Privacy Policy
Version 1.0 · Effective: 3 May 2026
1. Who We Are
Smartes LTD (RC 9165795) operates the SmartES platform at sme.smartes.com.ng. We act as both a Data Controller (for our own client relationships) and a Data Processor (for data belonging to your business's customers and staff, which you control).
We are registered with the Nigeria Data Protection Commission (NDPC) as a Data Controller and Processor of Major Importance (MDPOHL).
2. Data We Collect
About your business (you give us this)
Business name, CAC number, your name, email address, phone number, platform usage activity
Data you enter for your business operations
Your staff names, emails, roles · Your customers' names, phone numbers, transaction history · Sales records, inventory, expenses, invoices
Technical data (collected automatically)
Login timestamps, security event logs (login failures, account locks), API request logs
3. How We Use Your Data
| Purpose | Lawful Basis (NDPA 2023) |
|---|---|
| Account creation and management | Performance of contract |
| Delivering and improving the platform | Performance of contract |
| Sending you transactional notifications | Performance of contract / Legitimate interests |
| Security monitoring and audit logs | Legitimate interests |
| Complying with Nigerian law | Legal obligation |
We do not sell, rent, or trade your data. We do not use your data for advertising. Anonymised, aggregated insights (which cannot identify you or your customers) may be used to improve our services.
5. How We Protect Your Data
🔐 Encrypted in transit
HTTPS/TLS enforced on all platform endpoints
🗄️ Encrypted at rest
Database encrypted via Neon's built-in encryption
🔑 Passwords hashed
bcrypt with cost factor 12 — never stored in plain text
👤 Role-based access
Users only access data their role permits
📋 Security logging
Login events and security incidents are logged
🚨 Breach notification
We notify you within 72 hours of any breach affecting your data
6. Your Rights Under NDPA 2023
As a data subject under Nigerian law, you have the right to:
Access
Get a copy of data we hold about you
Rectification
Have inaccurate data corrected
Erasure
Request deletion where there's no lawful reason to keep it
Portability
Receive your data in a usable format
Object
Object to processing based on legitimate interests
Restrict
Request we limit processing in certain circumstances
To exercise your rights, email our Data Protection Officer at dpo@smartes.com.ng. We will respond within 30 days.
7. How Long We Keep Data
| Data Type | Retention Period |
|---|---|
| Your account and business data | Active subscription + 1 year |
| In-platform business data (sales, stock, etc.) | 30 days after closure, then permanently deleted |
| Security audit logs | 7 years (regulatory requirement) |
| Billing records | 7 years (FIRS tax requirement) |
| Support communications | 2 years |
9. Contact & Complaints
Smartes LTD · RC 9165795
🔐 Data Protection Officer: dpo@smartes.com.ng
📧 General enquiries: info@smartes.com.ng
📍 Suite A5 Coscharis Plaza, Area 3, Garki, Abuja, FCT, Nigeria
Right to complain
If you are not satisfied with our response to any privacy concern, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at www.ndpc.gov.ng.
© 2026 Smartes LTD · RC 9165795 · Terms & Conditions