🛡️ Federal Republic of Nigeria • NDPA 2023 Statutory Privacy Policy

FinanceFlex Privacy Policy

Formulated under the Nigeria Data Protection Act (NDPA 2023) and Central Bank of Nigeria (CBN) regulations, governing the collection, processing, and protection of personal and financial data.

⚖️

NDPA 2023 Compliance & Banking Rails Protection

FinanceFlex is operated by SITANET GLOBAL ORBIT LIMITED (RC: 1772819). We are committed to upholding the constitutional rights to privacy of all Nigerian citizens. This Privacy Policy details our data collection standards, our partnership with 9 Payment Service Bank (9PSB), your statutory rights under the Nigeria Data Protection Act (NDPA) 2023, and the security measures safeguarding your business operations.

1. Legislative & Regulatory Framework

This Policy complies with the mandatory requirements of:

  • Nigeria Data Protection Act (NDPA) 2023, enacted by the National Assembly of the Federal Republic of Nigeria.
  • Nigeria Data Protection Regulation (NDPR) 2019 administered by the Nigeria Data Protection Commission (NDPC).
  • Central Bank of Nigeria (CBN) Regulatory Framework for Bank Verification Number (BVN) Operations.
  • National Identity Management Commission (NIMC) Act No. 23 of 2007.
  • Money Laundering (Prevention and Prohibition) Act 2022 and Terrorism (Prevention and Prohibition) Act 2022.

2. Categories of Information We Collect

To provide enterprise ERP functionality, automated bank transfer reconciliation, and regulatory compliance, we collect the following categories of data:

a) Director & Business Owner KYC Identity Data:

Full Legal Name, Email Address, Verified Telephone Number, National Identity Number (NIN), Bank Verification Number (BVN), Date of Birth, and digital copy of the official NIMC NIN Slip or Government-issued Identification document.

b) Business Entity & Corporate Records:

Business Trade Name, Corporate Affairs Commission (CAC) Registration Number (RC/BN), Tax Identification Number (TIN), business physical address, and primary trade sector.

c) Financial & 9PSB Banking Transaction Data:

Assigned dynamic 9PSB Virtual NUBAN accounts (990xxxxxxx), settlement bank account numbers, bank transfer confirmation alerts, transaction reference IDs, POS payment timestamps, and payment verification webhooks.

d) Operational Commercial Data:

Inventory stock counts, product catalog pricing, cashier shifts, customer sales receipts, expense categories, and statutory tax calculations.

3. Lawful Bases for Processing (Section 25, NDPA 2023)

We process your data strictly pursuant to the lawful bases recognized under Section 25 of the NDPA 2023:

  • Contractual Performance: Processing necessary to provide point of sale services, cloud database storage, receipt printing, and business workspace features.
  • Legal & Regulatory Obligation: Verifying identity via NIN and BVN to satisfy CBN Anti-Money Laundering (AML/CFT) Customer Due Diligence, CAC compliance, and FIRS/SIRS tax record keeping.
  • Legitimate Interests: Preventing unauthorized access, detecting fraud, and securing multi-tenant databases.
  • Explicit Consent: Where you provide consent for optional identity verification or third-party banking add-ons.

4. 9PSB (9 Payment Service Bank) Banking Rails Integration

To facilitate automated bank transfer collections and settlement, FinanceFlex integrates with 9 Payment Service Bank (9PSB) via the SitanetPay payment aggregator platform:

🏦 Transparency Disclosure on 9PSB Data Sharing:

When an invoice or checkout session is initialized, transaction metadata (transaction amount, order ID, and workspace reference) is transmitted to 9PSB to issue a dynamic, 10-digit virtual NUBAN account. Upon completion of payment, 9PSB transmits real-time settlement notification webhooks back to our platform to verify and credit the payment. We do not store customer bank passwords or PINs.

5. Zero Biometric Storage Principle

FinanceFlex operates on a strict Zero Biometric Storage architecture. While identity validation lookups are executed through accredited verification gateways (NIMC/NIBSS/Dojah), raw fingerprints, iris scans, or facial templates are NEVER captured, stored, or processed on our servers.

6. Data Security & Encryption Standards

We employ industry-leading technical and organizational security safeguards:

  • Transit Encryption: All data in transit between users, our servers, and 9PSB is encrypted with 256-bit Transport Layer Security (TLS 1.3 / SSL).
  • Database Multi-Tenant Isolation: Every business workspace is isolated at the database query level, preventing cross-tenant data leaks.
  • At-Rest Protection: Critical keys, webhook secrets, and sensitive attributes are encrypted using AES-256 standard encryption.
  • Immutable Audit Trails: Platform operations are logged to a tamper-resistant audit ledger retained for compliance verification.

7. Statutory Data Subject Rights (NDPA 2023)

Under the Nigeria Data Protection Act 2023, you have the following enforceable statutory rights:

Right of Access:

Request a copy of the personal and business records we hold about you.

Right to Rectification:

Update inaccurate or incomplete identity and business profile data anytime.

Right to Erasure ("Forgotten"):

Request deletion of personal data, subject to CBN mandatory transaction retention.

Right to Portability:

Export your inventory, sales, and accounting records in standard formats (CSV/Excel).

8. Data Retention Policy

Pursuant to statutory directives issued by the Central Bank of Nigeria (CBN) and Federal Inland Revenue Service (FIRS), financial transaction records and business tax ledgers are retained for a statutory minimum of five (5) to six (6) years following the financial year of execution. Personal identity records uploaded during onboarding are securely archived and deleted upon verified account closure subject to regulatory audit mandates.

9. Data Protection Officer (DPO) & Contact Details

If you have questions about this Privacy Policy, wish to exercise any of your data rights, or want to submit an inquiry to our Data Protection Officer, please contact:

Data Protection Office • SITANET GLOBAL ORBIT LIMITED
Appointed pursuant to Section 32 of the Nigeria Data Protection Act (NDPA) 2023

Email: dpo@sitanet.ng / privacy@financeflex.com.ng
Regulatory Supervisory Authority: Nigeria Data Protection Commission (NDPC), Abuja, Nigeria.
Corporate Headquarters: SITANET GLOBAL ORBIT LIMITED, Lagos, Nigeria.