Privacy Policy

1. Who we are

Yinetai ("Yinetai", "we", "us") provides the Yinetai Privacy Toolkit — a compliance platform that helps organisations meet their obligations under the Nigeria Data Protection Act 2023 (NDPA), the EU General Data Protection Regulation (GDPR), and related regulations. Our registered contact address is House C4, Praise Ville Garden Estate, Phase 3, Ogudu, Lagos, Nigeria. You can reach our privacy team at support@yinetai.com.

This policy explains how we handle personal data when you visit our website, create an account, or use the platform. Where our customers use the platform to manage their own compliance records, they act as the data controller of those records and we act as a data processor on their documented instructions.

2. The data we collect

We collect only what we need to run the service:

• Account data — name, work email address, phone number, organisation name, role, and login credentials (passwords are stored only as salted hashes).
• Billing data — plan selection and payment references. Card details are processed by our payment provider (Paystack) and never stored on our servers.
• Platform content — the compliance records your organisation creates (ROPA entries, assessments, logs, documents). This content belongs to your organisation.
• Usage data — sign-in timestamps, audit trails of actions taken in the platform, device and browser information, and IP addresses, used for security and support.
• Enquiry data — messages you send us through contact forms or support channels.

3. Why we process it

We process personal data to: provide and secure the platform; authenticate users and prevent abuse; bill for subscriptions; respond to support requests; meet our own legal obligations (including under the NDPA); and — with your consent — send product updates you can opt out of at any time. Our lawful bases are contract performance, legal obligation, legitimate interest in securing the service, and consent where indicated.

4. Sharing and disclosure

We do not sell personal data. We share it only with: service providers who host and operate our infrastructure under data-processing agreements; payment processors for billing; regulators or law enforcement where the law requires it; and, where your organisation initiates it, with the Data Protection Compliance Organisation (DPCO) or the Nigeria Data Protection Commission (NDPC) as part of an audit or filing workflow you control.

5. International transfers

Where data is transferred outside Nigeria, we do so in line with Part VIII of the NDPA — relying on adequacy, appropriate safeguards such as contractual clauses, or your explicit consent, and we record the basis in our own records of processing.

6. Retention

Account data is retained for the life of your subscription and deleted or anonymised within 90 days of account closure, except where a longer period is required by law (for example, financial records). Platform content is retained under your organisation's own retention settings; archived records remain reconstructable for compliance history until your organisation deletes them.

7. Your rights

Under the NDPA (and, where applicable, the GDPR) you have the right to access, correct, delete, or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent. Send requests to support@yinetai.com; we respond within the statutory timelines. You may also lodge a complaint with the Nigeria Data Protection Commission.

8. Security

We apply technical and organisational measures appropriate to the risk, described further in our Technology Privacy statement — including encryption in transit, hashed credentials, role-based access control, and audit logging of privileged actions.

9. Changes to this policy

We will post any changes on this page and, for material changes, notify account holders by email before they take effect.

Questions about this policy or our data practices? Contact our privacy team at support@yinetai.com or +234 703 846 3961.