Azmahpoint Nigeria Ltd ('Azmahpoint', 'we', 'our', or 'us') is committed to protecting the personal information of every individual who interacts with our platforms, including the OrderBot SaaS engine. This policy describes what data we collect, how we process it, who we share it with, and the rights you hold under the Nigeria Data Protection Act 2023 (NDPA) and its implementing regulations.
1. Data We Collect
We collect information you provide directly — including full name, email address, WhatsApp phone number, and business details submitted through our Project Intake Form. When OrderBot is deployed for a merchant tenant, we additionally process end-customer order data (delivery addresses, item selections) strictly on behalf of the merchant as a data processor. We do not collect payment card numbers; all card data is handled exclusively by our payment gateway partners under their own PCI-DSS compliance frameworks.
2. Meta WhatsApp Cloud API Processing
OrderBot operates over the Meta WhatsApp Cloud API. When a user sends a WhatsApp message to an OrderBot-powered merchant number, that message is routed through Meta Platforms, Inc.'s infrastructure before reaching our webhook endpoints. We process the content of those messages solely to fulfil the commerce transaction requested. Message content is not retained beyond the order lifecycle (maximum 90 days) unless a longer retention period is explicitly agreed with the merchant. Meta's own data handling is governed by Meta's Privacy Policy and the WhatsApp Business Terms of Service.
3. Payment Logging
On payment confirmation, our systems log a settlement record containing: transaction reference ID, masked account identifier, settlement amount in NGN, gateway identifier, and a UTC timestamp. This log is maintained for a minimum of 7 years to satisfy Nigerian financial record-keeping obligations under CAMA 2020. Raw card or account credentials are never logged; our payment gateway partners tokenize all sensitive payment instruments on their own infrastructure.
4. Multi-Tenant Database Partitioning
Each merchant that deploys OrderBot is assigned a fully isolated database namespace identified by a unique tenant_id. Database-level access control lists (ACLs) prevent any query from one tenant namespace from reading, writing to, or enumerating records in another namespace. Backup snapshots are encrypted at rest using AES-256 and stored in geographically separated regions.
5. Your Rights Under the NDPA 2023
As a data subject under Nigerian law, you hold the following rights: (i) Right of Access — obtain a copy of personal data we hold; (ii) Right to Rectification — correct inaccurate data; (iii) Right to Erasure — request deletion where no legal retention obligation applies; (iv) Right to Restrict Processing; (v) Right to Data Portability; (vi) Right to Object. Contact us at support@azmahpoint.com.ng. We will respond within 30 days.
6. Retention Periods
Lead form submissions are retained for 24 months or until you request erasure. Order transaction logs are retained for 7 years. WhatsApp message content is deleted after 90 days from the date of the order. Audit logs of staff data access are retained for 3 years.
7. Security Measures
We implement: TLS 1.3 encryption in transit; AES-256 encryption at rest for database snapshots; RBAC limiting staff permissions to the minimum required; automated API key rotation on a 30-day cycle; and continuous uptime and anomaly monitoring.
8. Contact & Data Protection Officer
For any data protection queries, access requests, or complaints, contact our Data Protection Officer at: support@azmahpoint.com.ng. If you believe your data rights have been violated, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpb.gov.ng.
