Privacy Policy & Data Protection Notice

1. Scope & Data Controller

This Privacy Policy applies to all users visiting or registered on Collekt (https://collektng.com). The designated Data Controller responsible for your personal data is:

2. Lawful Bases of Processing

Pursuant to Section 25 of the NDPA 2023, Collekt processes your personal information strictly under the following lawful bases:

• Consent: Explicit, informed consent provided during sign-up, document submission, or newsletter subscription.
• Contractual Necessity: Processing required to establish escrow accounts, process milestone payments, facilitate tender bids, and fulfill contract awards.
• Legal Obligation: Compliance with Nigerian corporate and financial laws (CAMA 2020, FIRS tax compliance, EFCC anti-money laundering regulations).
• Legitimate Interests: Protecting marketplace security, preventing fraud, and optimizing AI matching algorithms without infringing upon your fundamental rights.

3. Categories of Data Collected

• Identity Data: Full name, username, professional title, profile photograph/avatar, government-issued identification numbers.
• Corporate Data: Registered business name, CAC RC/BN number, registered address, director details, FIRS TIN number.
• Contact Data: Email address, telephone number, physical location, state of residence/operations.
• Professional Credentials: Resumes/CVs, COREN engineering license numbers, university degrees, professional certifications (BOSIET, NDT, HSE, PMP), and portfolio drawings.
• Financial & Transactional Data: Paystack dedicated virtual NUBAN account records, wallet funding logs, withdrawal account details, transaction reference numbers, and platform commission ledgers. (Note: Collekt does not store raw debit/credit card CVV codes).
• Technical & Telemetry Data: IP address, browser type, device identifiers, session cookies, and login timestamps.

4. Sensitive KYC Verification Data & Regulatory Checks

To establish the Shield Verification status (🛡️), Users may voluntarily submit high-integrity identity documents:

• National Identification Number (NIN): Used exclusively to authenticate individual identity against NIMC standards.
• CAC Incorporation Documents: Used to confirm corporate legal existence and operational status with the Corporate Affairs Commission.
• Third-Party Verification Consent: By uploading these credentials, you grant Collekt Technologies Ltd and its certified verification infrastructure providers express permission to query the respective statutory databases. These documents are encrypted and accessible only to authorized compliance officers.

5. Kolly AI & Algorithmic Processing

• Candidate Compatibility Matching: When Kolly AI evaluates candidate profiles for posted tenders, it analyzes skill tags, discipline alignment, years of experience, and verification badges to calculate match scores.
• No Automated Exclusion: AI match recommendations never prevent candidates from submitting bids. All verified candidates retain the right to apply for any open opportunity on the Marketplace.
• Confidentiality of IP: Client project drafts and professional bids processed by Kolly AI are never sold to external data brokers or used to train public open-source models without authorization.

6. Data Sharing & Escrow Banking

Collekt does not sell, rent, or trade your personal data. We share data only with:

• CBN-Licensed Financial Rails: Paystack Payments Limited and designated settlement banks (Wema Bank, Sterling Bank, Nova Bank) to process escrow funding and direct NUBAN withdrawals.
• Matched Counterparties: Project proposals, cover letters, and professional profiles are displayed to the hiring Corporate Client when a bid is submitted.
• Law Enforcement & Regulators: When strictly mandated by a valid court order, search warrant, or regulatory directive issued by the NDPC, EFCC, NUPRC, or Nigerian Police Force.

7. Cross-Border Data Transfers

Where your data is processed using cloud infrastructure located outside Nigeria (such as Supabase, Google Cloud, or Netlify CDN edge nodes), Collekt ensures full compliance with Sections 41–43 of the NDPA 2023 through standard contractual clauses and encryption standards ensuring an adequate level of data protection.

8. Security & Encryption Standards

Collekt implements defense-in-depth technical and operational safeguards:

• Transport Layer Security (TLS 1.3 / HTTPS) with forced HSTS encryption across all web traffic.
• AES-256 encryption for documents and media stored in Supabase cloud buckets.
• PostgreSQL Row-Level Security (RLS) enforcing strict multi-tenant isolation so users can only access their authorized chats, wallet ledgers, and proposals.
• 72-Hour Breach Notification: In the unlikely event of a security incident affecting your rights, Collekt will notify the NDPC and affected Data Subjects within seventy-two (72) hours as mandated by the NDPA.

9. Data Retention & Disposal

Personal data is retained for the duration of your active account. Financial transaction records and tax audit trails are retained for six (6) years in accordance with Nigerian commercial tax and accounting standards. Upon verified account closure, personal identification documents are securely purged or anonymized.

10. Your Statutory Rights Under NDPA 2023

As a Data Subject, you hold enforceable rights under Nigerian law:

• Right of Access: Request a digital copy of all personal data held about you.
• Right to Rectification: Update inaccurate or outdated profile information at any time via your Profile page.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your account and personal records, subject to ongoing legal/escrow dispute holds.
• Right to Restrict Processing: Request temporary restriction of data processing while a dispute is being investigated.
• Right to Data Portability: Receive your profile data in a structured, machine-readable format.
• Right to Lodge a Complaint: Lodge a formal grievance with the Nigeria Data Protection Commission (NDPC) at https://ndpc.gov.ng if you believe your privacy rights have been violated.

11. Cookies & Local Storage

Collekt uses necessary session cookies and local storage to keep you securely signed in, preserve your dark/light theme preference, and manage active messaging threads. You can manage cookie preferences in your browser settings at any time.

12. Data Protection Officer (DPO) Contact

To exercise your privacy rights or request data deletion, contact our Data Protection Officer: