NDPA Notice
Last updated 15 October 2026
Our role
For visitors and customer staff, YexID is the data controller. For the individuals our customers verify, the customer is the controller and YexID is the processor, acting only on the customer's instructions.
Lawful basis
Customers must have a lawful basis, including consent where required, before they ask us to verify an individual. We process on that instruction, on contract with the customer, and on our legal obligations.
Data minimisation
Each verification level returns only the fields on its allowlist. Check results are deleted after 24 hours, batch files after 48 hours. Our long-term call records are masked (last three NIN digits, no names).
Security and breaches
Data is encrypted in transit, access is limited by role, and the admin area requires sign-in plus two-factor authentication. If a breach is likely to harm individuals we will notify the Nigeria Data Protection Commission within 72 hours and tell affected customers without undue delay.
Transfers
Where personal data is processed outside Nigeria we apply the safeguards the NDPA requires.
Your rights
Subject to the NDPA you may ask to access, correct, delete or restrict your data, object to processing, and withdraw consent. Contact our data protection contact at [email protected], or complain to the Nigeria Data Protection Commission.