Privacy Policy

1. Introduction

ZumaGrid Trust Infrastructure ("ZumaGrid", "we", "us", or "our") is committed to protecting the privacy and security of personal data. This Privacy Policy explains how we collect, use, store, and protect information when you use our platform, website (www.zumagrid.app), and related services.

We comply with the Nigeria Data Protection Regulation (NDPR) 2019, the Nigeria Data Protection Act (NDPA) 2023, and the EU General Data Protection Regulation (GDPR) where applicable.

2. Data Controller

ZumaGrid is the data controller for personal data processed through our platform. For enquiries regarding data protection, contact us at:

• Email: hello@zumagrid.app
• Phone: +234 706 728 1296
• Location: Lagos, Nigeria

3. Information We Collect

3.1 Information You Provide

• Account registration details (name, email, phone number, organisation)
• Identity verification data (biometric data for guard verification, government-issued ID numbers)
• Organisational data (company details, security post locations)
• Communications (support requests, feedback)

3.2 Information Collected Automatically

• Device and browser information
• IP address and approximate location
• Usage data (pages viewed, features used, timestamps)
• Patrol and operational logs generated through platform use

3.3 Biometric Data

Where biometric verification is deployed (fingerprint scanning, facial recognition), this data is processed under explicit consent and legitimate security interest. Biometric templates are encrypted at rest and in transit using AES-256 encryption.

4. Legal Basis for Processing

We process personal data under the following legal bases:

• Consent — Where you have given explicit consent (e.g. biometric enrolment)
• Contractual Necessity — To deliver services under our agreement with your organisation
• Legitimate Interest — To maintain platform security, prevent fraud, and improve services
• Legal Obligation — To comply with Nigerian law, including security reporting requirements

5. How We Use Your Data

• Providing and maintaining the ZumaGrid platform
• Identity verification and access control
• Generating operational intelligence reports for authorised clients
• Communicating service updates and security alerts
• Improving platform performance and user experience
• Meeting legal and regulatory obligations

6. Data Sharing

We do not sell personal data. We may share data with:

• Your Organisation — Operational data is shared with the institution that deployed ZumaGrid at your post
• Law Enforcement — Only when legally compelled by valid Nigerian court order
• Service Providers — Cloud hosting, payment processing, and communications providers operating under data processing agreements

7. Data Retention

Personal data is retained for the duration of the service relationship plus a maximum of 5 years after account closure, unless longer retention is required by law. Biometric data is deleted within 90 days of guard de-registration unless otherwise required by the contracting institution.

8. Data Security

• AES-256 encryption at rest and TLS 1.3 in transit
• Role-based access control (RBAC) for all platform data
• Regular security audits and penetration testing
• Incident response procedures with 72-hour breach notification

9. Your Rights

Under the NDPR/NDPA and GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Request erasure ("right to be forgotten")
• Restrict or object to processing
• Data portability
• Withdraw consent at any time
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC)

To exercise any of these rights, contact hello@zumagrid.app. We will respond within 30 days.

10. International Data Transfers

Where data is transferred outside Nigeria (e.g. cloud infrastructure), we ensure appropriate safeguards are in place including Standard Contractual Clauses (SCCs) and adequacy assessments as required by NDPR.

11. Cookies

Our website uses essential cookies for authentication and session management. For details on our cookie usage, please see our Cookie Policy.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered users and posted on this page with a revised "Last updated" date.