Enterprise Data Protection Policy

DueSure Support Limited (“DueSure,” “we,” “our,” or “the Company”) operates a multi-tenant RegTech SaaS platform providing automated Anti-Money Laundering (AML) and Counter-Financing of Terrorism (CFT) Due Diligence and Screening services for Designated Non-Financial Businesses and Professions (DNFBPs) in Nigeria.

Because our platform processes sensitive personal identifiable information (PII) belonging to our clients' customers (the subjects of KYC/AML checks), we maintain an uncompromising standard of data security and privacy governance. This Data Protection Policy establishes the mandatory framework required to comply with the Nigeria Data Protection Act (NDPA) 2023, the Money Laundering (Prevention and Prohibition) Act (MLPPA) 2022, and administrative directives from the Nigeria Data Protection Commission (NDPC) and SCUML/NFIU.

In compliance with Section 25 of the NDPA 2023, DueSure and its subscribing DNFBP clients process personal data under a dual lawful basis:

1. Statutory Compliance (Legal Obligation): The processing of customer data is strictly required to fulfill statutory Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD) obligations imposed on DNFBPs under Sections 6 and 11 of the MLPPA 2022.

2. Explicit Documented Consent: Subscribing DNFBP clients covenant and warrant that they have obtained prior, unambiguous, and informed consent from their end-customers to run identity, sanctions, and PEP verifications through the DueSure platform.

3. In the context of processing end-customer data, the subscribing DNFBP acts as the Data Controller, and DueSure Support Limited acts as the Data Processor, processing such data solely on documented instructions from the DNFBP client

All platform operations, database architectures, and engineering workflows adhere strictly to the NDPA data protection principles:

1. Lawfulness, Fairness, and Transparency: Data is processed only for explicit regulatory and compliance verification purposes.

2. Purpose Limitation: Customer data submitted for screening is never utilized for marketing, profiling, or secondary commercial purposes.

3. Data Minimization: Only data fields strictly required to execute identity validation, PEP screening, and watchlist matching are ingested.

4. Accuracy: Screening indices are synchronized daily to maintain high data accuracy and prevent false compliance flags.

5. Storage Limitation & Retention: Data is retained in accordance with statutory anti-money laundering archiving schedules while respecting data minimization timelines.

6. Integrity and Confidentiality: Robust technical measures protect data against unauthorized access, destruction, or accidental loss.

To protect the personal data of your customers processed on DueSure, we enforce strict data shielding and tokenization protocols:

1. Prohibition of Raw Biometric Storage: Raw, unmasked National Identification Numbers (NIN), Bank Verification Numbers (BVN), or biometric templates belonging to your customers are never stored in plain text on our persistent multi-tenant database tables.

2. Aggregator-Proxy Routing: All identity verification queries interact exclusively with Tier-1 licensed Data Protection Compliance Organization (DPCO)-accredited aggregators.

3. Cryptographic Hashing: The platform stores only cryptographically masked display strings and irreversible HMAC-SHA256 hash fingerprints used solely for duplicate detection and audit tracking.

4. Transient Telemetry: External API payload responses containing sensitive personal data are scrubbed immediately after computing risk scores, retaining only necessary verification flags and audit hashes.

DueSure implements enterprise-grade technical security controls to ensure data segregation between different DNFBP organizations:

1. Row-Level Security (RLS): Our PostgreSQL 16 database enforces strict multi-tenant isolation via dynamic session variables. Tenant A cannot query, view, or access tenant B's customer screening records under any operational circumstance.

2. Encryption Standards:

   • At Rest: All databases, backups, and object storage buckets (storing audit certificates) are encrypted using AES-256-GCM.

   • In Transit: All web traffic, API endpoints, and microservice communications are secured using TLS 1.3.

3. Immutable Audit Logging: Every search query, data access, credit consumption, and compliance adjudication is recorded in a cryptographically chained, range-partitioned audit log table protected by immutability triggers that prevent updates or deletions.

1. Statutory Minimum Retention: Section 8 of the MLPPA 2022 mandates that all KYC, CDD, and transaction verification records be retained for a minimum period of five (5) years following the termination of the business relationship or completion of the transaction.

2. Secure Deletion: Upon the expiration of the statutory 5-year retention window (or upon lawful instruction from a DNFBP client where no overriding statutory obligation exists), customer screening files and audit dossiers are securely purged from active production environments using cryptographic shredding.

In alignment with Part V of the NDPA 2023, end-customers whose data is processed on the platform hold specific rights:

1. Right of Access & Rectification: Customers may request access to their screening dossiers or demand correction of inaccurate personal records through their respective DNFBP service provider.

2. Statutory Tipping-Off Restrictions: In compliance with anti-money laundering laws, access or deletion requests may be restricted or denied if fulfilling them would compromise an ongoing NFIU investigation, suspicious transaction report (SAR), or regulatory inquiry.

3. Grievance Redress: Complaints regarding data handling can be directed to our dedicated privacy desk at [email protected].

In the unlikely event of a security incident or data breach compromising personal identifiable information:

1. Internal Escalation: Any suspected breach must be reported to the Data Protection Officer (DPO) within two (2) hours of discovery.

2. NDPC Reporting: If a breach poses a risk to the rights and freedoms of data subjects, the DPO shall formally notify the Nigeria Data Protection Commission (NDPC) within seventy-two (72) hours in compliance with Section 40 of the NDPA 2023.

3. Client Notification: Affected DNFBP subscribing firms will be notified immediately with detailed technical impact assessments and remediation guidance.

1. Data Protection Officer (DPO): DueSure maintains a designated DPO responsible for overseeing compliance with this policy, conducting periodic Data Protection Impact Assessments (DPIAs), and managing data privacy inquiries.

2. Licensed DPCO Retainer: The company retains an accredited Data Protection Compliance Organization (DPCO) to audit our technical infrastructure annually and file statutory compliance reports with the NDPC.