Data Protection

1. The law we follow

We handle personal data under the Nigeria Data Protection Act 2023 and the General Application and Implementation Directive issued by the Nigeria Data Protection Commission, the regulator for data protection in Nigeria.

We follow the principles in section 24 of the Act. Personal data is:

• processed fairly, lawfully and transparently;
• collected for specific, clear and legitimate purposes, and not used in ways that do not fit them;
• adequate, relevant and limited to what is needed;
• kept accurate and up to date;
• kept no longer than needed;
• kept secure against loss, misuse and unauthorised access.

2. Who is the controller and who is the processor

3. What we commit to as your processor

When we process personal data for you, as section 29 of the Act requires, we will:

• process it only to provide the service you have asked for and on your documented instructions (your use of the dashboard and API);
• make sure everyone who can access it is bound to keep it confidential;
• protect it with appropriate technical and organisational measures (see below);
• use another processor only under a contract that gives the data at least the same protection, and remain responsible for their work;
• help you answer requests from data subjects and meet your own duties under the Act, as far as we reasonably can;
• tell you without undue delay if we become aware of a personal data breach affecting your data;
• delete or return your data when your account is closed, except what the law requires us to keep;
• give you the information you reasonably need to show that these commitments are met.

These commitments form part of our Terms and Conditions. If your organisation needs a signed data processing agreement, write to support@odotservices.com.ng.

4. What you must do as the controller

• Have a lawful basis. Only email or text people who have agreed to hear from you or with whom you have another lawful basis under section 25 of the Act.
• Tell people. Your own privacy notice should say that you use service providers to send messages and verify identity.
• Get consent for identity checks. Before you submit someone’s NIN, BVN or other identifier, make sure they know and, where the law requires it, have agreed, and that the check is needed for a legitimate purpose such as onboarding or fraud prevention.
• Respect choices. Give people a way to stop marketing messages and act on it promptly.
• Keep only what you need. Do not upload more personal data than the task requires, and delete results you no longer need.
• Protect your access. Keep API keys and passwords private and remove access for people who leave your team.
• Meet your own duties to the NDPC. If your organisation is a data controller or processor of major importance, register with the Commission and file the returns it requires.

5. Identity verification data

Identity numbers and the records returned for them are treated with extra care:

• we use them only to carry out the check you requested and to show you the result;
• requests are sent to the verification source over encrypted connections;
• results are stored encrypted, and identifiers are masked in the dashboard;
• access is limited to your account and to our staff who need it to support you or investigate abuse;
• we do not use verification results for our own marketing or sell them to anyone.

6. Security measures

• Encrypted connections (HTTPS/TLS) for the dashboard, API and mail submission.
• Passwords stored only as one-way hashes; API keys and stored secrets encrypted.
• Access to production systems limited to authorised staff, with activity logs.
• Sending limits, abuse detection and sender checks (SPF, DKIM and domain verification) to stop impersonation.
• Regular backups and software updates.

7. Other processors we use

To provide the service we use carefully chosen providers in these categories: hosting and infrastructure; email delivery; SMS carriers; identity verification providers and official registries; payment providers (Paystack and Squad); and AI providers, only for AI features you choose to use. A current list is available on request from support@odotservices.com.ng.

8. Transfers outside Nigeria

Where a provider processes data outside Nigeria, we make the transfer only on a basis allowed by sections 41 to 43 of the Act: an adequate level of protection in the receiving country, binding contractual safeguards, or one of the specific conditions the Act lists (such as the transfer being necessary to perform a contract).

9. If there is a data breach

• We investigate and contain it at once.
• Where we are the controller and the breach is likely to put people’s rights and freedoms at risk, we notify the NDPC within 72 hours of becoming aware of it, and tell the affected people without undue delay where the risk to them is high.
• Where the data is yours and we are the processor, we tell you without undue delay, with what we know about what happened, what data is affected and what we are doing, so that you can meet your own duty to notify.

10. Requests from data subjects

People have the right to access, correct, erase, restrict, object to and move their data, and to withdraw consent.

• If the request is about your account with us, email support@odotservices.com.ng. We answer within 30 days.
• If you received a message or were verified by one of our customers, that business is the controller. Contact them first. If you write to us, we will pass your request to them and help them answer it.

Anyone can also complain to the Nigeria Data Protection Commission at ndpc.gov.ng.

11. Retention and deletion

We keep the data you process through us for as long as your account is open and as needed to provide logs and history in your dashboard. When your account is closed we delete or anonymise it, apart from records the law requires us to keep, such as payment records.

12. Our Data Protection Officer

Data Protection Officer
CloudXpert Systems & OacSoft Technologies
Plot 693 Obafemi Awolowo Way, Jabi District, Abuja, Nigeria
Email: support@odotservices.com.ng

We review this page whenever our processing or the law changes.