Privacy Policy

This Privacy Policy explains how Skillnexus Orbit Limited ("we", "us", "our") collects, uses, stores, and shares personal data when you use the IDNexus ("Service"). It applies to both account holders (customers using the API) and data subjects (individuals whose identity is being verified). The Service is available worldwide but governed by Nigerian law.

1. Data controller and processor roles

For account data (your email, password, API usage), IDNexus acts as a data controller. We determine what data we collect and why.

For verification data you submit — biometric images, identity documents, identity numbers, or phone records — you act as the data controller, and IDNexus acts as a data processor. You are responsible for ensuring you have a lawful basis to verify each individual, and for providing them with notice under the NDPA or the equivalent law in your jurisdiction.

2. What data we collect

Account data (controller role)

Verification data (processor role)

3. How we use your data

We process personal data to:

• Deliver the verification results you request
• Authenticate your account and API calls
• Process credit top-ups through our payment providers
• Comply with audit, tax, and anti-money-laundering obligations
• Detect and prevent fraud, abuse, and unauthorised access
• Respond to your support requests
• Send transactional emails (password resets, billing receipts, security alerts)
• Comply with lawful requests from regulators or courts

We do not use personal data for advertising, marketing profiling, or sale to third parties.

4. Third-party processors

We share data with the following processors, under contracts that require them to protect it:

Each processor is bound by a Data Processing Agreement that restricts their use of the data to the services they provide to us.

5. International data transfers

Some processors (Google Cloud, Cloudflare, Brevo) store data outside Nigeria. Under NDPA Section 43, cross-border transfers of sensitive personal data require appropriate safeguards.

We rely on the following safeguards:

• Biometric data: Processed entirely in-memory and never persisted outside the verification session. Any transient transfer to Google Cloud is encrypted in transit (TLS 1.3) and deleted after the response is returned.
• Account data: Transfers rely on standard contractual clauses and the processors' own NDPA-equivalent compliance programs.
• Identity attributes: Never transferred in raw form to non-Nigerian processors. Nigerian-based identity partners handle all raw identity number lookups.

If you require data residency in a specific jurisdiction, contact us at compliance@skillnexus.uk to discuss an enterprise plan.

6. Data retention

We retain data only as long as necessary:

• Account data: Until account deletion, then 90 days for recovery, then permanently deleted
• Session tokens: 7 days (expiry) or until logout
• Password reset tokens: 15 minutes
• API keys: Until revoked, then 30 days
• Verification results: 7 years (regulatory minimum for AML/KYC audit)
• Identity number hashes: 7 years (audit)
• Biometric images and embeddings: Deleted immediately after verification — not persisted
• Payment records: 7 years (tax and AML)

7. Your rights under NDPA

As a data subject, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data (subject to legal retention obligations)
• Restrict processing in certain circumstances
• Object to processing based on legitimate interests
• Port your data to another provider in a machine-readable format
• Withdraw consent at any time (this does not affect the lawfulness of prior processing)
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC) or your local data protection authority

To exercise any of these rights, email privacy@skillnexus.uk. We will respond within 30 days.

Note: If your data was submitted to us by one of our customers (as a data processor), we will forward your request to that customer, who is the data controller for your data. We will assist them in fulfilling your request.

8. Security

We implement industry-standard security measures:

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for data at rest
• PBKDF2-SHA256 (100,000 iterations) for password hashing
• SHA-256 hashing for API keys and identity numbers
• HMAC-SHA256 signing of service-to-service calls
• Regular security audits and penetration testing
• Least-privilege access controls for staff

If you discover a vulnerability, please report it to security@skillnexus.uk. We do not pursue legal action against good-faith security researchers.

9. Cookies

Our dashboard uses strictly-necessary cookies only (session tokens). We do not use advertising cookies, tracking pixels, or third-party analytics that profile you across sites.

Our API endpoints do not use cookies — authentication is via the Authorization: Bearer header or X-API-Key header.

10. Children

The Service is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has submitted data to us, contact privacy@skillnexus.uk and we will delete it promptly.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email at least 14 days before they take effect. The "Last updated" date at the top indicates the most recent revision.

12. Contact and complaints

For privacy questions: privacy@skillnexus.uk

For security reports: security@skillnexus.uk

For compliance matters: compliance@skillnexus.uk

If you are not satisfied with our response, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng or with your local data protection authority.