In short
- We collect what we need to assess your application, verify who you are, finance and support your device, and meet our legal duties.
- Your NIN, selfie and financial details are sensitive. They are encrypted, shown masked, and opened only by staff who need them, with every access recorded.
- We check your NIN and selfie with an identity verification service against the national identity record. A person, not a computer, decides on your application.
- We never sell your data, and we never contact your friends or family about your account.
- You can ask to see, correct or delete your data, and complain to the Nigeria Data Protection Commission (NDPC).
1.Who is responsible for your data
[Company legal name] Limited (RC [RC number]), [Registered office address], Nigeria, operating as Solar PayGo, is the data controller for the personal data described here. We process it in line with the Nigeria Data Protection Act 2023 and the regulations and directives of the NDPC.
Our data protection officer can be reached at [data protection officer email]. This notice applies to customers, applicants, and people named as an alternate contact.
2.What we collect and where it comes from
| Kind of data | Examples | Where it comes from |
|---|---|---|
| Identity | Names, date of birth, NIN, NIN slip | You, or our sales representative with your permission |
| Photo of your face (selfie) | Used to confirm the NIN is yours; this is biometric data | You, or our sales representative with your permission |
| Contact details | Mobile number, email, residential address, area, state, nearest landmark | You |
| Alternate contact | Name and phone number of someone who agreed to be contacted if we cannot reach you | You |
| Financial | Declared monthly income, chosen payment frequency, deposits and repayments | You; payment providers once you pay |
| Identity check results | Name, date of birth and gender on the national record, face-match result and score | Our identity verification provider |
| Verification calls | When we called, whether we reached you, notes of what you confirmed | Our verification team |
| Product and service | Chosen device, serial number, installation notes, faults and warranty claims | You, our staff |
| Account and security | Password (stored only as a one-way hash), sign-in history, device and IP address | Your use of the service |
| Preferences | Preferred language, communication preferences | You |
We do not keep the photo or signature that the national identity record returns: we store only the result of the check. We do not ask for your bank card, bank PIN or BVN when you apply.
3.Why we use it and on what basis
| Purpose | Lawful basis |
|---|---|
| Assess your application, call you to confirm it, and offer and manage your financing agreement | Steps you asked us to take before a contract, then performance of the contract |
| Verify your identity with your NIN and selfie, including face matching | Your explicit consent (biometric data is sensitive), our legal obligations, and our legitimate interest in preventing fraud |
| Detect duplicate, fraudulent or mistaken applications | Legitimate interests and legal obligations |
| Take and record payments, issue unlock codes and receipts | Performance of the contract; legal obligations for financial records |
| Send reminders, service messages and updates about your application | Performance of the contract |
| Install, repair and support your device, and handle complaints | Performance of the contract; legitimate interests |
| Keep the service secure, keep an audit trail and improve it | Legitimate interests and legal obligations |
| Tell you about other products | Only with your consent, which you can withdraw at any time |
| Respond to lawful requests from regulators, courts or law enforcement | Legal obligation |
4.How we protect sensitive data
- Your NIN is encrypted in our database and shown with only its last four digits. Staff can see it in full only after giving a reason, and each time is recorded.
- NIN slips and selfies are kept in private storage. They open only through short-lived links for authorised staff, and every opening is recorded.
- Staff see only what their role needs: a sales representative sees the customers they registered, not your identity check results; verification officers see what they need to verify you.
- Administrators and verification officers must use two-step sign-in. Data is encrypted in transit.
5.Automated checks and human decisions
The identity verification service compares your details and selfie with the national record and returns a result, and our system flags things like a NIN used on another application. These are evidence for our verification team. A person makes every decision on your application. You can ask for a decision to be explained and reviewed (section 9).
7.Data stored outside Nigeria
Our systems are hosted in [hosting country / region], and some providers may process data outside Nigeria. Where that happens, we transfer data only as the Nigeria Data Protection Act allows, for example to a country with adequate protection or under contractual safeguards, and we can tell you which safeguards apply.
8.How long we keep it
| Record | How long |
|---|---|
| Applications that are rejected, withdrawn or expire, with their NIN slip and selfie | [24 months] after the decision, to deal with questions and repeat or fraudulent applications, then deleted |
| Customer records, financing agreements, payments and call notes | For the agreement and [6 years] after it ends, as financial and tax law requires |
| NIN slip and selfie of a customer | Until the agreement ends, then [12 months], unless a dispute requires longer |
| Security and sign-in records | [12 months] |
| Audit trail of access to records | As long as the record it describes |
Some records cannot be changed or deleted earlier where the law requires us to keep them, but we will stop using them for anything else.
9.Your rights
Under the Nigeria Data Protection Act you can ask us to:
- tell you what we hold about you and give you a copy;
- correct anything inaccurate or incomplete;
- delete data we no longer need or have no lawful reason to keep;
- restrict or stop some uses, including any use based on our legitimate interests;
- give you your data in a commonly used format;
- withdraw a consent you gave, at any time;
- explain and review a decision, and not be subject to a decision made only by a computer.
Contact our data protection officer at [data protection officer email]. We may ask you to confirm who you are. We respond within [30 days] and do not charge for reasonable requests. If you withdraw consent to identity checks, we may not be able to continue your application, but this does not affect checks already made.
You can also complain to the Nigeria Data Protection Commission (NDPC). We would appreciate the chance to sort things out first.
10.If someone named you as their alternate contact
We keep only your name and phone number. We contact you only to ask the customer to get in touch with us, never to tell you anything about their account or money they owe. To have your details removed, contact us.
11.If something goes wrong
If a personal data breach puts your rights at risk, we will notify the NDPC within 72 hours of becoming aware of it, as the law requires, and tell you without undue delay what happened and what you can do.
12.Children
Our service is for adults. We do not knowingly accept applications from anyone under 18.
13.Changes to this notice
Each version of this notice has its own number, and we record the version in force when you gave consent. We will tell you about important changes. Our terms explain how you apply and use the service.
14.Contact us
Data protection officer: [data protection officer email]
- Phone: [support phone]
- WhatsApp: [support WhatsApp number]
- Email: [support email]
- Post: [Company legal name] Limited, [Registered office address], Nigeria