Privacy Policy

1. Introduction

Opsuite Technologies Ltd (“Company”, “we”, “us”, or “our”) is committed to protecting the privacy and security of personal data. This Privacy Policy explains how we collect, use, store, share, and protect personal information when you use the Opsuite platform (“Service”).

This Privacy Policy applies to:

• (a) Business owners and administrators who register and manage Tenant accounts (“Subscribers”);
• (b) Authorised Users (employees, cashiers, staff) who access the Service through a Tenant account;
• (c) Individuals whose personal data is processed through the Service by Subscribers, including customers, employees, and visitors (“Data Subjects”);
• (d) Visitors to our website at opsuite.io.

This Privacy Policy should be read together with our Terms of Service. By using the Service, you acknowledge that you have read and understood this Privacy Policy.

2. Legal Framework

This Privacy Policy is designed to comply with the following regulations:

2.1 Nigeria Data Protection Regulation (NDPR) 2019 — Issued by the National Information Technology Development Agency (NITDA), the NDPR governs the processing of personal data in Nigeria and applies to all transactions intended for the processing of personal data of natural persons residing in Nigeria.

2.2 Nigeria Data Protection Act (NDPA) 2023 — The comprehensive data protection legislation for Nigeria, establishing the Nigeria Data Protection Commission (NDPC) as the supervisory authority and codifying data protection principles and obligations.

2.3 General Data Protection Regulation (GDPR) — Where our Subscribers or their Data Subjects are located in the European Economic Area (EEA), we also consider the requirements of the GDPR.

We are committed to the following data protection principles:

• Lawfulness, fairness, and transparency — Processing data lawfully and openly
• Purpose limitation — Collecting data for specified, explicit, and legitimate purposes
• Data minimisation — Collecting only data that is necessary
• Accuracy — Keeping personal data accurate and up to date
• Storage limitation — Retaining data no longer than necessary
• Integrity and confidentiality — Processing data securely
• Accountability — Demonstrating compliance with these principles

3. Data Controller and Data Processor Roles

3.1 Opsuite as Data Controller. We act as the Data Controller for:

• (a) Subscriber account information (business name, contact details, billing information);
• (b) Authorised User login credentials and access data;
• (c) Website visitor data (cookies, analytics);
• (d) Platform usage data and system logs;
• (e) Payment and subscription data;
• (f) Communications between you and our support team.

3.2 Opsuite as Data Processor. We act as the Data Processor for:

• (a) Customer data entered by Subscribers into the CRM, POS, and invoicing modules;
• (b) Employee data entered by Subscribers into the staff, attendance, and payroll modules;
• (c) Visitor data entered through the Visitor Management module;
• (d) Biometric data (fingerprint and facial recognition templates) collected through attendance devices;
• (e) Marketing contact data managed through the Communications module;
• (f) Financial data entered into the accounting module.

3.3 Subscriber Responsibilities. As a Subscriber using the Service to process personal data of your customers, employees, and visitors, YOU are the Data Controller for that data. You are responsible for:

• (a) Having a lawful basis for processing;
• (b) Providing privacy notices to your Data Subjects;
• (c) Obtaining necessary consents (especially for biometric data and marketing);
• (d) Responding to Data Subject rights requests;
• (e) Conducting Data Protection Impact Assessments where required;
• (f) Reporting data breaches to the relevant supervisory authority as required by law.

4. Personal Data We Collect

4.1 Account Registration Data (Data Controller)

When you register as a Subscriber, we collect:

• Business name and type
• Contact email address
• Phone number
• Business address
• Website URL (optional)
• Selected subdomain
• Subscription plan selection

4.2 User Account Data (Data Controller)

For Authorised Users, we collect:

• Username and email address
• First name and last name
• Phone number
• Password (stored in hashed form using bcrypt encryption)
• PIN (stored in hashed form, for kiosk access)
• Employee code (for kiosk login)
• Role and permission settings
• Last login timestamp and IP address

4.3 Payment Data (Data Controller)

When you make payments, the following is collected through Paystack:

• Payment reference numbers
• Card details (only last 4 digits and card brand are stored by us — full card details are handled exclusively by Paystack)
• Payment history and subscription status
• Paystack customer and subscription codes

4.4 Customer Data (Data Processor — entered by Subscriber)

Subscribers may enter the following about their customers:

• Name, email, phone, and address
• Date of birth (for birthday rewards)
• Gender
• Purchase history and spending totals
• Loyalty points and reward history
• Customer segmentation and tags
• Communication preferences and marketing consent
• Referral source
• Notes and special preferences

4.5 Employee/Staff Data (Data Processor — entered by Subscriber)

Subscribers may enter the following about their employees:

• Employee ID, name, email, and phone
• Date of employment and employment type
• Department and position
• Work schedule and shift assignments
• Bank account details (account name, number, and bank code) for payroll
• Salary information (base salary, allowances, bonuses)
• Tax identification details (TIN, NIN, RSA PIN, PFA details, NHF number, NHIS number)
• Biometric data (fingerprint templates, facial recognition templates)
• Attendance records (clock-in/out times, lateness, overtime)
• Leave records and holiday entitlements
• Kiosk access PIN
• Commission rates and structures

4.6 Visitor Data (Data Processor — entered by Subscriber or self-service)

Through the Visitor Management module:

• First name, last name, email, and phone
• Address and company name
• Gender
• Photograph (captured at check-in)
• Identification document type and number (national ID, passport, driver's licence)
• Vehicle registration number
• Items brought onto premises
• Purpose of visit
• Host/department assignment
• Check-in and check-out timestamps
• QR code and badge data

4.7 Financial Data (Data Processor — entered by Subscriber)

Through accounting and POS modules:

• Invoice and quotation details (amounts, line items, payment terms)
• Customer and supplier TIN (Tax Identification Numbers)
• Expense records
• Transaction records (items, quantities, prices, payment methods)
• Commission calculations
• Journal entries and account ledger data

4.8 Marketing Data (Data Processor — entered by Subscriber)

Through the Communications & Marketing module:

• Contact names, emails, and phone numbers
• Tags, source tracking, and segmentation
• Subscription/unsubscription status
• Email engagement data (opens, clicks)
• Campaign performance metrics

4.9 Device and Biometric Data (Data Processor)

Through the attendance device management:

• Device serial numbers and configuration
• Biometric templates (fingerprint data, facial recognition data)
• Device pairing and synchronisation data
• Work code assignments

4.10 Signage Data (Data Processor — entered by Subscriber)

Through the Digital Signage module:

• Media files (images, videos, audio)
• Display configurations and playlists
• App content (team member profiles, menus, directories)
• Scheduling data
• Display device pairing information

4.11 Platform Usage Data (Data Controller)

We automatically collect:

• IP addresses
• Browser type and version
• Device information
• Pages accessed and features used
• Login timestamps
• Audit log entries (actions performed, resources affected)
• Error logs

5. How We Use Personal Data

5.1 As Data Controller, we use personal data to:

• Provide the Service — Create and manage your account, authenticate users, and deliver the features of your Subscription Plan.
• Process payments — Manage subscriptions, process recurring payments through Paystack, and handle billing inquiries.
• Communicate with you — Send service-related notifications, respond to support requests, and inform you of important changes to the Service or Terms.
• Ensure security — Detect and prevent fraud, unauthorised access, and other security threats; manage account lockouts; maintain audit logs.
• Improve the Service — Analyse usage patterns to improve features, fix issues, and develop new functionality.
• Comply with legal obligations — Maintain records as required by Nigerian law, respond to lawful requests from authorities, and comply with tax and regulatory requirements.

5.2 As Data Processor, we process personal data to:

• Store and host data — Securely store all data entered by Subscribers on our infrastructure.
• Enable Service features — Process data as necessary to deliver the features of the Service, including generating invoices, quotations, and financial reports; processing payroll calculations; managing attendance records and biometric verification; delivering email campaigns and notifications; operating visitor check-in and management; displaying digital signage content; and computing analytics and insights (RFM scores, customer health, CLV predictions).
• Send transactional emails — Deliver email notifications on behalf of Subscribers (invoices, attendance alerts, visitor approvals, payroll notifications, birthday rewards).
• Generate automated insights — Calculate analytics such as customer segmentation, churn risk, and sales trends, which are provided exclusively to the relevant Subscriber.

5.3 Legal Bases for Processing (NDPR/NDPA)

We process personal data on the following legal bases:

• Consent — Where you have given explicit consent (e.g., marketing communications, biometric data collection)
• Contract performance — Where processing is necessary to fulfil our contractual obligations under the Terms of Service
• Legitimate interest — Where processing is necessary for our legitimate business interests (e.g., security, fraud prevention, service improvement), provided these interests do not override your rights
• Legal obligation — Where processing is required by applicable law

7. Data Sharing and Third-Party Services

7.1 We Do NOT Sell Personal Data. We do not sell, rent, or trade personal data to third parties for marketing or any other purposes.

7.2 Third-Party Service Providers. We share personal data with the following categories of service providers who assist us in operating the Service:

7.3 Biometric Devices — ZKTeco

• Data exchanged: Biometric templates (fingerprint, facial recognition)
• Purpose: Synchronising biometric data between the Service and attendance hardware devices
• Data remains within the Subscriber's device network and our servers

7.4 Legal Disclosures. We may disclose personal data if required to do so by law, court order, or governmental authority, or if we believe in good faith that such disclosure is necessary to: (a) comply with a legal obligation; (b) protect and defend our rights or property; (c) prevent fraud or address security issues; (d) protect the personal safety of users or the public.

7.5 Business Transfers. In the event of a merger, acquisition, reorganisation, or sale of assets, personal data may be transferred to the acquiring entity, subject to the same privacy protections described in this policy. We will notify Subscribers before any such transfer.

8. Data Security

We implement robust technical and organisational measures to protect personal data:

8.1 Authentication and Access Control

• Passwords are hashed using bcrypt with 12 rounds of salting
• PINs are stored in hashed form
• HTTP-only session cookies (credentials not stored in browser localStorage)
• CSRF (Cross-Site Request Forgery) token protection
• Rate limiting on authentication endpoints (5 attempts per 15 minutes)
• Account lockout after 5 failed login attempts (15-minute lockout period)
• Two-factor authentication (2FA) available for administrator accounts
• Role-based access control with granular permissions per module

8.2 Data Isolation

• Strict multi-tenant data isolation at the database query level
• Tenant-specific collection prefixing prevents cross-tenant data access
• Compound database indexes enforce tenant-scoped queries
• Each Subscriber's data is logically separated and inaccessible to other Subscribers

8.3 Network Security

• HTTPS/TLS encryption for all data in transit
• Strict CORS (Cross-Origin Resource Sharing) policies in production
• Security headers implemented via Helmet.js
• IP whitelisting for super administrator access
• gzip compression for data transmission

8.4 Input Validation and Protection

• Comprehensive input sanitisation to prevent injection attacks
• Parameterised database queries to prevent NoSQL injection
• reCAPTCHA protection where applicable
• Content Security Policy headers

8.5 Monitoring and Logging

• Comprehensive audit logging of all user actions
• Security event tracking (login attempts, permission changes)
• Automated alerts for suspicious activity

8.6 Data Breach Response. In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will: (a) notify affected Subscribers without undue delay and in any event within 72 hours of becoming aware of the breach; (b) provide details of the nature of the breach, data affected, likely consequences, and measures taken; (c) cooperate with Subscribers in meeting their own breach notification obligations to supervisory authorities and Data Subjects; (d) document all breaches and remedial actions taken.

9. Data Retention

We retain personal data for the following periods:

9.1 Post-Termination. When a subscription ends, all End User Data is retained for 90 days to allow data export. After this period, data is permanently deleted from our active systems. Backup copies may persist for up to an additional 30 days before being overwritten.

9.2 Legal Holds. Data may be retained beyond the stated periods if required by law, court order, or ongoing legal proceedings.

9.3 Subscriber Configuration. Subscribers can configure certain retention settings within the Service (e.g., visitor data retention). We recommend setting retention periods in accordance with applicable data protection laws and your own privacy policies.

10. Your Rights

10.1 Rights of Subscribers and Authorised Users

Under the NDPR, NDPA, and applicable data protection laws, you have the following rights regarding personal data for which we are the Data Controller:

• (a) Right of Access — You may request a copy of the personal data we hold about you.
• (b) Right to Rectification — You may request correction of inaccurate or incomplete personal data.
• (c) Right to Erasure (Right to be Forgotten) — You may request deletion of your personal data, subject to legal retention requirements.
• (d) Right to Restrict Processing — You may request that we limit the processing of your personal data in certain circumstances.
• (e) Right to Data Portability — You may request your personal data in a structured, commonly used, machine-readable format.
• (f) Right to Object — You may object to the processing of your personal data based on legitimate interests.
• (g) Right to Withdraw Consent — Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

10.2 Exercising Your Rights. To exercise any of these rights, please contact us at support@opsuite.io. We will respond to your request within 30 days. We may request verification of your identity before processing your request.

10.3 Rights of Data Subjects (Customers, Employees, Visitors)

If your personal data has been entered into the Service by a Subscriber (e.g., you are a customer, employee, or visitor of a business using Opsuite), your primary point of contact for exercising your data protection rights is that Subscriber (the Data Controller). The Subscriber is responsible for:

• Responding to your access, correction, and deletion requests;
• Providing you with information about how your data is processed;
• Honouring your right to object or withdraw consent.

If you are unable to reach the Subscriber or believe your rights are not being respected, you may contact us at support@opsuite.io and we will make reasonable efforts to assist.

10.4 Right to Lodge a Complaint. You have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) or the relevant supervisory authority in your jurisdiction if you believe your data protection rights have been violated.

11. Cookies and Session Management

11.1 Session Cookies. The Service uses HTTP-only session cookies to maintain your authenticated session. These cookies are essential for the operation of the Service and cannot be disabled while using the platform.

11.2 CSRF Tokens. We use CSRF (Cross-Site Request Forgery) tokens stored in cookies to protect against cross-site attacks. These are security-essential cookies.

11.3 Local Storage. The Service may use browser local storage for:

• Kiosk session data (employee code, session state)
• UI preferences
• Temporary payment references during the registration process

11.4 Analytics. We may use analytics tools to understand how the Service is used. Any analytics data is processed in aggregate form and does not identify individual users.

11.5 Third-Party Cookies. The Service does not embed third-party advertising cookies. Third-party cookies may be set by our payment processor (Paystack) during the payment flow.

13. International Data Transfers

13.1 Data Location. Our primary servers and databases are hosted in secure data centres. Data may be processed in jurisdictions outside Nigeria where our infrastructure providers operate.

13.2 Safeguards. Where personal data is transferred to countries that do not provide an adequate level of data protection, we implement appropriate safeguards, including:

• (a) Contractual clauses with our service providers that impose data protection obligations equivalent to those required by Nigerian law;
• (b) Ensuring that service providers maintain appropriate security certifications and compliance programmes;
• (c) Limiting data transfers to what is necessary for the provision of the Service.

13.3 Paystack. Payment data processed by Paystack is handled in accordance with Paystack's data processing practices and PCI DSS compliance standards.

13.4 Zoho Mail. Email delivery through Zoho Mail may involve processing of email content on Zoho's servers. Zoho maintains data protection standards and certifications applicable to their services.

14. Children's Privacy

The Service is designed for business use and is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children.

If we become aware that we have collected personal data from a child under 18, we will take steps to delete such data promptly.

If you are a Subscriber and become aware that a child has provided personal data through the Service (e.g., as a visitor or customer), please contact us immediately so that we can take appropriate action.

15. Marketing Communications

15.1 From Opsuite to Subscribers. We may send you service-related communications, including product updates, billing notifications, and important announcements. These are transactional communications necessary for the provision of the Service.

15.2 Marketing from Opsuite. We may occasionally send marketing communications about new features, offers, or related products. You can opt out of marketing emails at any time by clicking the unsubscribe link or contacting support@opsuite.io.

15.3 Marketing by Subscribers. When Subscribers use the Communications & Marketing module to send emails to their contacts:

• The Subscriber is the Data Controller and is responsible for consent management;
• We process the email delivery as a Data Processor;
• Subscriber emails include unsubscribe functionality;
• We track opens and clicks on behalf of the Subscriber for campaign analytics;
• We do not use marketing contact data for our own purposes.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law.

For material changes, we will provide notice through: (a) email notification to Subscriber contact addresses; (b) in-app notification upon login; (c) updated “Last Updated” date at the top of this policy.

Material changes will be communicated at least 30 days before they take effect. Your continued use of the Service after the effective date of changes constitutes acceptance of the updated Privacy Policy.

We encourage you to periodically review this Privacy Policy to stay informed about how we protect your data.

17. Data Protection Contact

For any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact: