Effective date: [[EFFECTIVE DATE]] · Version: [[VERSION]]
This policy covers people who use the CredCheck company portal and API on behalf of a manufacturer, brand, distributor, retailer or other business customer ("tenant"). That includes owners, admins, brand, production and compliance staff, support and viewer roles, and partner (distributor) users. It also covers people who contact our sales or support teams.
For the consumer side of CredCheck, see the consumer privacy policy.
Who is responsible
[[LEGAL ENTITY NAME]] ("CredCheck"), [[REGISTERED ADDRESS]], Lagos, Nigeria, RC [[RC NUMBER]]. DPO: [[DPO NAME]], [[DPO EMAIL]].
- We are the controller for your account, sign-in, security, billing and support data.
- Your organisation is the controller for the business data it puts into CredCheck: products, batches, codes, recalls, distributor contacts, engagement content, webhooks and integrations. We process that data for your organisation under our data processing agreement. Questions about that data should go to your organisation first.
What we collect
| Category | Examples | Source |
|---|---|---|
| Account and identity | Name, work email, optional phone number, language, company and role membership, invitation details | You, or the colleague who invited you |
| Authentication and security | Password (stored only as an Argon2id hash), MFA secret (encrypted), hashed MFA recovery codes, sign-in sessions (IP address, browser user agent, created, last used and revoked times), failed and successful sign-in attempts (hashed email identifier, IP, outcome), account lockouts | You and your device |
| Activity and audit | A record of every significant action: who, what, when, the before and after values of the change, IP address, request ID, and whether it happened during a CredCheck support session | Automatically |
| API and integrations | API key name, prefix, scopes, creator, last used (the secret is stored only as a hash), webhook endpoints and delivery logs | You |
| Notifications | In-portal notifications, your channel preferences (email, SMS, WhatsApp, push), quiet hours, opt-outs | You and the platform |
| Billing | Billing name, email, address, tax ID. Invoices and payments. Saved payment method as an encrypted provider token with brand, last 4 digits and expiry only. We never receive full card numbers or CVV. | You and payment providers |
| Support | Ticket subject, messages and attachments | You |
| AI feature use | Your prompts and the AI outputs for features such as the copilot and intelligence briefs. Stored with emails and phone numbers redacted, truncated, and with cost and provider metadata. | You |
How we use it and our legal bases
| Purpose | Legal basis ([[COUNSEL TO CONFIRM]]) |
|---|---|
| Creating and running your account, role-based access, and delivering the service to your organisation | Contract with your organisation. Legitimate interests toward you as its user. |
| Security: MFA, lockouts, session management, anomaly and abuse detection, audit logs | Legitimate interests (securing the platform and every tenant's data). Legal obligation where records are required. |
| Letting CredCheck support or operations staff view your organisation's portal during a time-limited support session. It needs a reason, is capped at 30 minutes, and every action is logged and visible to your organisation. | Legitimate interests and contract (support) |
| Service and billing messages: invites, password resets, security alerts, recalls, fraud alerts, usage and billing notices | Contract and legitimate interests |
| Billing, invoicing, tax and accounting | Contract. Legal obligation. |
| Product improvement and aggregated usage statistics | Legitimate interests |
| Marketing emails about new features [[ONLY IF USED]] | Consent or legitimate interests, with an opt-out in every message |
We do not use your data for automated decisions that have legal or similarly significant effects on you.
Who we share with
- Your organisation. Admins can see members, roles, activity and the audit log.
- CredCheck staff, on a need-to-know basis by role (support, operations, fraud, finance, compliance). Access is logged, and sensitive fields are masked by default.
- Service providers under contract: hosting (Hetzner, Germany), network and security (Cloudflare), email (Resend), SMS and WhatsApp (Africa's Talking, Meta), push (Expo), storage (Cloudflare R2), payments (Paystack, Flutterwave, Stripe, depending on what your organisation chooses) and AI (Anthropic, OpenAI, Google, depending on configuration). The list is at subprocessors.md. Platform administrators choose which providers are active, so the list shows every provider that may be used.
- Regulators receive aggregated counterfeit statistics only, never portal user data, unless the law requires it.
- Professional advisers, authorities and successors, as the law allows.
International transfers
Our platform is hosted in Germany. Some providers process data in the United States and elsewhere. We use recognised safeguards such as contractual clauses [[COUNSEL TO CONFIRM mechanisms per NDPA ss.41–43, GDPR Chapter V, POPIA s.72, Kenya DPA Part VI]].
Retention
| Data | Period ([[COUNSEL TO CONFIRM]]) |
|---|---|
| Account profile | While your account is active, then [[PERIOD]]. Erased or anonymised on request, subject to the exceptions below. |
| Sessions | [[PERIOD, e.g. 90 days after expiry]] |
| Sign-in attempts | [[PERIOD, e.g. 90 days]] |
| Audit logs | [[PERIOD, e.g. 7 years]]. Kept as a legal and security record. On erasure your identity is removed from your profile, and audit entries keep only an internal ID. |
| Invoices, payments, billing profiles | [[PERIOD required by tax and company law, e.g. 6 years]] |
| Support tickets | [[PERIOD]] |
| AI invocation logs | [[PERIOD, e.g. 12 months]] |
| Webhook delivery logs and notifications | [[PERIOD, e.g. 90 days]] |
[[ENGINEERING: these periods are not yet enforced in code, gap 2]]
Security
- Passwords are hashed with Argon2id. MFA is mandatory for company admins and all CredCheck staff.
- Access tokens are short-lived, and refresh tokens rotate.
- Secrets and personal fields are encrypted with AES-256-GCM.
- Tenant data is isolated by application checks and PostgreSQL row-level security, under a least-privilege database role.
- Traffic uses TLS. Backups are encrypted.
- Actions are audited, and penetration tests are carried out before launch.
See Annex 2 of the DPA.
Your rights
You can ask to:
- access, correct or delete your data
- restrict or object to processing
- have your data ported
- withdraw consent where we rely on it
You can also complain to the Nigeria Data Protection Commission or your local authority. Contact [[DPO EMAIL]].
Some limits apply:
- Company owners. If you are the owner of a company account, ownership must be transferred before your account can be erased.
- Business data. Requests about your organisation's business data are handled with your organisation, which is the controller.
- Records we must keep. We keep records we are legally required to keep, such as invoices and security audit entries.
Storage in your browser
The portal keeps your session in your browser (browser storage and a secure sign-in cookie) and remembers dismissed announcements. These are strictly necessary. There are no advertising or analytics cookies. Details: cookie-consent-audit.md.
Changes and contact
We will notify organisation admins of material changes by email or in the portal before they take effect.
Contact: [[DPO EMAIL]], [[POSTAL ADDRESS]].