1Who We Are
Remitpro Ltd (“Remitpro”, “we”, “us”, “our”) is a data controller registered in Nigeria under CAMA 2020. We operate the IdentityFlow Nigeria Digital Identity Platform, a technology prototype developed for the Bureau of Public Enterprises (BPE) that enables Nigerian citizens and corporate entities to verify their identity with Nigerian government agencies via secure NIN and BVN-backed authentication.
Company Name
Remitpro Ltd
Registered Address
Suite 26, Jam Nab Plaza, Ladoke Akintola Blvd, Garki 2, Abuja, FCT
Data Protection Officer
info@remitpro.io
General Enquiries
info@remitpro.com.ng
Website
www.remitpro.com.ng
NIMC API Licence
NIMC/API/2026/00XX (Pending)
2What Personal Data We Collect
We collect only the data necessary to provide identity verification services (NDPR data minimisation principle). Here is a full breakdown:
Identity Data
- National Identification Number (NIN) — 11-digit NIMC-issued number
- Bank Verification Number (BVN) — 11-digit NIBSS-issued number (stored as a one-way hash)
- Full legal name as on NIMC record
- Date of birth and gender
- State of origin and Local Government Area (LGA)
- Registered phone number (for OTP verification)
- CAC registration number (corporate entities)
- Tax Identification Number / TIN (corporate entities)
Biometric Data
- Liveness detection result (pass/fail) — NOT the biometric image itself
- Device-based fingerprint verification result (pass/fail)
- Facial comparison score (deleted immediately after processing)
- Note: IdentityFlow does not store biometric templates. Only outcomes are retained for audit purposes.
Agency Access Data
- List of government agencies you have authorised
- Specific data fields authorised per agency
- Timestamps of each consent grant and revocation
- Agency access logs (which agencies accessed data, when, and for what stated purpose)
Device & Usage Data
- IP address and device type (for fraud detection only)
- Session tokens (rotated every 15 minutes)
- Pages visited within IdentityFlow (anonymised analytics)
- Error logs and failed verification attempt records (for system improvement)
3How We Use Your Data
Identity Verification
Your NIN and BVN are used to confirm your identity against NIMC and NIBSS databases. This is the core purpose of IdentityFlow.
Agency Data Sharing
With your explicit consent, specific identity attributes are transmitted to authorised government agencies (BPE, FIRS, PENCOM, CAC, BPP) via secure API channels.
Virtual NIN Generation
Your NIN is used to generate a tokenized 16-character vNIN per NIMC specification. Your permanent NIN is never exposed to third parties through this mechanism.
Fraud Prevention & Security
Anonymised device signals and usage patterns are analysed to detect and prevent identity fraud, account takeover, and system abuse.
Audit Trail
A tamper-evident log of all data access events is maintained as required by the NIMC Act 2007 and NDPR transparency principles. You can view this log in your Privacy Dashboard.
Service Improvement
Anonymised, aggregated analytics help us improve the Platform. No personal data is used for this purpose.
4Who We Share Your Data With
We never sell, rent, or trade your personal data. Data is shared only as described below, strictly for the stated purpose, and under contractual data protection obligations.
NIMC (National Identity Management Commission)
To verify your NIN against the National Identity Database. Required for core identity verification.
Basis: Consent + NIMC Act 2007NIBSS (Nigeria Inter-Bank Settlement System)
To verify and link your BVN for financial identity confirmation.
Basis: Consent + CBN GuidelinesBPE, FIRS, PENCOM, CAC, BPP
Only the specific data fields you explicitly authorise in the Agency Access Panel. You control exactly what each agency receives.
Basis: Your explicit consent (NDPR Art. 2.2(a))Cloud Infrastructure (Google Cloud, af-south1)
Encrypted data storage and processing. Data remains within Africa at all times to comply with NDPR data residency.
Basis: Legitimate Interest + Data Processing AgreementSecurity & Fraud Prevention Services
Anonymised or aggregated device signals only. No identity data is shared with fraud prevention providers.
Basis: Legitimate InterestLaw Enforcement / Regulatory Bodies
Only when required by a valid court order or Nigerian law. You will be notified where legally possible.
Basis: Legal Obligation5How Long We Keep Your Data
NIN hash & BVN hash
Statutory audit trail — NIMC Act 2007
Virtual NIN (vNIN)
NIMC technical specification
Agency access logs
FIRS & NIMC statutory records obligations
Biometric outcomes
Data minimisation — NDPR Art. 2.1(1)(c)
Account closure
NDPR right to erasure, subject to audit trail retention
6Your Rights Under NDPR 2019
You can exercise any of the following rights by contacting info@remitpro.io or using the controls in your Privacy Dashboard. We will respond within 30 days.
Access
Request a copy of all personal data we hold about you
Rectification
Request correction of inaccurate or incomplete data
Erasure
Request deletion of your data (subject to statutory retention periods)
Restriction
Request we suspend processing while accuracy is contested
Portability
Receive your data in a structured, machine-readable format
Object
Object to processing for specific purposes
Withdraw Consent
Revoke agency data-sharing access at any time from your dashboard
Lodge Complaint
File a complaint with the NDPC at info@ndpc.gov.ng
7Cookies & Local Storage
IdentityFlow uses only strictly necessary cookies and browser local storage to maintain secure session state. We do not use advertising cookies, third-party tracking pixels, or fingerprinting technologies.
session_token
Maintains your authenticated session. HttpOnly, Secure, SameSite=Strict.
Expiry: 15 minutes (auto-renewed)
csrf_token
Protects against cross-site request forgery.
Expiry: Session
theme_pref
Stores your display preference (light/dark mode).
Expiry: 1 year
8Changes to This Policy
We may update this Privacy Policy periodically. Material changes will be notified to registered users via their verified contact details at least 14 days before the changes take effect. The "Effective" date at the top of this page will always reflect the latest version.
Continued use of IdentityFlow after the effective date of an updated Policy constitutes your acceptance of the changes.
Privacy Questions?
Our Data Protection Officer is available to answer any questions about this policy or how your data is handled.