Privacy Policy

TRD Platform Limited ("TRD," "we," "us," or "our") is a technology company incorporated under the laws of the Federal Republic of Nigeria, with its registered office at 15th Floor, Civic Towers, Ozumba Mbadiwe Avenue, Victoria Island, Lagos, Nigeria. We operate an identity verification and compliance platform that serves financial institutions, fintech companies, telecommunications providers, insurance companies, and other regulated entities across multiple African markets.

This Privacy Policy describes how TRD collects, uses, processes, stores, discloses, and protects personal data in connection with our Platform, APIs, SDKs, and related services (collectively, the "Services"). For the purposes of this Policy, TRD acts as a data processor on behalf of our Customers who are data controllers, and as a data controller in relation to personal data of Customer representatives and website visitors. This Policy applies to all personal data processed by TRD regardless of the nationality or residency of the data subject.

Verification Data: We collect personal data submitted by our Customers for identity verification purposes. This includes full names, dates of birth, government-issued identification numbers (such as NIN, BVN, passport numbers), photographs and scanned images of identity documents, residential addresses, phone numbers, and email addresses of the individuals (End Users) being verified.

Biometric Data: With explicit consent, we collect and process biometric data including facial photographs, facial geometry templates, and liveness detection data used to verify that the person presenting an identity document is its rightful owner. Biometric templates are generated using irreversible hashing and are stored only for the duration necessary to complete the verification.

Device & Usage Data: We automatically collect technical information about devices used to access the Platform, including IP addresses, browser type and version, operating system, device identifiers, screen resolution, and language settings. We also collect usage data such as API call volumes, response times, error rates, and feature usage patterns to monitor and improve service performance.

Account Data: When Customers register for an account, we collect business name, registration number, registered address, billing contact details, and information about authorized users including names, email addresses, and role-based access permissions.

We use Verification Data to perform identity verification, business verification, sanctions screening, and fraud detection services as requested by our Customers. This includes matching submitted data against government databases, corporate registries, credit bureau records, telecommunications records, and sanctions watchlists to produce verification results and risk assessments.

We use device and usage data for fraud prevention and detection purposes, including identifying suspicious patterns, preventing unauthorized access, and maintaining the integrity of our Platform. Usage analytics are also used to improve service performance, optimize API response times, diagnose technical issues, and inform the development of new features and capabilities.

We may use Account Data and contact information to communicate with Customers regarding their accounts, service updates, security alerts, compliance notifications, billing, and changes to our Terms or this Privacy Policy. We will not use personal data for marketing communications without the appropriate consent from the data subject.

Our processing of personal data is carried out on one or more of the following legal bases as required by the Nigeria Data Protection Regulation (NDPR), the Nigeria Data Protection Act (NDPA), the Protection of Personal Information Act (POPIA) of South Africa, and other applicable data protection legislation.

Consent: Where required by applicable law, we obtain explicit, informed, and freely given consent from data subjects before processing their personal data. This is particularly relevant for the processing of biometric data and any processing that goes beyond what is necessary for the performance of a contract. Consent may be withdrawn at any time by contacting our Data Protection Officer.

Contractual Necessity: We process Verification Data as necessary for the performance of our contract with our Customers and to provide the Services as agreed. Processing is also necessary to take pre-contractual steps at the request of the Customer, such as providing trial access and service demonstrations.

Legal Obligation: We process personal data where required by applicable laws and regulations, including anti-money laundering (AML) and counter-terrorism financing (CTF) regulations, regulatory reporting obligations, and lawful requests from competent authorities.

Legitimate Interests: Where appropriate, we process personal data on the basis of our legitimate interests or the legitimate interests of our Customers, including fraud prevention, network and information security, and service improvement, provided that such interests are not overridden by the rights and freedoms of the data subject. We maintain records of our legitimate interest assessments in accordance with NDPR and POPIA requirements.

We may share personal data with carefully vetted third-party service providers who assist us in delivering the Services. These providers include cloud infrastructure providers, government identity database operators, corporate registry authorities, credit bureaus, telecommunications companies, and sanctions screening database providers. All third-party processors are bound by data processing agreements that impose security and confidentiality obligations no less protective than those set out in this Policy.

We may disclose personal data to government authorities, law enforcement agencies, or regulatory bodies when required by applicable law, regulation, court order, or lawful government request. We participate in fraud prevention networks and may share anonymized or aggregated data with such networks to combat financial crime across the African market. We do not sell, rent, or trade personal data to any third party for their own marketing or commercial purposes.

We retain Verification Data for the duration necessary to provide the Services and as required by applicable law and regulatory frameworks. For active Customer accounts, verification records are retained for a minimum of five (5) years from the date of verification, in accordance with CBN anti-money laundering record-keeping requirements and similar regulatory obligations across our operating markets.

When a Customer account becomes inactive or is terminated, Verification Data associated with that account is retained for ninety (90) days to allow the Customer to export its data, after which it is securely deleted unless regulatory retention requirements mandate a longer period. Biometric templates are deleted within thirty (30) days of the completion of the verification process, unless regulatory requirements dictate otherwise. Anonymized or aggregated data derived from Verification Data may be retained indefinitely for analytical and service improvement purposes, as such data cannot be attributed to an identifiable individual.

In accordance with the NDPR, NDPA, POPIA, and other applicable data protection legislation, data subjects have the following rights in relation to their personal data processed by TRD. Because TRD primarily acts as a data processor on behalf of our Customers, requests from End Users should generally be directed to the Customer that submitted their data. However, TRD will assist Customers in responding to data subject requests and will cooperate directly with data subjects where appropriate.

Right of Access: Data subjects have the right to obtain confirmation of whether their personal data is being processed and, if so, to access a copy of that data along with information about the processing. Right to Rectification: Data subjects have the right to have inaccurate personal data corrected and incomplete data completed. Right to Erasure: Data subjects have the right to request the deletion of their personal data where it is no longer necessary for the purposes for which it was collected, or where the data subject withdraws consent and there is no other lawful basis for processing.

Right to Data Portability: Data subjects have the right to receive their personal data in a structured, commonly used, and machine-readable format. Right to Object: Data subjects have the right to object to processing based on legitimate interests. Right to Restriction: Data subjects have the right to request the restriction of processing in certain circumstances, such as where the accuracy of the data is contested. Requests can be submitted to dpo@trdplatform.com and will be responded to within ten (10) business days, with erasure requests initiated within seventy-two (72) hours.

TRD primarily processes and stores personal data within Africa, with data centers located in Nigeria and South Africa. However, the provision of our Services may require the transfer of personal data to other jurisdictions, including to our cloud infrastructure providers and third-party data sources. Transfers within the African Continental Free Trade Area (AfCFTA) framework are governed by the data protection laws of the respective member states.

Where personal data is transferred to a jurisdiction that has not been deemed to provide an adequate level of data protection, we implement appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the Nigerian Data Protection Commission (NDPC) and the Information Regulator of South Africa, binding corporate rules, and supplementary technical and organizational measures to ensure that the transferred data receives a level of protection equivalent to that required by the NDPR and POPIA.

TRD implements comprehensive technical and organizational security measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. All personal data is encrypted at rest using AES-256-GCM encryption and in transit using TLS 1.3. Sensitive fields, including identification numbers and biometric data, are encrypted with customer-specific keys managed through a hardware security module (HSM) infrastructure.

Access to personal data is strictly controlled through role-based access control (RBAC) with the principle of least privilege. All access to personal data is logged in immutable audit trails, and access logs are monitored for anomalous activity. TRD maintains SOC 2 Type II compliance and undergoes annual third-party security audits and penetration testing conducted by independent security firms. Vulnerability assessments are performed on a continuous basis using automated scanning tools.

Our security infrastructure includes network segmentation, web application firewalls, distributed denial-of-service (DDoS) protection, intrusion detection and prevention systems, and real-time security monitoring. All employees and contractors with access to personal data are required to complete annual security awareness training and are subject to background checks and confidentiality obligations.

TRD maintains a comprehensive data breach response plan to ensure swift detection, containment, and remediation of any personal data breach. In the event of a breach involving personal data, TRD will notify the affected Customer without undue delay and in any event within seventy-two (72) hours of becoming aware of the breach, in accordance with the NDPR notification requirements.

Where a breach is likely to result in a high risk to the rights and freedoms of data subjects, TRD will work with the relevant Customer to ensure that affected data subjects are notified directly, unless the personal data has been rendered unintelligible through encryption or other technical measures. TRD will also notify the Nigeria Data Protection Commission (NDPC) and, where applicable, the Information Regulator of South Africa, within the timeframes prescribed by applicable law. Following any breach, TRD will conduct a thorough investigation and implement corrective measures to prevent recurrence.

We use cookies and similar tracking technologies on our website and Platform to enhance functionality, analyze usage patterns, and improve the user experience. Essential cookies are strictly necessary for the operation of the Platform, including session management, authentication, and security features. These cookies cannot be disabled as the Platform would not function without them.

Analytics cookies help us understand how visitors interact with our website and Platform by collecting information about pages visited, time spent, and navigation patterns. This data is aggregated and anonymized and is used solely for service improvement purposes. Preference cookies remember your settings and preferences, such as language selection and dashboard layout, to provide a more personalized experience.

TRD does not use marketing or advertising tracking cookies without obtaining explicit consent. We do not participate in cross-site tracking or sell data to advertising networks. You can manage your cookie preferences through your browser settings or through the cookie consent banner displayed on your first visit to our website. Please note that disabling certain cookies may affect the functionality of the Platform.

The TRD Platform and its Services are not directed at individuals under the age of eighteen (18) years. We do not knowingly collect personal data from children. Our Customers are responsible for ensuring that any verification requests they submit through the Platform relate to individuals who are at least eighteen (18) years of age, or where the verification is conducted in compliance with applicable laws regarding the processing of minors' data.

If we become aware that we have inadvertently collected personal data from a child under eighteen (18), we will take immediate steps to delete such data from our systems. If you believe that a child under the age of eighteen has provided personal data to us through the Platform, please contact our Data Protection Officer at dpo@trdplatform.com and we will take appropriate action, including deletion of the relevant data.

TRD reserves the right to update or modify this Privacy Policy at any time. When we make material changes to this Policy, we will notify our Customers by email at the address associated with their account and by posting a prominent notice on the Platform dashboard. The date of the most recent revision will always be indicated at the top of this page.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data. Your continued use of the Platform following the posting of changes to this Policy constitutes your acceptance of such changes. If you do not agree with the revised Policy, you should discontinue use of the Services and contact us to request the deletion of your data in accordance with the data subject rights outlined in Section 7.

TRD has appointed a Data Protection Officer (DPO) who is responsible for overseeing our compliance with data protection legislation, including the NDPR, NDPA, and POPIA. The DPO serves as the primary point of contact for data protection inquiries, data subject rights requests, and regulatory consultations.

Email: dpo@trdplatform.com

Address: Data Protection Officer, TRD Platform Limited, 15th Floor, Civic Towers, Ozumba Mbadiwe Avenue, Victoria Island, Lagos, Nigeria.

We aim to acknowledge all data protection inquiries within two (2) business days and to provide a substantive response within thirty (30) days, in accordance with the NDPR response timeline. For NDPR compliance inquiries, including data breach notifications and regulatory filings, please direct all correspondence to the DPO at the email address above.

TRD is registered with and subject to oversight by the following data protection regulatory authorities in our operating markets:

Nigeria Data Protection Commission (NDPC): The NDPC is the primary regulatory authority responsible for the enforcement of the Nigeria Data Protection Regulation (NDPR) and the Nigeria Data Protection Act (NDPA). TRD maintains its NDPR compliance registration with the NDPC and submits annual data protection audit reports as required. Complaints and inquiries may be directed to the NDPC at ndpc.gov.ng.

Information Regulator (South Africa): The Information Regulator is established under the Protection of Personal Information Act (POPIA) and is responsible for monitoring and enforcing compliance with POPIA in South Africa. TRD processes personal data of South African data subjects in compliance with POPIA requirements, including the appointment of an Information Officer and the maintenance of processing records. Complaints may be directed to the Information Regulator at inforegulator.org.za.

Data subjects who are unsatisfied with TRD's response to a data protection complaint retain the right to lodge a complaint directly with the relevant supervisory authority in their jurisdiction. TRD will fully cooperate with any investigation conducted by a competent regulatory authority.