Privacy Policy & Data Protection Notice

Effective Date: September 10, 2026 • Supervising Authority: Nigeria Data Protection Commission (NDPC) • Version: 2026.2 (Pilot Ready)

STATUTORY COMMITMENT TO DATA PRIVACY:
Collekt Technologies Ltd ("Collekt", "we", "our") is dedicated to protecting the privacy, confidentiality, and fundamental rights of all Data Subjects in compliance with the Nigeria Data Protection Act (NDPA) 2023 and international data protection standards. This policy governs how we collect, process, store, and safeguard your personal and corporate information.

Privacy Table of Contents

1. Scope & Data Controller 2. Lawful Bases of Processing 3. Categories of Data Collected 4. Sensitive KYC Verification Data 5. Kolly AI & Algorithmic Processing 6. Data Sharing & Sub-Processors 7. Cross-Border Data Transfers 8. Security & Encryption 9. Data Retention & Disposal Schedule 10. Your Statutory Rights (NDPA) 11. Cookies & Tracking 12. Data Protection Officer (DPO) Contact

1. Scope & Data Controller

This Privacy Policy applies to all users visiting or registered on Collekt (https://collektng.com). The designated Data Controller responsible for your personal data is:

Collekt Technologies Ltd
Data Protection Office
Email: collektng@gmail.com

2. Lawful Bases of Processing

Pursuant to Section 25 of the NDPA 2023, Collekt processes your personal information strictly under the following lawful bases:

Consent: Explicit, informed consent provided during sign-up, document submission, or newsletter subscription.
Contractual Necessity: Processing required to establish escrow accounts, process milestone payments, facilitate tender bids, and fulfill contract awards.
Legal Obligation: Compliance with Nigerian corporate and financial laws (CAMA 2020, FIRS tax compliance, EFCC anti-money laundering regulations).
Legitimate Interests: Protecting marketplace security, preventing fraud, and optimizing AI matching algorithms without infringing upon your fundamental rights.

3. Categories of Data Collected, Purposes & Lawful Bases

We collect and process personal and corporate data strictly where permitted under Section 25 of the Nigeria Data Protection Act (NDPA) 2023. The table below details what we collect, why, and our statutory basis:

Data Category	Specific Data Elements	Processing Purpose ("Why")	NDPA Lawful Basis
Individual Identity Data	Full legal name, professional title, profile photograph, username, national origin, state of residence.	To create, authenticate, and maintain your professional marketplace profile and facilitate client engagements.	Consent • Contractual Necessity
Corporate & Enterprise Data	Registered corporate name, CAC RC/BN number, registered office address, director names, FIRS corporate TIN.	To verify corporate legal standing, facilitate enterprise tender postings, and comply with CAMA 2020.	Legal Obligation • Contractual Necessity
Sensitive KYC Data	National Identification Number (NIN), scanned government ID, director biometric records, CAC status reports.	To establish "Shield Verification", prevent fraud/impersonation, and comply with CBN AML/CFT 2022 standards.	Explicit Affirmative Consent (Sec 25)
Professional & Licensure Data	COREN license number, engineering discipline, university degrees, industry certifications (BOSIET, NDT, HSE, PMP), CV/portfolio.	To ensure regulatory compliance with Engineers (Registration) Act 2018 and NOGICD Act 2010 for energy tenders.	Contractual Necessity • Legitimate Interests
Financial & Escrow Data	Dedicated virtual NUBAN accounts (Paystack/Korapay), settlement commercial bank account numbers, payout ledgers, FIRS WHT/VAT tax credit notes.	To power milestone escrow custody, process instant bank transfers, and remit 5% WHT / 7.5% VAT tax filings.	Contractual Necessity • Legal Tax Obligation
Communications & Project Data	In-app messages, milestone deliverables, project scopes, CAD drawings, inspection sign-offs, tender bid proposals.	To facilitate project collaboration, maintain immutable audit evidence under Evidence Act 2011, and arbitrate disputes.	Contractual Necessity • Legitimate Interests
Technical Telemetry Data	IP address, device fingerprints, browser version, session timestamps, audit security event logs.	To detect brute-force attacks, enforce session inactivity timeouts (15 min), and prevent clickjacking.	Legitimate Interests • Cybersecurity Compliance

4. Sensitive KYC Verification Data & Regulatory Checks

To establish the Shield Verification status, Users may voluntarily submit high-integrity identity documents:

National Identification Number (NIN): Used exclusively to authenticate individual identity against NIMC standards. Raw NINs are tokenized and never exposed in public profile views or client search APIs.
CAC Incorporation Documents: Used to confirm corporate legal existence and operational status with the Corporate Affairs Commission portal.
Third-Party Verification Consent: By uploading these credentials, you grant Collekt Technologies Ltd and its certified verification infrastructure providers express permission to query the respective statutory databases. These documents are encrypted via AES-256 and accessible only to authorized compliance officers.

5. Kolly AI & Algorithmic Processing

Candidate Compatibility Matching: When Kolly AI evaluates candidate profiles for posted tenders, it analyzes skill tags, discipline alignment, years of experience, and verification badges to calculate match scores.
No Automated Exclusion: AI match recommendations never prevent candidates from submitting bids. All verified candidates retain the right to apply for any open opportunity on the Marketplace.
Confidentiality of IP: Client project drafts and professional bids processed by Kolly AI are never sold to external data brokers or used to train public open-source models without authorization.

6. Data Sharing, Sub-Processors & Statutory Disclosures

Collekt does not sell, rent, or trade your personal data. We share data strictly with the following categories of service providers, financial institutions, and regulatory bodies under formal Data Processing Agreements:

Recipient / Sub-Processor	Role & Data Shared	Safeguards & Standards
Supabase Inc. (Database & Cloud Storage)	Encrypted user profiles, authentication hashes, uploaded documents, milestone records, and transaction ledgers.	AES-256 encryption at rest, TLS 1.3 in transit, strict PostgreSQL Row-Level Security (RLS) tenant isolation.
Paystack Payments Limited & Korapay Technologies Ltd	User name, email, dedicated virtual NUBAN records, wallet funding references, and bank withdrawal routing.	CBN-licensed Payment Solution Service Providers (PSSP), PCI-DSS Level 1 certified, HMAC-SHA512 webhook security.
Settlement Partner Banks (Wema Bank, Sterling Bank, Nova Bank)	NUBAN account numbers, account holder legal name, instant NIBSS settlement payment hashes.	Licensed commercial banks supervised by the Central Bank of Nigeria (CBN); mandatory AML/CFT name-matching.
Identity Verification Partners (NIMC, CAC, NIBSS, COREN)	NIN verification tokens, CAC RC numbers, biometric face checks, engineering registration numbers.	Statutory query gateways; strict tokenization; zero retention of raw biometric templates.
Google Cloud / Gemini AI	Anonymized profile skill parameters, public tender specifications, cost estimation queries.	Zero-data-retention enterprise API endpoints; user IP and confidential CAD schematics are never trained on.
Netlify Inc. (Edge CDN & Serverless)	Web page delivery, serverless API execution, client IP for rate limiting and bot mitigation.	Global edge caching, TLS 1.3 termination, ISO 27001 certified data center infrastructure.
Statutory Regulators & Law Enforcement (NDPC, EFCC, NFIU, FIRS, Police)	Identity records, transaction ledgers, tax invoices, electronic evidence.	Disclosed strictly upon receipt of valid judicial subpoenas, court orders, or formal statutory compliance directives.

7. Cross-Border Data Transfers

Where your data is processed using cloud infrastructure located outside Nigeria (such as Supabase, Google Cloud, or Netlify CDN edge nodes), Collekt ensures full compliance with Sections 41–43 of the NDPA 2023 through standard contractual clauses and encryption standards ensuring an adequate level of data protection.

8. Security & Encryption Standards

Collekt implements defense-in-depth technical and operational safeguards:

Transport Layer Security (TLS 1.3 / HTTPS) with forced HSTS encryption across all web traffic.
AES-256 encryption for documents and media stored in Supabase cloud buckets.
PostgreSQL Row-Level Security (RLS) enforcing strict multi-tenant isolation so users can only access their authorized chats, wallet ledgers, and proposals.
72-Hour Breach Notification: In the unlikely event of a security incident affecting your rights, Collekt will notify the NDPC and affected Data Subjects within seventy-two (72) hours as mandated by the NDPA.

9. Data Retention & Disposal Schedule

Pursuant to Section 24(1)(d) of the NDPA 2023, personal data is retained strictly for the duration necessary to fulfill the statutory, contractual, and regulatory objectives for which it was collected. Our formal data retention schedule is outlined below:

Data Classification	Retention Period	Disposal / Purge Protocol
Identity & KYC Verification Documents (NIN, Passports, CAC certificates)	Raw document uploads are purged 30 days following verification approval. Verification audit status, hash, and metadata retained for 6 years post-account closure.	Cryptographic erasure (crypto-shredding) of cloud storage files; cascade purge of database references.
Financial, Escrow & Invoicing Records (NUBAN payouts, tax invoices, WHT/VAT notes)	6 years from the date of milestone settlement, in accordance with the Companies Income Tax Act (CITA) and Money Laundering (Prevention and Prohibition) Act 2022.	PostgreSQL ledger archiving to cold encrypted storage; hard-coded immutable WORM retention.
Tenders, Project Proposals & Deliverables (CAD drawings, technical briefs, messages)	Active duration of contract + 3 years following completion to support warranty claims, arbitration, and tax audits.	Automatic removal from active CDN buckets; encrypted archive in cold storage or user-requested deletion.
Active User Profile & Account Data	Duration of active account relationship. Accounts dormant for 24 consecutive months receive warning notices prior to deletion.	Full anonymization or permanent database deletion upon user request via NDPA Sec 34 self-service portal.
Security Audit Logs & Telemetry	7 years pursuant to ISACA ITAF 5th Edition and CBN Cybersecurity Framework requirements.	Write-Once-Read-Many (WORM) audit ledger purge upon statutory expiration.

10. Your Statutory Rights Under NDPA 2023

As a Data Subject, you hold enforceable rights under Nigerian law:

Right of Access: Request a digital copy of all personal data held about you.
Right to Rectification: Update inaccurate or outdated profile information at any time via your Profile page.
Right to Erasure ("Right to be Forgotten"): Request deletion of your account and personal records, subject to ongoing legal/escrow dispute holds.
Right to Restrict Processing: Request temporary restriction of data processing while a dispute is being investigated.
Right to Data Portability: Receive your profile data in a structured, machine-readable format.
Right to Lodge a Complaint: Lodge a formal grievance with the Nigeria Data Protection Commission (NDPC) at https://ndpc.gov.ng if you believe your privacy rights have been violated.

Manage Privacy & Profile Data Download Account Data (NDPA Sec 33) Request Account Erasure (NDPA Sec 34)

STATUTORY CBN & FCCPA NOTICE:
Collekt Technologies Ltd is an independent software technology marketplace facilitator, not a commercial deposit-taking bank. Escrow clearing and payout transactions are performed via CBN-licensed payment partners. Consumer dispute resolutions comply strictly with Sections 114–116 of the Federal Competition and Consumer Protection Act (FCCPA 2018) with a 14-day turnaround time.

11. Cookies & Local Storage

Collekt uses strictly essential session cookies and local storage to keep you securely signed in, preserve your dark/light theme preference, and manage active messaging threads. You can manage or reject non-essential cookies at any time under the Nigeria Data Protection Act (NDPA 2023).

12. Data Protection Officer (DPO) Contact

To exercise your privacy rights, lodge an inquiry, or request data deletion, contact our Data Protection Officer:

Data Protection Officer (DPO)
Collekt Technologies Ltd
Official Emails: compliance@collektng.com (Regulatory & Legal) • dpo@collektng.com (Data Protection Officer) • kolly@collektng.com (Platform Concierge)
Supervising Authority: Nigeria Data Protection Commission (NDPC) • https://ndpc.gov.ng