Legal Basis for Processing
IdentityFlow processes personal data under the following legal bases as defined in the NDPR 2019:
- 1Consent (NDPR Art. 2.2(a)): Explicit, informed, and revocable consent is obtained before processing any identity attribute. Consent is granular — you choose which agencies see which fields.
- 2Statutory Obligation (NDPR Art. 2.2(c)): Where processing is required by Nigerian law (e.g., NIMC Act 2007, FIRS Act), we rely on this basis in addition to consent.
- 3Legitimate Interest (NDPR Art. 2.2(e)): Used only for security monitoring, fraud prevention, and system integrity — always balanced against the rights and freedoms of users.
The 7 NDPR Data Protection Principles
Lawfulness, Fairness & Transparency
We only process your identity data (NIN, BVN, biometrics) with your explicit, documented consent. You are informed in plain language of every purpose for which your data is used before any processing begins. No data is processed on a legal basis other than your consent or a statutory obligation.
Purpose Limitation
Your NIN is collected solely for identity verification for Nigerian government agency access (BPE, NIMC, FIRS, PENCOM, CAC). It will never be used for profiling, marketing, credit scoring, or any secondary purpose not disclosed at collection time.
Data Minimisation
We collect only the minimum data necessary for the stated verification purpose. Zero-Knowledge Proofs (ZKP) allow agencies to confirm an attribute (e.g., "NIN is valid") without receiving the underlying data. Agencies receive field-level access only as explicitly authorised by you.
Accuracy
Identity data is sourced directly from authoritative registries (NIMC database, NIBSS BVN database, CAC registry). You have the right to request correction of any inaccurate personal data held by us at any time by contacting info@remitpro.io.
Storage Limitation
Sensitive identity credentials (NIN, BVN hash) are retained only for as long as required to complete the verification process plus a mandatory 90-day audit trail period under NIMC Act 2007. Virtual NINs (vNINs) expire after 72 hours per NIMC specification.
Integrity & Confidentiality
All data is encrypted at rest (AES-256) and in transit (TLS 1.3). Access is restricted by role-based controls, audited continuously, and reviewed monthly. No plaintext NIN or BVN is ever written to logs.
Accountability
IdentityFlow maintains a registered Data Protection Officer (DPO) as required by NDPR Article 4.1(4). We are registered with the Nigeria Data Protection Commission (NDPC) and submit annual data protection audits conducted by a NDPC-licensed auditor.
Your Rights as a Data Subject
Under NDPR 2019, you have the following rights with respect to your personal data processed by Remitpro Ltd via IdentityFlow. To exercise any right, contact our DPO at info@remitpro.io or use the controls in your Privacy Dashboard.
Right of Access
You may request a full copy of all personal data held about you within 30 days of your request at no charge.
Right to Rectification
You may request correction of inaccurate or incomplete personal data. We will rectify or escalate to the relevant registry (NIMC/NIBSS) within 30 days.
Right to Erasure ("Right to be Forgotten")
You may request deletion of your IdentityFlow account and associated data, subject to statutory retention obligations under the NIMC Act 2007 and FIRS tax record requirements.
Right to Restrict Processing
You may request that we suspend processing of your data in certain circumstances — for example, while the accuracy of data is being contested.
Right to Data Portability
You may request your verified identity data in a structured, machine-readable format (JSON/XML) to transfer to another NDPR-compliant provider.
Right to Object
You may object to processing of your data for any purpose beyond your original consent. All agency data-sharing can be revoked immediately from your Privacy Dashboard.
Right to Withdraw Consent
You may withdraw consent for any or all agency data access at any time without penalty. Withdrawal does not affect the lawfulness of processing before withdrawal.
Cross-Border Data Transfers
Primary Data Residency: All Nigerian citizen identity data is stored within Africa (Google Cloud af-south1, Johannesburg) in compliance with NDPR Article 2.12 data localisation provisions.
Sub-processors: Where any sub-processor is outside Nigeria, we ensure they are located in a jurisdiction with equivalent data protection standards, or we apply Standard Contractual Clauses (SCCs) approved by the NDPC.
No Sale of Data: IdentityFlow does not and will never sell, rent, or commercially transfer Nigerian citizen identity data to any third party under any circumstances.
Contact Our Data Protection Officer
For any NDPR-related enquiries, data subject access requests, or complaints about how we handle your data:
Complaints may also be submitted to the Nigeria Data Protection Commission (NDPC): info@ndpc.gov.ng