Data Protection Impact Assessment (DPIA)

1. Assessment Scope & Legal Mandate

Section 28(1) of the NDPA 2023 mandates that where data processing may likely result in a high risk to the rights and freedoms of Data Subjects by virtue of its nature, scope, context, or purposes, a Data Controller shall carry out a Data Protection Impact Assessment prior to processing.

Collekt identified three operational dimensions triggering this statutory assessment:

• Large-scale processing of sensitive identification data: Verification of National Identification Numbers (NIN), CAC incorporation records, and engineering licensure.
• Algorithmic & AI-driven evaluations: Using Kolly AI (Google Gemini) for compatibility matching, bill of quantities (BOQ) estimation, and proposal recommendations.
• Custodial financial processing: Dedicated virtual NUBAN accounts, multi-million Naira milestone escrow holds, and 15% platform split disbursements.

2. Description of Processing Operations

Collekt functions as a verified B2B marketplace. Professionals register individual accounts to showcase COREN-certified credentials and bid on institutional tenders. Corporate clients post verified tenders and fund milestone deliverables into ring-fenced escrow custody. All transactions execute over secured payment rails (Paystack and Korapay) with final payouts settling directly to verified Nigerian bank accounts.

3. High-Risk Area 1: Identity Verification & Shield KYC

• Threat Scenarios: Unauthorized extraction of citizen NINs; identity theft; bulk harvesting of corporate director details; falsified engineering stamps.
• Architectural Safeguards Implemented:
  • Tokenization: Raw NINs are tokenized immediately upon verification against NIMC standards; raw identification numbers are never rendered in public client search views or unauthenticated API endpoints.
  • Transient File Quarantine: Uploaded identification slips are automatically purged after thirty (30) days, retaining strictly an immutable SHA-256 cryptographic proof of verification.
  • Pre-Signed Inspection URLs: Internal compliance officers view documents via time-bound 5-minute pre-signed URLs, preventing permanent URL sharing.
• Residual Risk Level: LOW

4. High-Risk Area 2: Kolly AI & Algorithmic Matching

• Threat Scenarios: Algorithmic bias leading to unfair exclusion of qualified specialists; unauthorized leakage of confidential engineering schematics (CAD drawings) into public LLM training datasets; loss of human agency.
• Architectural Safeguards Implemented:
  • No Automated Exclusion: AI match percentages (e.g. 94% Match) serve as informational sorting aids. Every verified professional retains the unhindered statutory right to apply and bid for any open opportunity on the Marketplace.
  • Zero Model Training: API requests to Google Gemini utilize enterprise tier configurations contractually excluding user briefs, cost estimates, and portfolio documents from public model training corpora.
  • Explainable Heuristics: Compatibility criteria are transparently disclosed to users, evaluating verified COREN status, discipline alignment, years of experience, and past milestone performance ratings.
• Residual Risk Level: LOW

5. High-Risk Area 3: Financial & Escrow Data Processing

• Threat Scenarios: Interception of escrow funds; unauthorized milestone release; webhook signature spoofing; duplicate payouts; tax evasion on Withholding Tax (WHT).
• Architectural Safeguards Implemented:
  • Atomic Database Transactions: Milestone releases execute via atomic PostgreSQL stored procedures enforcing double-entry ledger balance conservation: Platform Fee (15%) + Specialist Net Payout (85%) == 100% Escrow.
  • Cryptographic Webhook Verification: Inbound payment webhooks enforce constant-time HMAC-SHA512 validation with a strict 5-minute anti-replay timestamp window.
  • Two-Factor Financial PIN & Step-Up OTP: Disbursals require the user's secret 4-digit PIN (hashed with bcrypt). Withdrawals ≥ ₦50,000 mandate secondary time-bound SMS/email OTP authorization pursuant to CBN Cybersecurity Guidelines Section 4.2.
  • 1-to-1 NUBAN Name Matching: Payout destination bank accounts must match the verified profile legal name, preventing mule account diversion.
• Residual Risk Level: LOW

6. Proportionality & Necessity Analysis

The collection of NINs and CAC numbers is strictly necessary and proportionate to eliminate the acute economic hazard of "ghost contractors" and fake engineering stamps in high-risk infrastructure projects. The 15% platform commission and 5% WHT deductions are transparently itemized on audit-ready FIRS Electronic Tax Invoices, fully satisfying Sections 114–116 of the Federal Competition and Consumer Protection Act (FCCPA 2018).

7. Master Risk Assessment & Mitigation Matrix

8. Stakeholder & User Consultations

Prior to formalizing this DPIA, Collekt consulted with founding engineering cohort members, prospective EPC corporate clients, and certified legal practitioners. Stakeholders unanimously endorsed the mandatory 7-day milestone review SLA, transparent 15% fee structure, and dedicated virtual NUBAN escrow model as significant advancements in Nigerian commercial trust.

9. DPO & Executive Sign-Off