Privacy Policy
1. Data we collect
| Category | Examples | Why |
|---|---|---|
| Account | Email, phone, hashed password, display name | Create and secure your account |
| KYC / Identity | Government ID photo, selfie, date of birth, address | Legal AML/KYC obligation |
| Financial | Bank account number & name, transaction history, wallet balance | Deposits, withdrawals, settlement |
| Technical | IP address, device fingerprint, user agent, cookies | Fraud prevention, session security |
| Support | Messages you send to support, chat transcripts | Resolve your enquiries |
2. Lawful bases (NDPR / GDPR alignment)
- Contract. Account, financial, and task data ◚¬— needed to deliver the service you signed up for.
- Legal obligation. KYC and AML records ◚¬— required by Nigerian law.
- Legitimate interest. Fraud prevention, platform security, and analytics in aggregate.
- Consent. Marketing emails and non-essential cookies, which you can withdraw at any time.
3. How long we keep data
| Category | Retention |
|---|---|
| Active account data | While your account is open, plus 90 days after closure |
| KYC & AML records | 5 years after account closure (CBN/AML rules) |
| Transaction records | 6 years (tax & accounting rules) |
| Technical / security logs | 12 months, then anonymised or deleted |
| Marketing preferences | Until you unsubscribe |
4. Who we share data with
- Payment processors (e.g. Paystack) ◚¬— to collect deposits and settle withdrawals.
- KYC verification partners ◚¬— to confirm identity documents are genuine.
- Email & SMS providers ◚¬— to deliver notifications and OTPs.
- Nigerian regulators & law enforcement ◚¬— where required by law or valid court order.
- We do not sell personal data. We do not share it for third-party advertising.
5. International transfers
Some service providers (e.g. cloud email, anti-fraud tooling) may process data outside Nigeria. Where that happens, we use providers in jurisdictions with adequate protection, or we rely on standard contractual clauses to ensure your data stays safe.
6. Your rights under the NDPR
- Access ◚¬— request a copy of the data we hold about you.
- Rectification ◚¬— correct inaccurate data.
- Erasure ◚¬— close your account and have personal data deleted, subject to legal retention.
- Restriction & objection ◚¬— pause certain processing, including marketing.
- Portability ◚¬— receive your data in a common machine-readable format.
- Complaint ◚¬— lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.
To exercise any right, write to our Data Protection Officer at privacy@efgaihub.com. We respond within 30 days.
7. Security
- Transport encrypted end-to-end with HTTPS (TLS 1.2+).
- Passwords hashed with bcrypt ◚¬— never stored in plain text.
- KYC documents stored encrypted at rest; access limited to compliance staff on a logged, need-to-know basis.
- Optional two-factor authentication and WebAuthn (fingerprint / Face ID) on every account.
- If we ever suffer a personal-data breach that is likely to risk your rights, we will notify the NDPC within 72 hours and affected users without undue delay.
8. Cookies
We use first-party cookies for session management and security. Non-essential cookies (analytics, chat widget) load only after you accept via the cookie banner. You can clear cookies from your browser at any time.
9. Children
The platform is not intended for anyone under 18. If we learn that we have collected data from a minor, we delete it promptly.
10. Changes to this policy
Material changes are posted here and announced by email at least 7 days before taking effect.
11. Contact
Data Controller: EFGAIHUB TECHNOLOGY AND SERVICES LIMITED
Registered address: No. 16 University Road, Nsukka, Enugu State, Nigeria
DPO: privacy@efgaihub.com
General support: support@efgaihub.com