Data Protection Policy

1. Purpose & Scope of Application

The purpose of this Policy is to guarantee that Collekt Technologies Ltd handles all personal and corporate records in full alignment with statutory Nigerian privacy standards. This Policy applies across all operational environments:

• Personnel: All full-time employees, executive directors, engineering staff, compliance officers, and temporary contractors.
• Technical Systems: Production databases (Supabase PostgreSQL), cloud object stores, serverless API functions (Netlify), AI models (Gemini API), edge caching layers, and administrative portals.
• Data Assets: All electronic and physical records containing Data Subject identities, KYC scans (NIN, CAC, director details), financial ledgers, and technical project files.

2. Core Data Protection Principles (NDPA 2023 Section 24)

All data processing workflows across Collekt must satisfy the six fundamental principles established under Section 24 of the NDPA 2023:

1. Lawfulness, Fairness & Transparency: Data must be collected only under verified lawful bases (Consent, Contract, Legal Obligation, or Legitimate Interests) with plain-language notices provided prior to collection.
2. Purpose Limitation: Personal information collected for verification (e.g. NIN, CAC certificates) must never be repurposed for marketing, secondary profiling, or data broker dissemination.
3. Data Minimization: Collekt systems must request strictly the minimum information necessary to execute the requested feature. (e.g., verifying a corporate account requires CAC RC/BN validation without retaining unnecessary director domestic records).
4. Accuracy & Data Integrity: Users are empowered to update, rectify, and refresh outdated records directly via their Profile portal.
5. Storage Limitation: Records must be retained strictly in accordance with statutory retention schedules and purged upon expiration.
6. Integrity & Confidentiality: Data must be defended using defense-in-depth cryptographic controls against unauthorized alteration, accidental loss, destruction, or illicit access.

3. Governance & Data Protection Officer (DPO) Mandate

Pursuant to Section 32 of the NDPA 2023, Collekt maintains a dedicated Data Protection Office headed by a designated Data Protection Officer (DPO):

• Reporting Line: The DPO reports directly to the Chief Executive Officer and Board of Directors, ensuring independent oversight free from operational conflict of interest.
• Core Responsibilities: Monitoring platform compliance with NDPA; advising engineering teams on Data Protection Impact Assessments (DPIAs); serving as the official liaison to the Nigeria Data Protection Commission (NDPC); and overseeing prompt resolution of Data Subject complaints within statutory SLAs.
• Contact Information: Inquiries, regulatory submissions, or audit inquiries are directed to compliance@collektng.com (Regulatory & Legal Desk) or kolly@collektng.com (Concierge).

4. Access Control, Least Privilege & RBAC

To eliminate internal data leakage and horizontal privilege escalation:

• Role-Based Access Control (RBAC): Administrative permissions are segmented into granular roles (Support Specialist, Verification Auditor, Escrow Treasury Manager, Super Admin). Access to sensitive KYC documents is restricted strictly to verified Compliance Officers.
• Mandatory Multi-Factor Authentication (MFA): All internal developer, administrator, and database accounts require hardware-backed or time-based OTP two-factor authentication.
• PostgreSQL Row-Level Security (RLS): Multi-tenant isolation is enforced at the database engine layer. Database policies prohibit User A from viewing, modifying, or querying User B's private documents, wallet balances, or unreleased bids.
• Four-Digit Financial PIN & Step-Up OTP: Financial operations (escrow disbursements, NUBAN withdrawals) mandate client PIN authorization and time-bound SMS/email OTPs for amounts ≥ ₦50,000.

5. Cryptographic & Network Safeguards

• Encryption in Transit: Mandatory TLS 1.3 encryption across all public web and API traffic with strict HTTP Strict Transport Security (HSTS) headers and anti-clickjacking directives (X-Frame-Options: DENY).
• Encryption at Rest: AES-256 encryption applied to all file storage buckets housing uploaded resumes, COREN licenses, CAC incorporation files, and project CAD schematics.
• Credential Protection: Passwords and transaction PINs are cryptographically hashed using industry-standard salted hashing algorithms (bcrypt/Argon2); plaintext passwords or PINs are never stored or logged in telemetry.
• WORM Audit Logging: System audit logs enforce Write-Once-Read-Many (WORM) immutability via database triggers preventing modification or deletion.

6. Privacy by Design in Software Engineering

Every software release, serverless function, and schema migration deployed to Collekt must satisfy Privacy by Design standards:

• Pre-Commit Security Checks: Automated CI/CD pipelines scan source code for exposed API tokens, database keys, or hardcoded secrets prior to production deployment.
• Zero Sensitive Data in Telemetry: Loggers are configured to strip NINs, phone numbers, email addresses, and bank account numbers from operational console logs.
• File Upload Quarantine & Magic-Byte Inspection: All incoming document uploads undergo magic-byte signature validation and MIME-type quarantine to prevent executable or polyglot payload execution.

7. Handling Data Subject Rights Requests

Pursuant to Sections 34–39 of the NDPA 2023, Collekt honors statutory Data Subject Rights without undue delay:

• Right to Access & Portability (Sec 33): Users can generate an automated machine-readable export of their profile and activity history via /api/account-export.
• Right to Erasure (Sec 34): Users may submit account deletion requests via their profile portal. Records are processed within fourteen (14) business days, subject to mandatory 6-year financial tax retention obligations.
• Right to Rectification: Users can update profile information in real time via their dashboard settings.
• SLA: Formal requests submitted to compliance@collektng.com receive written acknowledgment within forty-eight (48) hours and full statutory resolution within thirty (30) calendar days.

8. Third-Party Vendor Risk Management

Collekt executes formal Data Processing Agreements (DPAs) with every third-party processor (Supabase, Paystack, Korapay, Netlify, Google Cloud). Vendors must demonstrate:

• Documented compliance with the NDPA 2023 or recognized international adequacy standards (ISO 27001, SOC 2 Type II, PCI-DSS).
• Contractual commitments to notify Collekt within twenty-four (24) hours of any suspected security incident.
• Strict prohibition against repurposing Collekt user data for third-party advertising or public AI model training.

9. Employee Training & Code of Conduct

• Mandatory Onboarding Training: Every team member completes data protection and cyber hygiene training prior to receiving system credentials.
• Confidentiality Obligations: All staff sign binding Non-Disclosure Agreements (NDAs) that survive termination of employment.
• Disciplinary Sanctions: Unauthorized inspection, copying, or dissemination of user personal information constitutes gross misconduct, resulting in summary dismissal, civil recovery, and referral to the NDPC and law enforcement.

10. Annual Audits & Regulatory Filings

Collekt commits to conducting an annual statutory Data Protection Compliance Audit through a licensed Data Protection Compliance Organization (DPCO) and submitting the formal audit report to the Nigeria Data Protection Commission (NDPC) in compliance with the NDPA 2023 regulatory timetable.