Privacy Notice

1. About This Notice

This Privacy Notice explains how SERIALSETS LIMITED(“we”, “us”, “our”) collects, uses, shares, and protects the personal data of users of the JUSTRA platform (app.justra.ng) and visitors to our website (justra.ng). We are committed to processing your personal data lawfully, fairly, and transparently in accordance with the Nigeria Data Protection Act, 2023 (“NDPA”) and its implementing regulations.

Please read this Notice carefully before using JUSTRA. By creating an account, you confirm you have read and understood how we process your personal data.

2. Who We Are

SERIALSETS LIMITED is incorporated under the Companies and Allied Matters Act 2020 (RC 9476624) and is the data controller responsible for the personal data described in this Notice.

3. Personal Data We Collect

Account and Identity Data

Your full name, email address, phone number, and password (stored as a secure, irreversible hash). Collected when you register.

Business Profile and Compliance Data

Business name, business type (sole trader, partnership, limited company), state, LGA, sector, trade type, Tax Identification Number (TIN), CAC registration number, number of employees, and revenue range. Used to generate your compliance score and sector-specific action plan.

Invoice and Financial Data

Invoice and receipt details including your clients' names, email addresses, phone numbers, postal addresses, TINs, service descriptions, quantities, unit prices, VAT amounts, and withholding tax deductions. Receipt and payment records linked to invoices you generate on the platform.

Document Vault Data

Copies of compliance documents you choose to upload: CAC Certificate of Registration or Incorporation, Tax Clearance Certificate, NSITF Certificate, NHF Letter of Confirmation, PENCOM clearance, and other regulatory documents. You control what you upload and may delete documents at any time.

Bank Statement Data (TaxSense Feature)

Where you use the TaxSense feature, you upload a bank statement in CSV format. We process transaction descriptions, dates, and amounts to generate a tax risk analysis. We do not access your bank account directly — all data is provided manually by you. TaxSense uploads are retained for 90 days and then permanently deleted.

Cooperative and Team Data

If you manage a cooperative on JUSTRA, we process member names, phone numbers, email addresses, roles, and contribution records. If you invite team members to your workspace, we process their names and email addresses in order to send and process the invitation.

Payment Data

Subscription plan information and payment reference numbers associated with your Paystack transactions. Card numbers, bank account details, and payment credentials are handled exclusively by Paystack Payments Limited (a CBN-licensed payment processor) and are never stored by JUSTRA.

Usage and Technical Data

IP address, browser type, device type, operating system, pages visited, session timestamps, and referrer URL, collected automatically for security, fraud prevention, and platform improvement.

4. How We Use Your Personal Data

We process your personal data for the following purposes, each on the stated lawful basis under the NDPA 2023:

5. Who We Share Your Data With

We share personal data only as described below. We never sell your personal data.

Service Providers (Data Processors)

We engage the following processors who access personal data solely to provide services to us, under binding Data Processing Agreements:

Regulatory and Legal Disclosures

We may disclose personal data to:

• Nigerian regulatory authorities (NRS, CAC, NDPC, CBN) where required by law or court order;
• law enforcement agencies acting under lawful authority;
• a purchaser or successor in the event of a business transfer or restructuring, subject to equivalent privacy protections and prior notice to you.

6. International Transfers

Some of our service providers operate outside Nigeria. Where personal data is transferred outside Nigeria, we ensure appropriate safeguards are in place in accordance with Part V of the NDPA 2023, including standard contractual clauses or reliance on an adequacy determination by the NDPC. We do not transfer personal data to countries without adequate protection without these safeguards in place.

You may request details of the specific transfer mechanisms we use by contacting privacy@justra.ng.

7. How Long We Keep Your Data

After each retention period, data is securely deleted or irreversibly anonymised.

8. Your Rights Under the NDPA 2023

The Nigeria Data Protection Act 2023 grants you the following rights:

• Right of Access (s.34): Request a copy of all personal data we hold about you.
• Right to Rectification (s.35): Request correction of inaccurate or incomplete data.
• Right to Erasure (s.36): Request deletion of your data where we have no continuing lawful basis to hold it.
• Right to Object (s.37): Object to processing based on legitimate interests, including direct marketing — we will always stop direct marketing immediately on request.
• Right to Data Portability (s.38): Receive your personal data in a structured, machine-readable format (CSV or JSON).
• Right to Restriction (s.39): Request that we pause processing of your data in certain circumstances.
• Right to Withdraw Consent (s.26): Where processing is based on consent (e.g. marketing), withdraw at any time without affecting the lawfulness of prior processing.
• Right re: Automated Decisions (s.40): Not to be subject to solely automated decisions that produce significant legal effects.

To exercise any of these rights, email privacy@justra.ngwith the subject line “Data Subject Request”. We will respond within 30 days and may need to verify your identity before processing your request. There is no charge for exercising your rights.

9. Cookies

JUSTRA uses only essential session cookies required for authentication and platform security (e.g. keeping you logged in). We do not use tracking cookies, advertising cookies, or third-party analytics trackers. You cannot opt out of essential cookies without losing access to your account, but no non-essential cookies are set without your consent.

10. Children's Data

JUSTRA is a business compliance platform intended for adults (18+) operating businesses. We do not knowingly collect personal data from persons under 18. If you believe a minor has created an account, please contact privacy@justra.ng immediately and we will delete the account.

11. Changes to This Notice

We may update this Notice from time to time to reflect changes in our practices or applicable law. We will notify you by email and display a prominent notice within the platform at least 14 days before material changes take effect. The version history below is maintained for your reference.

12. Contact and Complaints