Privacy Policy

1. Who We Are

Saharix Technologies Ltd (Saharix, we, us) is a Nigerian company that operates an escrow payment platform. For the purposes of the Nigeria Data Protection Act 2023 (NDPA) and, where applicable, the Nigeria Data Protection Regulation, Saharix is the data controller of the personal data described in this Policy. You can reach our data protection contact at privacy@saharix.com for any question, request, or complaint about your data.

2. The Data We Collect

We collect the following categories of personal data:

• Identity and contact data, such as your name, email address, phone number, and profile photo;
• Verification data, such as government-issued identification documents, selfie or liveness images, and the verification status and identifiers returned by verification providers;
• Transaction data, such as contracts, milestones, amounts, currencies, payment references, receipts, reviews, and dispute records and communications;
• Financial data, such as payout account details (bank name, account number, account type), which are stored in a masked form where possible;
• Device and usage data, such as IP address, device model, operating system, app version, pages viewed, and actions taken, collected through cookies and similar technologies;
• Communications data, such as messages and evidence exchanged within a contract, and records of your contacts with our support team, including via WhatsApp where you choose to use that channel.

3. Why We Process Your Data and Our Lawful Bases

Under the NDPA we process your personal data only where we have a lawful basis:

• Performance of a contract: to create and manage your account, operate escrow, process payments and payouts, verify delivery, issue receipts, and provide support.
• Compliance with a legal obligation: to verify identity (know-your-customer obligations), to keep transaction records, and to respond to lawful requests from regulators and law enforcement.
• Legitimate interests: to detect and prevent fraud, money laundering, and abuse; to secure our systems; to improve the Platform based on aggregated usage; and to enforce our Terms.
• Consent: to send you marketing communications and, where required, to process certain verification data. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

4. Verification and Financial Data

• Identity documents and selfies are collected only when a transaction or payout requires verification above our published limits.
• They are transmitted over encrypted connections, stored with restricted access, and retained only as long as required to meet our legal obligations and the requirements of our payment partners, after which they are deleted or anonymized.
• Bank account and payout details are used solely to deliver your money to you and to meet anti-fraud obligations.
• We do not store your card details; payments are processed on the secure pages of our payment providers.

5. Who We Share Your Data With

We share personal data only as needed to operate the Platform:

• Payment processors (Paystack Payments Limited and Flutterwave Technology Solutions Limited) to collect payments and process refunds;
• Payout partners (including Grey Tech Inc and licensed banks and mobile money operators) to deliver funds to your payout account;
• Counterparties to a transaction, who see your display name, profile photo, and transaction details as necessary to the escrow;
• Verification providers, who process your identity documents to confirm your identity;
• Infrastructure and communications providers, including our cloud hosting provider, email delivery provider, and the WhatsApp Business Platform for users who opt into that channel;
• Professional advisers, auditors, insurers, and, where required or permitted by law, regulators (including the Nigeria Data Protection Commission and the Central Bank of Nigeria regime applicable to our partners), law enforcement, and the Nigerian Financial Intelligence Unit.

We do not sell your personal data.

6. International Transfers

Some of the providers listed in section 5 may process data outside Nigeria. Where that happens, we rely on adequacy assessments and safeguards such as contractual clauses and data protection agreements with those providers, and we transfer only the data necessary for the specific purpose, in line with the NDPA's requirements for cross-border transfers.

7. How Long We Keep Your Data

• Account and profile data are kept while your account is active and for up to 5 years after closure, in line with record-keeping obligations applicable to payment transactions.
• Transaction, escrow, and dispute records are kept for at least 5 years after completion.
• Identity verification data is kept for the period required by applicable law and our payment partners' rules.
• Support communications are kept for up to 3 years.
• Usage data collected for security purposes is kept for up to 13 months.

Where data is no longer needed, we delete it or anonymize it so it can no longer be linked to you.

8. Your Rights

Under the NDPA you have the right to:

• access the personal data we hold about you and receive a copy;
• ask us to correct data that is inaccurate or incomplete;
• ask us to delete data that we no longer have a lawful basis to keep;
• object to or restrict certain processing, including processing based on legitimate interests;
• withdraw consent for consent-based processing at any time;
• lodge a complaint with the Nigeria Data Protection Commission.

To exercise any of these rights, email privacy@saharix.com from your registered email address. We respond within 30 days. We may ask for additional verification before acting on a request. Some requests may be limited where we are legally required to retain data, for example transaction records.

9. Security

• Encryption of data in transit (TLS) and at rest for sensitive fields;
• Hashed passwords and signed, rotated session tokens;
• Two-factor authentication with authenticator apps, email codes, and backup codes;
• Role-based access controls and audit logging of sensitive actions;
• Secure development practices.

Access to verification documents and financial data is restricted to personnel and processes that need it. No system is completely secure; if a personal data breach is likely to cause you harm, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it and will inform affected users where required.

10. Cookies and Similar Technologies

Our website uses strictly necessary cookies and local storage to keep you signed in and to remember preferences, and optional analytics cookies to understand how the site is used. You can control non-essential cookies through your browser settings. Our mobile applications do not use advertising identifiers.

11. Children

The Platform is not directed at anyone under 18, and we do not knowingly process the personal data of children. If we learn that an account belongs to someone under 18, we will close it and delete associated personal data, subject to retention obligations.

12. Changes to This Policy

We may update this Policy to reflect changes in our processing or the law. The version on this page is the current one, and material changes will be announced by email or in-app notice before they take effect.

13. Contact

For anything related to this Policy or your data, contact privacy@saharix.com. If you are not satisfied with our response, you may complain to the Nigeria Data Protection Commission.