1. Who this notice applies to
It applies to business owners who request a pilot, company users created in AfiaLedger, authorized staff using the Android app, and people whose information is entered into company operational records. During a company pilot, AfiaLedger operates the platform while the participating company determines much of the staff and business information entered into it.
2. Information we process
- Names, work email addresses, phone numbers, roles, staff codes, branch assignments, and account status.
- Business identity, locations, suppliers, catalogue information, and operational settings.
- Procurement, stock, production, sales, collection, expense, wastage, approval, and audit records entered by authorized users.
- Evidence files such as receipts or operational documents uploaded by users.
- Security and technical data such as session records, trusted-device identifiers, IP address, user agent, timestamps, and failed sign-in information.
- Website pilot enquiries, including owner name, business name, number of locations, phone number, and email address.
3. Why we use this information
We use personal data to provide and secure company accounts, operate requested workflows, maintain auditability, prevent duplicate or unauthorized activity, provide pilot support, respond to enquiries, investigate incidents, and comply with applicable legal obligations. We do not sell personal information.
4. Lawful basis
Depending on the relationship and activity, processing may be necessary to take steps requested before a pilot, perform the pilot arrangement, pursue legitimate interests in securing and operating the service, comply with legal obligations, or act on consent where consent is the appropriate basis.
5. Service providers and access
Authorized AfiaLedger personnel and the participating company’s authorized users may access information according to their roles. AfiaLedger also uses infrastructure, hosting, security, and transactional-email providers to operate the service. Providers receive only the access reasonably required for their function and may process information outside Nigeria subject to the safeguards required for the service.
6. Retention
Information is retained for the active pilot and for a reasonable period needed to support account closure, security, dispute handling, audit requirements, or legal obligations. Retention requirements differ by record type. AfiaLedger will refine and publish a formal retention schedule before general commercial availability.
7. Security
Current controls include HTTPS transport, hashed passwords and staff PINs, tenant and role checks, trusted-device controls, revocable sessions, server-generated timestamps, and audit history. No internet service can guarantee absolute security. See the security page for the current control scope.
8. Your rights
Subject to applicable law, you may ask to be informed about processing, access your personal data, correct inaccurate information, object to or restrict certain processing, request deletion where applicable, request portability, withdraw consent where processing relies on consent, and raise a complaint. Some requests may be limited where retention or processing is legally required or protects the rights of others.
9. Requests and complaints
During the pilot, submit a privacy request through the AfiaLedger representative who onboarded your company. AfiaLedger may request enough information to verify identity and authority before acting. You may also complain to the Nigeria Data Protection Commission through its official channels at ndpc.gov.ng.
10. Changes
This notice may change as the pilot, service providers, and legal obligations develop. The effective date above will be updated when material changes are published.