Data Protection

Our position

We process personal data as a data controller under the Nigeria Data Protection Act 2023, and we require every processor acting for us to meet the same standard. Data protection is treated as an operating requirement of the service, not a document.

Lawful basis for each activity

We identify a lawful basis before a new processing activity begins.

• Consent — registration, marketing, and the recording of voice sessions.
• Contract — produce purchase, payment and product supply.
• Legal obligation — tax, financial reporting, food safety traceability and anti-money-laundering checks.
• Legitimate interest — fraud prevention and the security of our own systems.

Data minimisation

The USSD menu is deliberately short. Each step collects only the field that step needs, and no field is collected because it might be useful later. Where a partner asks for data we do not hold, we ask the partner to justify the request before we collect it.

Security controls

Access is granted by role and reviewed when a role changes.

• Personal data is encrypted in transit and at rest.
• Access to farmer records is limited to staff whose work requires it, and is logged.
• PINs are never visible to staff and cannot be retrieved, only reset by the account holder.
• Systems are backed up, and restoration is tested rather than assumed.

Field agents and devices

Field agents collect data on managed devices under a written confidentiality undertaking. Records sync to our systems and are not retained on the device. An agent who leaves loses access on the day of departure, and the farmers they registered stay in the network unaffected.

Processors and third parties

Every processor is engaged under a written agreement covering purpose limitation, security, breach notification, sub-processing and deletion at the end of the engagement. We keep a register of processors and review it annually.

Transfers outside Nigeria

Where a processor operates outside Nigeria, we transfer data only to a jurisdiction or arrangement that satisfies the transfer conditions of the Act, and we document that assessment before the transfer begins.

If something goes wrong

A suspected breach is contained, assessed and recorded within 24 hours of discovery. Where the breach is likely to result in a risk to the people affected, we notify the Nigeria Data Protection Commission within 72 hours and inform those affected in language they can understand, including by phone call where reading a notice is not realistic.

Requests from data subjects

Requests reach us by email, by hotline, or through any field agent. We verify who is asking before we act, answer within 30 days, and keep a record of the request and the outcome. There is no charge.

Accountability

A named data protection contact within the company owns this statement, reviews it at least once a year, and reports on data protection to the leadership of the business. Write to info@promisepointgtnl.com marked for the attention of the data protection contact.