Privacy Policy

Identro is a digital trust, identity, business verification, AML, fraud, decision-support, wallet, digital-services, API and agent-services platform. The legal operator is Syrol Technologies Limited of Ihesiaba Court, Ishaya Shekari Crescent, Gwarinpa, Abuja, FCT, Nigeria.

For Account, staff, merchant onboarding, billing, security, fraud prevention, legal compliance, audit, service integrity and dispute records, Identro generally acts as a Data Controller. When a Business Customer submits an individual’s data for a requested verification or workflow, the Business Customer generally acts as Controller and Identro acts as Processor for that submitted data.

Identro may act as an independent Controller for limited processing connected to the same request where necessary to protect the Platform, prevent fraud and abuse, maintain billing and audit records, comply with law, manage provider disputes or establish and defend legal claims. The applicable Data Processing Addendum governs Processor activities.

• Website visitors and prospective customers.
• Merchants, Integration Partners, Service Partners, agents, staff and authorised users.
• Individuals whose identity, business, address, biometric or financial identifiers are submitted for verification.
• End users of merchant-provided digital or wallet-enabled services.
• Directors, beneficial owners, representatives, vendors, applicants and support contacts.

• Account and profile data: name, email, phone, credentials, role, security settings and status.
• Business and KYB data: company details, CAC and TIN information, licences, directors, beneficial owners, contact persons, addresses, bank and settlement details.
• Verification data: BVN, NIN, driver’s licence, voter-card data, address, facial image, liveness capture, consent reference, request metadata and verification result.
• AML, fraud and decision-support data: sanctions or watchlist indicators, risk signals, fraud markers, credit or eligibility inputs and outcome metadata.
• Wallet, payment and transaction data: balances, funding records, debits, reversals, commissions, settlement, provider references, receipts and reconciliation entries.
• Digital-service data: telephone, meter, smart-card, examination or beneficiary details required to fulfil a selected service.
• Technical and security data: IP address, device and browser data, API usage, allowlist configuration, webhooks, logs, session data and security events.
• Support, sales, complaint and communication records.

We receive Personal Data directly from individuals and organisations, from authorised merchants and agents, and from providers used to deliver a requested Service. These may include identity and business registries, financial institutions, payment processors, credit or risk partners, government agencies, telecommunications providers and fraud-prevention services.

Business Customers are responsible for ensuring that data submitted to Identro was collected lawfully and that required notices and consents were provided.

We process Personal Data only where a lawful basis applies under the Nigeria Data Protection Act 2023 and other applicable law.

Where consent is required for biometric, identity or other sensitive processing, the Business Customer must obtain and retain valid, specific and informed consent before submission. Identro may request evidence and may reject or suspend a request where a lawful basis is not reasonably demonstrated.

Consent may be withdrawn, but withdrawal does not affect prior lawful processing and may not require deletion of records that must be retained for legal, fraud, billing, security or dispute purposes.

BVN, NIN, facial images, biometric templates, liveness data and certain identity or financial identifiers receive enhanced protection. We apply access restrictions, encryption, masking or pseudonymisation where appropriate, monitoring and controlled retention.

Biometric data is used only for authorised verification, authentication, fraud prevention and security purposes. Identifiable verification images, biometric templates and API-submitted customer data are not used to train general-purpose AI models unless a separate lawful basis, appropriate notice and any required explicit consent are in place.

Identro may use automated systems, artificial intelligence and machine learning to perform and improve face matching, liveness detection, identity verification, fraud prevention, AML screening, risk assessment, credit or loan decision-support and Platform security.

Unless Identro is expressly contracted and legally authorised to make the final decision, the relevant merchant, lender or organisation remains responsible for final onboarding, credit, employment, compliance or transaction decisions. Where applicable law gives an individual rights concerning a solely automated significant decision, the individual may request human intervention, express a view and contest the decision through the relevant organisation or Identro.

Identro Accounts are generally intended for adults and authorised organisations. A minor may nevertheless be the subject of a lawful merchant request or the beneficiary of a digital service. The submitting customer must verify age where appropriate, obtain parent or guardian consent where required, collect only necessary information and apply heightened safeguards. Identro may refuse processing where these requirements are not demonstrated.

Business Customers may submit Personal Data through APIs and SDKs for a specified request. Identro processes such data to deliver the requested Service and does not use identifiable submitted data for unrelated marketing or general product training. Customers must secure credentials, minimise payloads, provide end-user notices and comply with the Data Processing Addendum.

• Identity, business, financial and government registries required to perform a request.
• Verification, AML, fraud, credit, address and biometric providers.
• Banks, payment processors and settlement providers.
• Cloud hosting, communications, email, monitoring, security and software providers.
• Auditors, licensed Data Protection Compliance Organisations, insurers and professional advisers.
• Regulators, courts, law enforcement and public authorities where lawfully required.
• A successor or purchaser in a lawful restructuring or transfer, subject to appropriate safeguards.

Identro does not sell, rent or commercially exchange Personal Data and does not disclose verification data for third-party advertising.

Where Identro acts as Processor, it may engage vetted sub-processors under written obligations concerning confidentiality, security, lawful processing, breach assistance, deletion and data-subject rights. Enterprise customers may request the current sub-processor list. Material changes will be notified as required by the applicable agreement.

Personal Data may be stored in or accessed from another country only where a transfer mechanism recognised by applicable law is in place. Depending on the circumstances, safeguards may include an adequacy determination, approved contractual clauses, binding corporate rules, a documented necessity ground or specific informed consent where legally appropriate. We assess transfer risk and apply contractual, technical and organisational controls.

We retain Personal Data only for the period necessary for the relevant purpose, legal obligations, fraud prevention, billing, security and dispute management. Retention may be extended where a legal hold, complaint, investigation or proceeding applies.

Deletion is applied across active systems and provider workflows where technically and contractually possible. Backup copies are isolated from normal use and expire through controlled backup-rotation schedules.

• Access and information about processing.
• Correction of inaccurate or incomplete data.
• Deletion where no lawful reason for retention remains.
• Restriction or objection where available.
• Data portability where legally and technically applicable.
• Withdrawal of consent.
• Human review of qualifying automated decisions.
• Complaint to the Nigeria Data Protection Commission or another competent authority.

Requests may be sent to info@identro.ng with “Attention: Data Protection Officer”. We may verify identity and, where Identro acts only as Processor, refer or coordinate the request with the relevant Business Customer. We aim to respond without undue delay and within the period required by law.

We use risk-appropriate safeguards including encryption in transit, encryption at rest where appropriate, role-based access, least privilege, credential controls, IP restrictions, logging, monitoring, secure development, vulnerability management, backups, incident response and vendor due diligence.

Where Identro acts as Processor, it will notify the relevant Controller without undue delay after becoming aware of a Personal Data Breach. Where Identro acts as Controller, it will notify the NDPC within 72 hours where the breach is likely to result in a risk to individuals, and notify affected individuals without undue delay where the breach is likely to result in high risk, subject to applicable law.

Identro uses essential and security technologies needed for login, session management, fraud prevention and Platform operation. Preference technologies may remember settings. Analytics technologies are used only in accordance with applicable consent and transparency requirements.

Where non-essential cookies are deployed, users will be provided with a consent mechanism and information describing the cookie name, provider, purpose, category and duration. Users may withdraw non-essential cookie consent through the available preference controls.

Marketing communications are sent only on a lawful basis and include a free opt-out. Transactional, security, service and legal notices are not marketing and may continue where necessary for the Account or Services.

Identro conducts Data Protection Impact Assessments for high-risk processing, including large-scale identity verification, biometrics, liveness, fraud scoring, loan decision-support and material new technologies. We maintain processing records, vendor reviews, retention controls, training and compliance assessments appropriate to our operations.

Material changes to this Policy will be communicated through the Platform, email or another reasonable channel. The effective date above identifies the current version.

Privacy and rights requests: info@identro.ng (Attention: Data Protection Officer). Security incidents: security@identro.ng. General support: support@identro.ng or info@identro.ng. Postal address: Ihesiaba Court, Ishaya Shekari Crescent, Gwarinpa, Abuja, FCT, Nigeria. Complaints may also be made directly to the Nigeria Data Protection Commission through its official channels.