Privacy Policy

1. Who we are and what this policy covers

S Identify Verification Technologies Ltd operates S Identify Africa at sidentifyafrica.com and the associated verification portal and APIs, including secureidverify.ng during the domain transition. This policy explains how we handle personal data about account holders, people whose identities are checked, business representatives and visitors. It applies to S Identify Africa rather than unrelated Jankado services.

We process data in accordance with the Nigeria Data Protection Act 2023 and other applicable requirements. We are responsible for processing undertaken for our own account administration, payments, security and compliance purposes. For customer-requested checks, our role depends on the workflow and any agreed data-processing arrangements. Organisations requesting checks have their own obligations and must provide their own notices where required.

2. Personal data we handle

Depending on the service, we may handle names, contact details, date of birth, gender, addresses, account identifiers, business registration information, NIN, BVN and information returned by authorised verification sources. Not every check requires every category.

Facial-verification workflows may involve selfies or live facial captures, comparison images, biometric data used for unique identification, match scores and verification outcomes. Document workflows may involve uploaded documents and the personal information they contain. Identity-and-consent workflows may include signatures, consent records and participant details.

We also handle service requests, transaction references, wallet and payment records, support communications, IP addresses, browser or device information, access logs and records needed to investigate misuse. Where alerts or institutional exceptions are used, records may include SMS delivery status, institutional requests, approvals and audit records.

3. Where data comes from

We receive data directly when you register, submit information, complete a facial capture, make a payment or contact support. We may also receive information from an organisation requesting a check, authorised verification sources, payment providers and technical logs generated when the service is used.

A person may be checked by a customer without holding a platform account. In that case, the requesting customer must establish its authority and lawful basis and provide any legally required notice or consent request.

4. Why we process data and our lawful bases

We use account and contact information to register users, administer access, respond to support requests and provide contracted services. Depending on the relationship and processing, the lawful basis may be performance of a contract, compliance with a legal obligation, consent or a legitimate interest supported by an appropriate assessment.

We use submitted identifiers, images and source records to perform the requested identity, facial, business or document check and return its result to the authorised requester. We determine the applicable lawful basis and, where sensitive personal data is involved, the additional legal condition required for that processing. Where consent is relied on, it must be informed and valid; acceptance of platform terms by a requester is not consent from another person.

We use payment and transaction records to reconcile funding, apply charges, investigate disputes and meet applicable recordkeeping obligations. We use security and audit records to control access, detect misuse, investigate complaints and protect the service. Legitimate interests do not override an individual’s rights where those interests are outweighed under applicable law.

Where enabled, we use an available identity-owner phone number to attempt a service-related SMS alert and record its delivery status. We may assess institutional notification exceptions and retain evidence of their approved scope. We do not treat an alert as authorisation for the underlying check.

5. Who receives data

We return relevant verification information to the authorised account holder or organisation requesting the check. That requester is responsible for its subsequent handling of results. We may disclose the information needed for a check to authorised identity and verification sources and specialist providers supporting the selected service.

Other recipients may include payment processors, currently including Paystack and Squadco where used, hosting and technical-support providers, and SMS delivery providers where notifications are enabled. Information is shared for the relevant service, security, reconciliation or compliance purpose, rather than to give every provider access to all records.

We may disclose information to regulators, law-enforcement bodies or courts where lawfully required, or where necessary and permitted to establish or defend legal claims. We do not sell or rent personal data. An affiliation with another company does not by itself authorise unrestricted sharing.

6. Facial data and automated results

Facial matching compares the submitted capture against the relevant reference for the selected verification workflow. Match outcomes can be affected by capture quality, reference accuracy and the comparison process. Customers should review results appropriately rather than treating a match score as a complete decision about a person.

If you believe an automated verification result is incorrect or materially affects you, contact us for an investigation of the platform result and contact the requesting organisation about its decision. Rights concerning qualifying automated decisions apply under applicable law. We will explain the relevant process when responding to a request.

7. Identity-owner alerts and exceptions

Where enabled, an additional alert may be attempted after a successful NIN or BVN check using an available identity-owner number. It excludes the NIN, BVN and verification result. A number may be missing, incorrect, reassigned or unreachable, and delivery can fail. Alerts may also be paused; absence of an alert does not establish whether a check occurred or was lawful.

Withholding or delaying an enabled alert for an institution requires written approval and a signed Institutional Notification Exception Addendum for a defined purpose, service, scope and period. We assess the supporting authority, lawful basis and required notice or consent, or documented exception, and keep appropriate audit records. We may suspend or revoke approval. Neither an exception nor an alert removes anyone’s data-protection rights.

8. Cookies and international transfers

The platform uses cookies or similar storage needed for sessions, sign-in and security. Browser settings can restrict cookies, but this may prevent account features from working. If optional analytics or other non-essential tracking is introduced, we will describe it and obtain consent where required.

Technical or verification providers may process data outside Nigeria, depending on the service and infrastructure used. Any international transfer must meet applicable Nigerian data-protection requirements, including an appropriate transfer basis and safeguards. Contact us for information about transfers relevant to your data.

9. Security and retention

We use appropriate technical and organisational measures to protect personal data, including controls on access and protection of data transmission. No system is entirely risk-free. Report suspected exposure or unauthorised access promptly. We will investigate and make required notifications where applicable law requires them.

We retain data only for as long as needed for the relevant service, account administration, payment reconciliation, security, complaints, legal claims or mandatory recordkeeping. The period varies by record type and legal requirements; this policy does not promise one retention period for every identifier, image or transaction.

Account closure does not automatically erase records that must lawfully be retained. When continued retention is no longer justified, data should be deleted or anonymised as appropriate. Contact us for retention information applicable to a particular service or record.

10. Your rights and how to exercise them

Subject to applicable law and its conditions, you may request access to your personal data, correction or completion, deletion, restriction of processing, data portability, and objection to relevant processing. You may withdraw consent where processing relies on consent; this does not invalidate earlier lawful processing. Some rights may be limited by legal obligations or another applicable lawful basis.

You do not need a platform account to raise a privacy request. Email [email protected] with a description of your concern and, if available, the relevant service or transaction reference. Do not send a full NIN, BVN, password or access token in your initial message. We may request proportionate information to verify your identity and locate the records securely.

If a customer organisation requested the check, we may need to coordinate with it or direct the part of your request concerning its own decision and records to that organisation. We remain responsible for responding to requests concerning processing for which we are responsible.

We will respond within applicable legal time limits and explain any lawful limitation. You may complain directly to the Nigeria Data Protection Commission at https://ndpc.gov.ng; contacting us first does not remove that right.

11. Children and policy updates

Platform account holders must be at least 18. Where a permitted service involves a child’s information, the requester must meet applicable requirements concerning authority, parental or guardian consent where required, and the child’s rights and interests.

We may update this policy as services or requirements change. We will revise the publication date and communicate material changes through appropriate channels. Where a change requires consent, we will seek it rather than treating continued use as consent on behalf of another person.

12. Contact

S Identify Verification Technologies Ltd, trading as S Identify Africa. Website: https://sidentifyafrica.com. Privacy requests and complaints: [email protected]. The existing support address remains in use during the domain transition.