Privacy Policy

Dojah Technologies Limited

1. Introduction

Dojah Technologies Limited (“Dojah”, “we”, “our”) recognises your privacy rights as guaranteed under the 1999 Constitution of the Federal Republic of Nigeria, the Nigerian Data Protection Act 2023 (“NDPA”), and the privacy provisions in other applicable laws governing our business operations in Nigeria.

This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you engage with us through our website at www.dojah.io, our digital platforms, our identity verification and compliance services, and any other touchpoints through which you interact with Dojah.

We are committed to processing your personal data in a manner that is lawful, fair, and transparent. This Policy is intended to help you understand:

• What personal information we collect and why.
• The legal basis on which we process your data.
• How we protect your information against unauthorised access, disclosure, or misuse.
• Your rights as a data subject and how to exercise them.
• How to contact us with questions or concerns about your data.

Note on our role as Data Processor: Dojah primarily acts as a Data Processor. We process personal data on behalf of our business clients — the Data Controllers — who determine the purposes and means of processing. In certain contexts described in this Policy (including our fraud intelligence services), Dojah may act as an independent Data Controller. Where relevant, this distinction is indicated.

2. Information We Collect

We collect only the information that is necessary for providing and improving our services. Our data collection practices are designed to be transparent, lawful, and proportionate. We do not collect Sensitive Personal Data unless it is required for a legitimate purpose, is collected with appropriate legal authority, and — where required — with your explicit consent.

We collect the following categories of personal data:

• Identifying Data: Information such as your full name, date of birth, and government-issued identification numbers (including passport numbers, National Identification Numbers, Bank Verification Numbers, and Tax Identification Numbers) collected when you register for our services or when our business clients submit your information for identity verification purposes.
• Contact Data: Your contact information, including postal address, email address, country of residence, and phone number, collected during registration or as part of the verification process.
• Demographic Data: Information such as gender, age, and nationality, collected to facilitate compliance with regulatory requirements and to improve our services.
• Financial Data: Financial information, including bank account details, Bank Verification Number (BVN), National Identification Number (NIN), virtual account information, and payment-related information, where necessary to provide our services, conduct verification activities, comply with regulatory requirements, and support fraud prevention measures.
• Transactional Data: Records of transactions processed through our platform, including purchase history and order details, used to facilitate services and provide customer support.
• Employment Data: Where you apply for a role at Dojah, we will collect employment-related information including job title, work history, and compensation details, used solely for recruitment purposes.
• Location Data: Location information, including GPS coordinates and IP address data, collected to provide location-based services and to detect anomalous access patterns.
• Online Identifiers: Identifiers such as usernames, device IDs, and cookies, collected to authenticate users, personalise experiences, and support analytics.
• Biometric and Identity Verification Data: In connection with our identity verification services, we may process biometric data, including facial images, facial recognition templates, liveness detection data, and other biometric identifiers derived from identity documents and liveness checks submitted through our platform. This processing is carried out on behalf of our business clients for the purposes of identity verification and fraud prevention.

Where Dojah stores any data derived from biometric processing for fraud intelligence purposes, this is done exclusively in the form of irreversible cryptographic hash values, encrypted representations, or pseudonymised records. Raw biometric data and facial images are not retained by Dojah beyond the immediate processing session unless expressly required by law or with appropriate legal authority. See Section 6 (Fraud Intelligence and Identity Signal Processing) for full details.

3. How We Use Your Information

We use the personal data we collect for the following purposes:

• To provide, operate, and improve our identity verification, KYC, KYB, and AML compliance services.
• To verify the identity of individuals on behalf of our business clients.
• To detect, investigate, and prevent fraud, financial crime, and other unlawful activity.
• To generate cross-platform fraud intelligence signals as described in Section 6.
• To comply with applicable laws and regulations, including AML, KYC, and data protection obligations.
• To communicate with you about our services, including service updates and important notices.
• To process payments and manage accounts.
• To respond to enquiries, complaints, and requests.
• To conduct analytics and improve the performance of our platforms.
• For recruitment and employment-related purposes where applicable.

4. AI Use and Automated Processing

Dojah may use approved artificial intelligence (AI) tools in connection with its work, including for drafting, editing, summarising, research, planning, coding assistance, and improving the performance of its platforms and services.

AI tools are used in accordance with Dojah's internal AI governance requirements. Personal data, client data, KYC and identity verification data, fraud or AML logic, credentials, source code, and unpublished internal information must not be entered into AI tools that have not been approved for that purpose.

AI-generated output is reviewed and checked before it is used or communicated. Dojah does not permit AI tools to make final decisions about customers, fraud cases, or compliance matters. Where AI has been used in significant work, that use is disclosed as required by Dojah's internal governance requirements.

5. Legal Basis for Processing

All processing of personal data by Dojah is carried out on one or more of the following lawful bases as provided under the Nigerian Data Protection Act 2023:

• Consent: Where you have provided explicit consent for a specific processing activity, such as receiving marketing communications or the processing of sensitive personal data. You have the right to withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Contractual Necessity: Where processing is necessary to perform a contract to which you are a party, or to take steps at your request before entering into a contract, including the provision of our identity verification and compliance services.
• Legal Obligation: Where processing is necessary to comply with a legal or regulatory obligation, including obligations under anti-money laundering legislation, tax laws, court orders, and directives from regulatory authorities.
• Legitimate Interests: Where processing is necessary for the legitimate interests of Dojah or a third party, provided those interests are not overridden by your rights and freedoms. This includes:
  • Fraud prevention and detection, including the generation of cross-platform identity fraud signals.
  • Maintaining the security and integrity of our platforms and services.
  • Improving and developing our products and services.
  • Compliance and risk management activities.

Where we rely on legitimate interests as a legal basis, we conduct a balancing assessment to ensure our interests do not unduly prejudice your rights as a data subject.

6. Fraud Intelligence and Identity Signal Processing

Dojah operates a cross-platform fraud intelligence service designed to assist our business clients in identifying potential identity anomalies during their customer onboarding and verification processes. This section explains how this service works, what data is involved, and what it means for individuals whose data is processed.

What This Service Does

As part of processing identity verification requests on behalf of our business clients, Dojah may generate and retain cryptographic hash representations of identity data — specifically, one-way hashes derived from biometric data (such as facial images) and identity reference numbers (such as Bank Verification Numbers). These hashes are mathematical representations that cannot be reversed to reconstruct the original data.

When an identity verification request is submitted, Dojah may compare the resulting hash values against hashes generated from prior verification requests processed across our platform. Where a comparison indicates a potential anomaly — for example, that the same biometric hash has been associated with more than one identity number in separate verification events — Dojah may generate an advisory fraud signal and provide it to the requesting business client.

Nature and Scope of Fraud Signals

Fraud signals are advisory only. They do not automatically prevent, block, or decline an onboarding or transaction. The receiving business client retains full and sole responsibility for their verification and onboarding decision. A fraud signal from Dojah is an informational indicator, not a determination of fraud, identity theft, or wrongdoing.

Dojah does not make onboarding, account opening, transaction approval, transaction denial, account restriction, or other customer-facing decisions on behalf of its business clients based solely on fraud signals. Fraud signals are not intended to replace human review or the independent judgement of the business client. Business clients remain solely responsible for evaluating any fraud signal and for making their own decisions regarding their users.

Examples of anomalies that may generate a fraud signal include:

• The same biometric representation appearing in association with more than one identity number across separate verification events.
• Identity data appearing in circumstances inconsistent with prior verification records.
• Patterns indicative of identity document misuse or duplication.

A fraud signal does not constitute a determination that an individual has engaged in fraud, criminal activity, or any unlawful conduct. Anomalies may arise for legitimate reasons, including administrative errors, data entry inconsistencies at source institutions, or issues in underlying government databases that are outside Dojah's control. Business clients are advised to treat fraud signals as one input among several in their verification decision-making process.

What Data Is Stored

Dojah does not store raw biometric data (including facial images) or copies of identity documents for the purpose of fraud signal generation. The data retained for this purpose consists solely of:

• Irreversible cryptographic hash values, encrypted representations, or pseudonymised records derived from biometric data.
• Irreversible cryptographic hash values or pseudonymised identifiers derived from identity reference numbers.
• Metadata associated with verification events (such as timestamps and event identifiers), which does not include personally identifying information in readable form.

Where hashing is used, these values are computationally infeasible to reverse-engineer into the original data. Pseudonymised data is maintained with appropriate technical and organisational controls to prevent re-identification.

Legal Basis for This Processing

The processing of hashed biometric and identity data for fraud intelligence purposes is carried out on the following legal bases:

• Legitimate Interests: Dojah and its business clients have a legitimate interest in preventing identity fraud and protecting the integrity of financial services onboarding. We have conducted a balancing assessment and are satisfied that this interest is not overridden by the data subjects' rights, given the limited nature of the data retained (hashes only, not raw data) and the advisory-only nature of the resulting signals.
• Legal Obligation: Where fraud signal processing is required or supported by obligations under applicable AML, KYC, and financial crime prevention legislation.

Your Rights in Relation to Fraud Signals

You may exercise your data subject rights in relation to fraud signal processing as set out in Section 10. However, please note that in certain circumstances, particularly where processing is carried out to prevent or detect fraud or to comply with legal obligations, we may be unable to immediately fulfil erasure or restriction requests without compromising those purposes. We will communicate any such limitations to you clearly.

Important: Fraud signals generated by Dojah are informational indicators provided to our business clients to support their decision-making. They do not prevent you from completing an onboarding process and do not constitute a determination of fraud or identity misuse. If you believe a fraud signal has resulted in an adverse outcome, you should contact the business that carried out the verification, as they are the Data Controller responsible for the onboarding decision.

7. International Transfers

We may transfer your personal data to recipients located outside of Nigeria for purposes including the provision of our services, fulfilment of contractual obligations, or compliance with legal and regulatory requirements.

Where such transfers occur, we implement appropriate safeguards in accordance with the NDPA 2023, which may include:

• Standard contractual clauses approved by the Nigeria Data Protection Commission.
• Transfers to countries recognised as offering an adequate level of data protection.
• Your explicit consent where no other adequate safeguard is available.
• Binding corporate rules or other approved transfer mechanisms.

We ensure that any international transfer of personal data is made only where adequate protections are in place.

8. Recipients of Your Personal Data

We may share your personal data with the following categories of recipients, to the extent necessary and in accordance with applicable law:

Business Clients

Personal data processed through our identity verification and compliance services is shared with the business client that initiated the verification request. In these circumstances, the business client is the Data Controller and Dojah acts as Data Processor.

Fraud Intelligence Recipients

Where a fraud signal is generated as described in Section 6, the advisory signal (not raw personal data) is shared with the business client that submitted the identity verification request giving rise to the signal. No raw biometric data, identity documents, or personally identifying information in readable form is shared as part of a fraud signal.

Such signals do not constitute a determination that an individual has engaged in fraud, criminal activity, or any unlawful conduct. Business clients remain solely responsible for assessing fraud signals and making their own independent decisions regarding the provision of products or services to their users. Dojah implements appropriate technical and organisational measures to protect fraud intelligence data against unauthorised access, disclosure, alteration, or misuse.

Service Providers

We engage third-party service providers to support the delivery, security, and operation of our services. These may include cloud hosting providers, biometric and identity verification technology providers, software and infrastructure providers, payment processors, customer support providers, communications providers, and data analytics providers. These providers process personal data only on our documented instructions, for specified purposes, and in accordance with applicable data protection laws and contractual confidentiality obligations.

Identity Data Sources and Verification Partners

To provide identity verification and compliance services, we may obtain, verify, or validate personal data through authorised third-party data sources, official registries, government agencies, licensed data providers, financial institutions, telecommunications providers, and technology partners that facilitate secure access to such data sources. These organisations provide information or verification responses necessary to confirm the accuracy or validity of information submitted during identity verification processes. We access such information only where authorised by applicable law, contractual arrangements, or with the appropriate legal basis.

Regulatory and Law Enforcement Authorities

We may disclose personal data to regulatory authorities, government agencies, or law enforcement bodies where required by law, court order, or regulatory direction. This includes obligations to report certain incidents or to cooperate with lawful investigations.

Other Authorised Recipients

We may share your personal data with other authorised recipients — including legal advisers and professional consultants — as necessary to manage our business operations, resolve disputes, or comply with legal obligations, and only to the extent required for those purposes.

9. Data Retention

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable laws and regulations. Our retention periods are determined by:

• The original purpose of data collection.
• Legal and regulatory requirements specifying minimum or maximum retention periods.
• Business necessity and operational requirements.
• Requests from data subjects exercising their rights.

With respect to fraud intelligence data specifically, cryptographic hash values, pseudonymised verification records, biometric templates, security logs, fraud intelligence data, and audit records retained for fraud signal purposes are kept for a period proportional to the fraud prevention purpose they serve and are reviewed periodically. Such records may be retained for longer periods where necessary to detect and prevent fraud, investigate security incidents, comply with legal obligations, establish or defend legal claims, or protect the integrity, security, and reliability of our services. Records are deleted when they are no longer necessary for any of these purposes and when no legal obligation prevents deletion.

Throughout all retention periods, we implement robust security measures to protect your data against unauthorised access, disclosure, alteration, or destruction.

10. Your Rights as a Data Subject

Under the Nigerian Data Protection Act 2023, you have the following rights with respect to your personal data. To exercise any of these rights, please contact us using the details in Section 16.

Right of Access

You have the right to request confirmation of whether we hold personal data about you and, if so, to receive a copy of that data along with information about how it is processed.

Right to Rectification

You have the right to request the correction of inaccurate or incomplete personal data we hold about you. We will take reasonable steps to verify the accuracy of any correction request before acting on it.

Right to Erasure

You have the right to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent and no other legal basis applies, or where the processing is unlawful. Please note that we may be unable to fulfil an erasure request where retention is required by law or is necessary for fraud prevention purposes, and we will explain any such limitation when responding to your request.

Right to Restriction or Objection

You have the right to request the restriction of processing of your personal data in certain circumstances, including where you contest the accuracy of the data or where the processing is unlawful but you prefer restriction to deletion. You also have the right to object to processing based on legitimate interests, including processing for fraud intelligence purposes, where you have grounds relating to your particular situation.

Right to Data Portability

Where processing is based on your consent or on a contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to request that it be transmitted to another data controller where technically feasible.

Right to Withdraw Consent

Where we rely on consent as a legal basis for processing, you may withdraw that consent at any time. Withdrawal will not affect the lawfulness of any processing carried out before the withdrawal.

11. Security

We are committed to protecting your personal data against unauthorised access, loss, misuse, alteration, or destruction. We implement technical and organisational security measures proportionate to the nature and sensitivity of the data we process, including:

• Encryption of data in transit and at rest.
• Access controls limiting data access to authorised personnel only.
• Regular security assessments and penetration testing of our infrastructure.
• Incident response procedures for the detection and management of security breaches.
• Contractual obligations requiring third-party providers to maintain equivalent security standards.

Authorised users of our information systems are required to exercise appropriate care in the handling of personal and confidential data. Copying, transmitting, or storing confidential data must be done in accordance with our internal security policies and only where authorised.

12. Marketing

We may use your personal data to send you marketing communications, promotional offers, and other materials about our products and services that may be of interest to you. Marketing communications may be delivered via email, SMS, or other channels.

You have the right to opt out of receiving marketing communications at any time by following the unsubscribe instructions included in any marketing message or by contacting us directly. Opting out of marketing communications will not affect the receipt of transactional or service-related communications, such as account notifications or updates to our terms and policies.

13. Cookies

We use cookies and similar tracking technologies to enhance your experience on our website and to support the functionality of our services. Cookies may be placed by us or by third-party providers such as analytics or advertising platforms.

We use both session cookies (which expire when you close your browser) and persistent cookies (which remain on your device for a defined period). You can manage your cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of our website.

For full details of the cookies we use and how to manage them, please see our Cookie Notice.

14. Children and Minors

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you are a parent or guardian and believe your child has provided us with personal data without your consent, please contact us immediately at compliance@dojah.io. We will promptly delete any such data from our records.

If you are under 18, please do not use our services or submit personal data to us.

15. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. When we make material changes, we will update the “Last Updated” date at the top of this Policy. We encourage you to review this Policy periodically.

Continued use of our services following notification of an update constitutes acceptance of the revised Policy.

16. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact our Compliance Officer:

17. Definitions

Biometric Data: Personal data resulting from specific technical processing relating to the physical, physiological, or behavioural characteristics of an individual, including facial images, facial recognition templates, liveness detection results, and other biometric identifiers that may be used to uniquely identify or verify an individual.

Biometric Hash: An irreversible cryptographic representation derived from biometric data. A biometric hash cannot be used to reconstruct the original biometric data and is used by Dojah solely for the purpose of fraud signal generation.

Cookies: Small data files stored on a user's device when they visit a website. Cookies help personalise the browsing experience, remember user preferences, and support analytics.

Data Controller: A person or entity that determines the purposes and means of processing personal data.

Data Processor: A person or entity that processes personal data on behalf of a Data Controller.

Data Protection Legislation: The Nigerian Data Protection Act 2023 (NDPA) and any subsidiary regulations, guidelines, or orders issued thereunder by the Nigeria Data Protection Commission (NDPC), together with any other applicable data protection legislation in Nigeria.

Data Subject: A living, identified, or identifiable natural person to whom personal data relates.

Fraud Signal: An advisory indicator generated by Dojah's fraud intelligence service and provided to a business client indicating a potential identity anomaly detected during an identity verification event. A fraud signal is informational only and does not constitute a determination of fraud, unlawful conduct, or a decision to decline any transaction or onboarding.

Identity Hash: An irreversible cryptographic representation derived from an identity reference number (such as a Bank Verification Number). An identity hash cannot be used to reconstruct the original number.

NDPA: The Nigerian Data Protection Act 2023.

NDPC: The Nigeria Data Protection Commission, the supervisory authority for data protection in Nigeria.

Personal Data: Any information relating to an identified or identifiable living natural person, including but not limited to name, date of birth, address, email address, phone number, financial information, government-issued identification numbers, biometric data, IP address, and device identifiers.

Sensitive Personal Data: A special category of personal data attracting heightened protection under the NDPA, including data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, or data concerning sexual orientation.

Services: The products, features, and functionalities provided by Dojah Technologies to its users and business clients, including identity verification, KYC, KYB, AML screening, transaction monitoring, and fraud prevention services, accessible through our website, APIs, and other platforms.

User: An individual who interacts with our services, including visitors to our website, users of our applications, and individuals whose data is submitted for verification by our business clients.