NDPR & NDPA Compliance
Official Data Protection Framework for PAICEY LTD (RC: 9724436) • Governed by the Nigeria Data Protection Act 2023
Contents & Quick Jump
1. Regulatory Framework & Supervisory Authority
PAICEY LTD. (Registration Number: RC: 9724436; incorporated under the Companies and Allied Matters Act of the Federal Republic of Nigeria) is committed to upholding the constitutional right to privacy guaranteed under Section 37 of the 1999 Constitution of the Federal Republic of Nigeria (as amended).
Our data processing operations strictly comply with:
- The Nigeria Data Protection Act 2023 (NDPA) signed into law by the President of the Federal Republic of Nigeria on June 12, 2023.
- The Nigeria Data Protection Regulation 2019 (NDPR) and all General Regulatory Directives and Guidelines issued by the Nigeria Data Protection Commission (NDPC).
- Regulatory directives issued by the Central Bank of Nigeria (CBN) and financial consumer privacy regulations applicable to payment processing partnerships with Hydrogen Pay and Squad by HabariPay (GTCO).
2. Core Principles of Data Protection Under NDPA (Section 24)
In pursuant to Section 24 of the NDPA 2023, all personal data collected and processed by PAICEY is governed by the following strict statutory principles:
Processed without coercion, deception, or covert tracking, accompanied by clear, accessible notices.
Collected exclusively for 4-pillar QOL modeling, 2x daily check-ins, subscription management, and kinetic insights.
We store only adequate and relevant metrics. We never collect or store plaintext passwords, complete card numbers, or card CVVs.
Check-in evaluations, step syncs, and subscription periods are updated in real-time with cluster IPC verification.
Data is retained only as long as accounts remain active, followed by 30-day permanent deletion or irreversible de-identification.
Protected by AES-256-GCM encryption, TLS 1.3 in-transit security, and WorkOS SOC 2 Type II authentication.
3. Lawful Bases for Processing (NDPA Section 25)
Every processing activity conducted by PAICEY rests on one of the recognized lawful bases under Section 25 of the NDPA:
- Consent (Section 25(1)(a)): You have given clear, specific, informed, and unambiguous consent to complete 2x daily check-ins, record physical movement, and receive personalized behavioral nudges. Consent may be revoked at any time.
- Contractual Performance (Section 25(1)(b)): Processing is necessary to perform our contract with You—to provision account access, deliver rolling 7-day and 30-day forecast curves, and manage billing via Hydrogen Pay, Squad by HabariPay (GTCO), or Creem.io.
- Legal Obligation (Section 25(1)(c)): Maintaining transaction history, VAT receipts, and audit trails required under Nigerian tax and financial laws.
- Legitimate Interests (Section 25(1)(d)): Ensuring platform cybersecurity, mitigating fraudulent transactions, invalidating distributed edge caches across cluster nodes, and preventing unauthorized scraping.
4. Your Statutory Rights as a Data Subject (NDPA Part VI)
Under Part VI (Sections 34–38) of the Nigeria Data Protection Act 2023, You enjoy the following enforceable rights:
You have the right to be informed of the identity of the Data Controller, the purpose of collection, recipients of data, and the existence of automated nudges before your data is gathered.
You may submit a Data Subject Access Request (DSAR) to receive a full confirmation and export of all personal data held about You by PAICEY, provided free of charge within 30 days.
You have the right to promptly modify, update, or correct incomplete, inaccurate, or outdated profile and questionnaire records.
You may request the permanent deletion of your account, check-in history, and stored biometric metadata where processing is no longer required or consent is withdrawn.
You have the right to receive your check-in ratings, step metrics, and QOL scores in a structured, commonly used, and machine-readable format (JSON/CSV) to transmit to another service provider.
You may object at any time to the processing of personal data for direct marketing, behavioral profiling, or research purposes.
You have the right not to be subjected to decisions based solely on automated processing. PAICEY's AI nudges and predictive curves are informational only and do not produce legal or clinical binding effects.
If You believe that PAICEY has violated your data privacy rights, You have the statutory right to file a complaint directly with the Nigeria Data Protection Commission (NDPC) via their official portal at ndpc.gov.ng.
5. Processing of Sensitive & Health-Related Personal Data (Section 30)
Under Section 30 of the NDPA 2023, data concerning health, physical capabilities, and biometric identifiers constitutes Sensitive Personal Data.
PAICEY strictly complies with Section 30 by ensuring that:
- Special category health ratings (sleep habits, perceived physical strain, focus scores) are captured only with explicit, affirmative consent.
- Biometric authentication (Touch ID, Face ID, FIDO2 WebAuthn Passkeys) is processed locally on your device hardware; PAICEY stores only cryptographic signature verification tokens, never raw biometric templates.
- Health data is never commingled with third-party advertising identifiers, marketing lists, or insurance aggregators.
6. Cross-Border Data Transfers & Third-Party Sub-Processors (NDPA Sections 41–43 & GAID)
Statutory notice regarding international cloud compute infrastructure, Cross-Border Data Transfer Instruments (CBDTI), and vetting mechanisms under the Nigeria Data Protection Act 2023 and the NDPC General Application and Implementation Directive (GAID).
6.1. Cross-Border Processing Notice
Because PAICEY operates resilient, globally distributed cloud infrastructure to ensure zero downtime, high-availability biometric authentication, and fault-tolerant telemetry sync, your personal data may be transferred to, stored, and processed on secure servers located outside the Federal Republic of Nigeria (specifically within member states of the European Union and the United States).
6.2. Legal Safeguards & Lawful Transfer Mechanisms
In strict compliance with Sections 41, 42, and 43 of the NDPA and the NDPC General Application and Implementation Directive (GAID), international transfers are executed exclusively through the following recognized legal gateways:
- Appropriate Safeguards & CBDTI (Section 42): The international recipient is bound by an enforceable Cross-Border Data Transfer Instrument (CBDTI) approved or recognized under the NDPA, including Data Processing Addenda (DPAs) incorporating Standard Contractual Clauses (SCCs) providing data protection safeguards equivalent to Nigerian law.
- Contractual Necessity (Section 43(1)(b)): The cross-border transfer is strictly necessary for the execution and performance of our contract with you (provisioning authenticated accounts, delivering kinetic analytics, and processing subscription renewals) or to execute features requested by you.
- Adequacy Determination (Section 41): Personal data is hosted in jurisdictions recognized by the Nigeria Data Protection Commission (NDPC) as providing adequate levels of data protection (including member states of the European Union governed by the EU GDPR).
6.3. Authorized Sub-Processors & Transfer Footprint
We engage vetted third-party service providers (sub-processors) to deliver specific software functions. The table below outlines our primary international sub-processors, their functional roles, processing jurisdictions, and governing transfer instruments:
| Sub-Processor | Role / Function | Processing Jurisdiction | Primary Transfer Safeguard |
|---|---|---|---|
| WorkOS, Inc. | User authentication, Single Sign-On (SSO), and identity verification | United States | Data Processing Addendum (DPA) with Standard Contractual Clauses (SCCs); tokenized encryption |
| Google Cloud Platform (GCP) | Core backend compute, private database hosting (ScyllaDB), and internal microservices | European Union (europe-west4 Netherlands, europe-west1 Belgium) / US | Google Cloud Data Processing Addendum (CDPA) with Model Contract Clauses; AES-256 disk encryption at rest; private VPC peering with zero public IPs |
| Scaleway S.A.S. (Iliad Group) | S3 Object Storage (replacing legacy Bunny Edge Storage), encrypted subscription/card/payment/consent document backups, distributed cluster sync locks, and durable webhook failover queues | European Union (nl-ams Amsterdam, Netherlands / Paris, France) | EU GDPR Data Processing Agreement (DPA) & NDPA Section 41 Adequacy; AWS SigV4 (HMAC-SHA256) cryptographic signing & AES-256 server-side encryption at rest |
| Bunny.net (BunnyWay d.o.o.) | Content Delivery Network (CDN), Magic Containers edge compute, DNS routing, and distributed libSQL edge database | European Union (Frankfurt primary) / Global Edge Nodes | GDPR-aligned Data Processing Agreement (DPA) with standard contractual safeguards |
| Creem.io | Payment processing and Merchant of Record for international (non-Nigerian) transactions | European Union / United Kingdom / United States | Merchant Data Processing Addendum and Level 1 PCI-DSS compliant tokenization |
| Zoho Corporation | Transactional email delivery, security notices, and communication notifications | United States / European Union | Zoho Data Processing Addendum (DPA) incorporating Standard Contractual Clauses (SCCs) |
*Note on Domestic Transactions: Payment transactions originating within Nigeria (via Hydrogen Pay / Access Bank Group and Squad by HabariPay / GTCO) are processed domestically on licensed Nigerian financial rails in full compliance with Central Bank of Nigeria (CBN) regulatory guidelines.
6.4. Infrastructure Architecture & Cryptographic Isolation
PAICEY operates a hardened cloud infrastructure. Our core backend database cluster (ScyllaDB), Go microservices, and S3 Object Storage are hosted inside dedicated European Union environments across Google Cloud Platform (GCP) (europe-west4 Eemshaven, Netherlands and europe-west1 St. Ghislain, Belgium) and Scaleway S.A.S. (nl-ams Amsterdam, Netherlands):
- Dual-Project Isolation & Private VPC Peering: Public edge ingress and core database assets are separated across two distinct Google Cloud projects (an isolated DMZ project and a protected Core project) connected solely through non-routable private Google Cloud VPC Network Peering.
- Zero-Knowledge Layer 4 (L4) TLS Passthrough: Edge HAProxy nodes in the DMZ forward raw encrypted TLS byte streams over VPC Peering directly to the Core tier without terminating TLS at the edge. The edge proxy cannot inspect, decrypt, or log personal health ratings or check-in payloads.
- Synchronized L4 Threat Mitigation & Kill-Switch: Edge and core proxies maintain a synchronized multi-master threat tracking cluster across private VPC Peering, enforcing volumetric rate limits and executing instant L4 connection rejections for malicious actors.
- Zero Public IP Address Exposure: The database virtual machine instances and Go backend servers operate in an isolated private VPC subnet with no public IPv4 or IPv6 addresses. They cannot be targeted or accessed directly from the public internet.
- Google Cloud Router & Cloud NAT: All outbound connections (such as operating system security updates and repository patches) are routed strictly through Google Cloud Router with Cloud NAT, preventing external parties from initiating inbound connections to the database.
- Cryptographic Safeguards & Scaleway S3 Persistence: Google-managed AES-256 data-at-rest encryption across all persistent volumes, AWS Signature Version 4 (
HMAC-SHA256) authenticated Scaleway S3 Object Storage in Amsterdam (nl-ams) for encrypted subscription backups and webhook failover queues, dedicated inter-region private fiber with MACsec encryption, and TLS 1.3 transport tunnels for all client connections.
Under the NDPA, data subjects have the right to request information regarding the specific safeguards maintained for cross-border transfers or to obtain a summary of relevant transfer instruments. Inquiries should be directed to our Data Protection Officer at dpo@paicey.com or privacy@paicey.com.
7. Technical Security Controls & 72-Hour Breach Notification (Section 40)
Pursuant to Section 40 of the NDPA 2023, PAICEY enforces multi-layered technical and organizational controls to protect personal and biometric data:
- Defense-in-Depth Network Segmentation: Multi-project isolation separating the DMZ tier from the Core VPC via Google Cloud VPC Peering, ensuring database hosts have zero public IP addresses and zero external ingress.
- Bastionless Administrative Access: SSH management is firewalled exclusively through Google Cloud's Identity-Aware Proxy (IAP), requiring multi-factor authenticated IAM identity validation with zero public port listeners.
- Volumetric Attack Defenses: Real-time HAProxy stick-table state replication across private VPC peering with automated L4 TCP handshake rejection.
- Data Encryption & EU Object Storage: AES-256 at-rest disk encryption on Google Cloud persistent disks and Scaleway S3 Object Storage (
nl-ams), AWS SigV4 request signing, AES-256-GCM session tokens, and TLS 1.3 cryptographic transport. - Identity & Authentication: WorkOS SOC 2 Type II certified passwordless authentication (FIDO2 Passkeys, WebAuthn, Email Magic Codes) with zero plaintext passwords.
In the unlikely event of a personal data breach that is likely to result in a risk to your rights and freedoms, PAICEY shall notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of the breach, in accordance with Section 40(2) of the NDPA.
If the breach poses a high risk to affected individuals, PAICEY will immediately communicate the breach directly to affected users with plain-language recommendations to mitigate potential adverse effects.
8. Human Kinetics Research & De-identification Standards
The scientific algorithms powering PAICEY were born from empirical Human Kinetics undergraduate research at the University of Lagos (UNILAG) led by Laura Bolade (CEO) titled: “Enhancing Physical Activity and Quality of Life Among University of Lagos Undergraduates Through Digital Fitness Nudges via the PAICEY App” and software architecture by Onakunle Oladipo.
Under Section 30(2) of the NDPA, historical health trends and kinetic datasets may be analyzed for scientific and statistical advancement exclusively in irreversibly anonymized, aggregated formats. Personal identifiers, names, emails, and device IDs are permanently stripped prior to mathematical modeling, ensuring that no individual user can ever be re-identified.
9. Data Protection Officer (DPO) & Request Filing
In compliance with Section 32 of the NDPA 2023, PAICEY has designated an official Data Protection Officer (DPO) responsible for regulatory adherence, annual NDPC audit reporting, and handling user privacy requests:
All Data Subject Access Requests (DSARs), correction requests, or erasure demands will be acknowledged within 48 hours and resolved within 30 calendar days as mandated by Nigerian law.