ltd (AOGRL)
Souillac, Mauritius
Email: compliance@aogrl.com
Website: ngozi-crm.beauty