Privacy Policy

1. Who we are

ComplianceNG ("we", "us", "our") facilitates business, travel, vehicle, and personal compliance services in Nigeria, and operates an agent referral program. This policy explains how we collect, use, store, and protect personal data under the Nigeria Data Protection Act, 2023 (NDPA) and its implementing General Application and Implementation Directive (GAID).

2. What personal data we collect

If you submit an application as a client

• Name, phone number, email address
• Details specific to the service requested (e.g. business name for CAC registration, travel details for visa services)
• Payment information (processed by Paystack — we do not store your card details)

If you sign up as an agent

• Name, phone number, email address, password (stored as a salted cryptographic hash, never in plain text)
• Legal name, government-issued ID type and number, and a photo of that ID (for verification)
• For store/kiosk agents: store address, state, and LGA, plus a photo of the storefront
• Bank account name, number, and bank name (for commission payouts)

Automatically, from anyone visiting our site

• A referral code, if you arrived via an agent's or another client's referral link (stored locally in your browser for up to 30 days)

3. Why we collect it

• To provide the compliance service you've requested, and to communicate with you about it
• To process payments and pay out agent commissions correctly
• To verify agent identity and store/kiosk legitimacy before approving them to represent us
• To attribute referrals correctly and calculate commissions owed
• To meet our own legal, tax, and regulatory obligations

4. Our legal basis for processing

Under Section 25 of the NDPA, we rely on one or more of the following depending on the situation:

• Consent — given explicitly at the point you submit an application or sign up as an agent
• Performance of a contract — processing needed to deliver the service you've asked for, or to operate our agreement with you as an agent
• Legal obligation — e.g. retaining payment records for tax purposes

5. Who we share it with

We don't sell personal data. We share it only with the vendors that help us operate the service, each acting under their own data processing terms:

Referral partner agents see only the name, phone number, and services relevant to applications they personally referred.

6. International data transfers

Some of the vendors above operate infrastructure outside Nigeria. The NDPA requires that when we transfer personal data outside the country, the recipient must provide a level of protection adequate to what the NDPA guarantees within Nigeria — through a qualifying law, contractual safeguard, binding corporate rules, or certification mechanism.

We maintain an internal register documenting each vendor, what data is transferred, where, and the safeguard that applies, reviewed as part of our compliance process. If you'd like more detail on a specific transfer, contact us using the details in Section 12.

7. How long we keep it

We retain application and payment records for as long as needed to provide the service and meet our tax and legal obligations, and agent records for the duration of the agent relationship plus a reasonable period afterward for financial reconciliation. You can request deletion at any time — see Section 9 — and we'll act on it unless we're legally required to retain specific records.

8. How we protect it

We apply technical and organisational measures proportionate to the sensitivity of the data involved, including: credentials and database access restricted to server-side infrastructure and never exposed in client-facing code, authenticated and rate-limited access to personal data, server-side verification of payments before any financial record is created, and field-level access controls so agents can only view or edit their own records.

9. Your rights and how to exercise them

Under the NDPA, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data, where we're not legally required to keep it
• Withdraw consent at any time, where consent is our basis for processing
• Object to certain processing

10. Children's data

Our services are intended for individuals who can lawfully enter into agreements in Nigeria. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes to this policy

We may update this policy as our services or legal obligations change. Material changes will be reflected in the "Last updated" date at the top of this page, and where appropriate, we'll take further steps to bring changes to your attention.

12. Contact us