Privacy Policy

• Account data: full name, email address, telephone/WhatsApp number, password (stored only as a secure hash), profile photo and account type (individual or company).
• Company data: company name, address, industry and contact person, where you register on behalf of an organisation.
• Service data: service requests, site locations, descriptions, preferred dates, attachments, service records, progress notes, reports and feedback ratings.
• Facility and asset data: site names and addresses, asset registers (equipment name, category, manufacturer, model, serial number, location detail, install and warranty dates, status and notes), QR/asset codes and the service history linked to each asset.
• Service completion and safety data: HSE checklist responses, work summaries, customer sign-off name, note and timestamp, and the responsible Operations Admin review outcomes.
• Billing data: quotations, invoices and line items, material approvals, and payment records (amount, method, reference, payment date and notes). We record payments made to our bank account; we do not collect or store card or bank login details.
• Technician data: specialisation, expertise, service areas, certifications, years of experience, home address and availability, where you register as a technician.
• Technical data: log data, device and browser information, and security events generated when you use the platform.

• To create and administer your account and verify your email address.
• To receive, review, approve and execute service requests.
• To assign technicians, schedule work and share progress updates and reports.
• To maintain your asset register and site records, and to keep a maintenance history for each asset.
• To document health, safety and environment (HSE) checks, obtain customer sign-off and carry out Operations Admin review on completed work.
• To prepare quotations and invoices, obtain material-cost approvals, and record payments received against your account statement.
• To send transactional notifications (in-app and email) about your service requests.
• To provide customer support, resolve disputes and improve service quality.
• To keep audit trails and meet legal, tax and regulatory obligations.

We do not sell your personal data, and we do not use it for third-party advertising.

We rely on: performance of a contract (delivering requested services), your consent (where you provide it, such as marketing or optional details), our legitimate interests (platform security, service improvement) and compliance with legal obligations.

Nafric Intertrade Limited is the data controller for personal data processed through Nafric Connect. This includes customer account and service data, and technician account, vetting, identification, location and service data collected through the platform.

Technician personal data. We are the controller of the personal data technicians provide to us — including name, contact details, gender, home address, specialisation and certifications, means of identification (such as National Identity Number or international passport number), live location while on an assigned service, service records and payment details. We process it to verify identity and eligibility, approve accounts, assign and dispatch services, keep customers informed, support safety and dispute resolution, settle fees, and meet legal, tax and regulatory obligations. Identification data is used only for vetting and fraud prevention and is visible only to Nafric administrators. Location data is collected only while a technician has location sharing enabled in connection with an assigned service, and may be switched off at any time.

Technicians are independent service providers, not our employees. Where a technician receives customer contact details or site information in order to carry out a service, the technician acts as our processor for that service and must use the data only to deliver it, keep it confidential, and delete or return it afterwards. Where a technician independently retains or reuses customer data for their own purposes, they do so as a separate controller and are responsible for their own compliance under the NDPA. These obligations are set out in our Independent Contractor Terms.

Where you register on behalf of a company, that company is the controller of its own employee and site records and we act as its processor for those records, in addition to being controller of the platform account data.

Data protection queries, subject access requests, correction and deletion requests, and breach notifications should be directed to us at info@nafrictrade.com. We handle these centrally and instruct technicians and other processors as needed.

• You — your own profile, requests and reports.
• Your company colleagues — where records belong to the company account you are linked to.
• Assigned technicians — only the service details and contact information needed to carry out your request.
• Nafric administrators — for operational oversight, approvals and support.

Access is enforced technically through row-level security rules on our database, not merely by policy.

We use trusted processors to host the platform, store files and deliver email notifications. These providers act on our instructions under confidentiality obligations. Some may process data outside Nigeria; where this happens we take reasonable steps to ensure an adequate level of protection.

• Encrypted transport (HTTPS) across the app and website.
• Passwords stored as salted hashes; we never see your password.
• Private storage buckets for attachments and reports, served only via time-limited signed links.
• Role-based access control for customers, technicians and administrators.
• Immutable audit logs for service status changes and request decisions.

No system is perfectly secure. Keep your password confidential and notify us immediately if you suspect unauthorised access.

We keep account and service records for as long as your account is active and thereafter for the period required for legal, accounting, warranty and dispute-resolution purposes. When no longer required, records are deleted or anonymised.

Asset registers, completion and HSE records, sign-offs, invoices and payment records are retained for the life of the asset or contract and for the statutory accounting and tax retention period thereafter, because they evidence work carried out, warranty positions and sums paid.

Subject to law, you may request access to, correction of, or deletion of your personal data; object to or restrict certain processing; withdraw consent; request a copy of your data; and lodge a complaint with the Nigeria Data Protection Commission. You can update most details directly on your profile page, or contact us using the details below.

We use strictly necessary cookies and browser storage to keep you signed in and to remember basic preferences. We do not use advertising or cross-site tracking cookies.

Nafric Connect is intended for business use and is not directed at persons under 18. We do not knowingly collect data from children.

We may update this policy from time to time. Material changes will be communicated in the app or by email, and the "last updated" date above will change.