# Privacy Policy (NDPA 2023)

**Data controller:** [COMPANY LEGAL NAME] (RC [CAC NUMBER]), [REGISTERED ADDRESS]
**Product:** [PRODUCT NAME] ("the Platform")
**Contact (Data Protection Officer):** [DPO NAME], [dpo@yourdomain.com]
**Version:** 0.1 DRAFT | **Effective date:** [DATE]

> DRAFT FOR LEGAL REVIEW. Written under the Nigeria Data Protection Act 2023 (NDPA) and its implementation framework; confirm current requirements, including registration with the Nigeria Data Protection Commission (NDPC) and any data-protection compliance audit filings, with counsel. Replace every bracket before publishing.

---

## 1. Who we are
[COMPANY] provides a mobile money and payments app. Financial services are delivered **in partnership with licensed financial institutions** ("Partners"). This policy explains what personal data we collect, why, who receives it, and your rights.

## 2. Data we collect
| Category | Examples | Source |
|---|---|---|
| Identity | Full name, date of birth, phone, email, BVN, NIN, selfie, ID document | You; identity-verification providers |
| Contact and address | Address, utility bill (higher tiers) | You |
| Account and transaction | Balances, transfers, recipients, bill payments, card activity | Generated by your use |
| Device and security | Device identifiers, IP address, session and login events, failed sign-ins | Automatically collected |
| Communications | Support messages, AI assistant conversations | You |
| Compliance | Screening results, risk scores, case notes | Us; Partners; screening providers |

We do **not** knowingly collect data from children under 18 **[confirm age policy]**.

## 3. Why we use your data and our lawful basis
| Purpose | Lawful basis (NDPA s.25) |
|---|---|
| Open and run your account, process payments | Contract |
| Verify your identity (KYC), screen against sanctions, report suspicious activity | Legal obligation |
| Detect and prevent fraud, secure the Platform | Legitimate interest; legal obligation |
| Customer support | Contract; legitimate interest |
| AI assistant features | Contract; your consent where required |
| Product improvement and analytics using aggregated or de-identified data | Legitimate interest |
| Marketing messages | **Consent** (opt-in, easy to withdraw) |

## 4. Sensitive data
BVN, NIN and biometric data (selfie/liveness) are treated as high-risk. We use them only for identity verification, fraud prevention and legal compliance, and apply stricter access controls. **[Confirm whether biometric data is classed as sensitive personal data and whether explicit consent is required for your flow.]**

## 5. AI assistant and your data
- The assistant can read **only your own** account information through server-side, authorised tools.
- It **cannot move money**. It can prepare a draft that you review and authorise with your PIN.
- Card numbers and national identifiers are **redacted** before conversation data is sent to an AI model provider.
- **[Confirm with your AI vendor: whether data is retained or used for training (it should not be), and where it is processed.]**
- You can use the Platform without the assistant **[confirm this is true in the product]**.
- Automated risk scoring may hold or block a transaction for security; you may ask for a human review (see section 9).

## 6. Who we share data with
| Recipient | Why |
|---|---|
| Licensed banking/payment Partners and payment switches | Process transfers and hold funds |
| Identity-verification and sanctions-screening providers | KYC and AML |
| SMS/OTP providers | Authentication |
| Card issuing and processing partners | Virtual/physical cards |
| Cloud and database hosting (e.g. Supabase) | Store and process data |
| AI model providers | Assistant features, with redaction as above |
| Regulators, law enforcement, courts | Where legally required |
| Professional advisers and auditors | Under confidentiality |

We do not sell your personal data.

## 7. International transfers
Some providers process data outside Nigeria. We transfer data only where adequate protection exists or appropriate safeguards (such as contractual clauses) are in place, as required by the NDPA. **[List actual hosting regions and confirm legal mechanism with counsel.]**

## 8. How long we keep data
| Data | Retention |
|---|---|
| KYC and transaction records | At least **5 years** after the relationship ends (AML law) **[confirm]** |
| Security and audit logs | **[X months]** |
| Support conversations | **[X months]** |
| AI conversations | **[X days/months]** |
| Marketing preferences | Until you withdraw consent |

After the retention period data is deleted or irreversibly anonymised. Legal retention duties can override a deletion request.

## 9. Your rights
Under the NDPA you may:
- **Access** your data and get a copy
- **Correct** inaccurate data
- **Delete** data, subject to legal retention duties
- **Restrict or object** to certain processing, including direct marketing
- **Data portability**
- **Withdraw consent** at any time
- **Not be subject to solely automated decisions** with significant effects, and request human review
- **Complain** to the Nigeria Data Protection Commission

Contact [dpo@yourdomain.com]. We aim to respond within **[30 days]** **[confirm statutory period]**.

## 10. Security
- Row-level security so each customer can only access their own records
- Encryption in transit and at rest **[confirm configuration with hosting provider]**
- Role-based staff access with multi-factor authentication
- Append-only audit logging
- Rate limiting and device/session controls
- Regular security testing **[PLANNED: schedule an independent penetration test before launch]**

## 11. Data breaches
If a breach is likely to harm your rights, we will notify the NDPC within **72 hours** of becoming aware and notify affected customers without undue delay **[confirm]**.

## 12. Cookies and analytics
**[Describe cookies/analytics actually used. If none beyond essential, say so.]**

## 13. Changes
We will publish changes here and notify you of material changes in the app or by email.

## 14. Contact
[COMPANY], [ADDRESS] | [dpo@yourdomain.com] | [phone]

---

## Internal checklist (delete before publishing)
- [ ] Register with the NDPC if required
- [ ] Appoint a Data Protection Officer
- [ ] Complete a Data Protection Impact Assessment (high-risk: BVN/NIN, biometrics, automated decisions)
- [ ] Sign data-processing agreements with every vendor above
- [ ] Record of processing activities
- [ ] Consent screens in the app match this policy
- [ ] Breach response procedure tested
- [ ] Annual compliance audit scheduled