1. Introduction
UNCLETIM DIGITAL SOLUTIONS LTD processes personal data in the course of providing digital, payment-support, and identity-verification services. This policy sets out how the Company complies with the Nigeria Data Protection Act 2023 (NDPA) and the directives of the Nigeria Data Protection Commission (NDPC).
2. Data Protection Officer
The Company has appointed a Data Protection Officer (DPO): Olamide Timilehin Adedayo — [email protected] — 08107198344.
3. Personal data processed
Customer names, phone numbers, email addresses, dates of birth, residential addresses, Bank Verification Numbers (BVN), National Identification Numbers (NIN), photographs/face images, and transaction records — collected only for specified, lawful purposes including account onboarding, KYC/identity verification, transaction processing, fraud prevention, and regulatory compliance.
4. Principles and safeguards
- Lawfulness, fairness, and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality.
- Technical measures: TLS 1.2+ encryption in transit, AES-256 encryption at rest, MFA on all administrative access, role-based access control, audit logging.
- Data is shared only where necessary — principally with 9 Payment Service Bank (payment infrastructure) and Prembly Limited (identity verification) — under written contracts containing data-protection and confidentiality obligations, following due diligence on each processor.
5. Data subject rights
Data subjects may request access, correction, deletion, restriction, portability, or object to processing, by contacting the DPO. Requests are answered within the timelines required by the NDPA, free of charge unless manifestly unfounded or excessive.
6. Breach management
Personal data breaches are handled under the Incident Response Plan. Where required by section 40 NDPA, the NDPC is notified within 72 hours of the Company becoming aware of the breach, and affected data subjects are informed where the breach is likely to result in high risk to them.
7. Retention and review
Personal data is retained only as long as necessary for the purpose collected and to meet legal and regulatory obligations (including partner-bank requirements), after which it is securely deleted. This policy is reviewed annually.