1. Data Controller

The data controller for personal information collected through this platform is Astrigate Digital Operations, located at 2nd Floor, Bavis House, No. 19 Gwani Street, Wuse Zone 4, Abuja, Nigeria. You can reach our data protection contact at crm@astrigatetechnologies.com.ng.com.

2. What Personal Data We Collect

When you file a complaint or inquiry through our platform, we collect the following categories of personal data:

• Basic personal data: Name, gender, date of birth
• Contact data: Email address, phone number, residential address and state
• Sensitive identifiers (where voluntarily provided): National Identification Number (NIN), Bank Verification Number (BVN), Tax Identification Number (TIN), CAC registration number
• Case data: The nature, description, and documentation of your complaint
• Technical metadata: IP address, browser session (retained for security audit purposes only)

3. Purpose and Legal Basis

We process your personal data for the following specific purposes, each on a lawful basis under the NDPR:

Purpose	Legal Basis
Processing and investigating your complaint	Consent + Legitimate interest
Identity verification (NIN, BVN, TIN)	Consent (you confirm at point of submission)
Communicating case status updates to you	Contractual necessity / Consent
Compliance with regulatory/legal obligations	Legal obligation
Internal quality improvement and reporting	Legitimate interest (anonymised data only)

4. Consent Statement — What You Agree To

When you tick the consent checkbox on our complaint form and submit, you are providing freely given, specific, informed, and unambiguous consent (as required by Article 2.2 of the NDPR) to the following:

5. Use of National Identification Number (NIN)

Where you provide your NIN, you are granting explicit approval under Section 7 of the NDPR for its use solely for the purpose of identity verification in connection with your complaint investigation. Specifically:

• Your NIN will only be accessed by authorised case officers and verified against the NIMC database where applicable
• It will not be used for any marketing, profiling, or secondary purpose
• It will be stored in encrypted form and is accessible only to authorised personnel
• You may request deletion of your NIN record at any time after case resolution

6. Data Retention Schedule

• Active case records: Retained for the full duration of case processing
• Resolved case records: Retained for 7 years from date of resolution (regulatory requirement)
• Identity numbers (NIN/BVN/TIN): Archived after case resolution; securely deleted at end of retention period
• Consent records: Retained permanently as evidence of lawful processing
• Technical metadata (IP, session): Retained for 12 months

7. Your Rights as a Data Subject

Under the NDPR and NDPA 2023, you have the following enforceable rights:

• Right of Access (Art. 3.1(3)): Request a copy of all personal data we hold on you
• Right to Rectification: Correct inaccurate information
• Right to Erasure: Request deletion (subject to legal retention obligations)
• Right to Restriction: Ask us to limit how we use your data
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Withdraw Consent: At any time, without affecting prior processing
• Right to Object: To processing based on legitimate interest
• Right to Lodge a Complaint: With the Nigeria Data Protection Bureau (NDPB)

To exercise any of these rights, send a written request to crm@astrigatetechnologies.com.ng.com with the subject: "NDPR Data Subject Request". We will respond within 30 days.

8. Third-Party Disclosure

Your personal data will NOT be disclosed to any third party except:

• Government agencies or regulators where legally required
• Identity verification authorities (NIMC, FIRS, CAC) for the sole purpose of verifying the numbers you submitted
• Technology service providers under strict data processing agreements, for platform hosting only

9. Cross-Border Data Transfer

Where data is processed by third-party systems outside Nigeria, we ensure adequate safeguards are in place as required by the NDPR, including data processing agreements and equivalent data protection standards.

10. How to Complain to the Regulator

If you believe your data protection rights have been violated, you may lodge a complaint with:

---