Privacy Policy

This Privacy Policy describes how SimpliP2P ("Company", "we", "us", or "our") collects, uses, discloses, stores, and protects personal data through the SimpliP2P platform ("Platform").

We are committed to protecting personal data in accordance with the Nigeria Data Protection Act (NDPA), 2023, applicable regulations, and other relevant data protection laws.

Depending on the circumstances of processing, we may act as:

• A Data Controller where we determine the purposes and means of processing personal data; and
• A Data Processor where we process personal data on behalf of our customers.

By accessing or using the Platform, you acknowledge that your personal data may be processed as described in this Privacy Policy.

We may collect and process the following categories of personal data:

Identity and Contact Information

• Full name
• Email address
• Telephone number
• Job title
• Department
• Employer or organization name

Vendor and Supplier Information

• Vendor representative details
• Business registration information
• Tax identification information
• Supplier contact details
• Contractual information

Procurement and Transaction Information

• Purchase requisitions
• Purchase orders
• Vendor submissions
• Bid and tender information
• Invoice information
• Payment-related information
• Approval workflow records

Technical Information

• IP address
• Browser type and version
• Device information
• Operating system
• Login information
• Session information
• Location information where permitted by law

System Usage Information

• User activity logs
• Audit trails
• Access records
• Security logs

We collect personal data through:

• Information submitted directly by users
• Customer organizations using the Platform
• Supplier and vendor onboarding activities
• Automated technologies such as cookies and analytics tools
• Technical logs generated through use of the Platform
• Communications with our support team

We process personal data for the following purposes:

• Providing and administering the Platform
• Procurement management activities
• Vendor onboarding and management
• Contract administration
• Invoice and payment processing
• User authentication and access control
• Provision of customer support
• Service improvement and enhancement
• Fraud prevention and detection
• System monitoring and security management
• Regulatory compliance and reporting
• Business continuity and disaster recovery
• Internal audits and risk management activities

We process personal data based on one or more of the following lawful bases:

• Consent: Where you have provided consent for a specific processing activity.
• Contractual Necessity: Where processing is necessary for entering into or performing a contract.
• Legal Obligation: Where processing is necessary to comply with applicable legal or regulatory obligations.
• Legitimate Interest: Where processing is necessary for our legitimate business interests, including information security, fraud prevention, service improvement, business administration, risk management, and audit and compliance monitoring.

Such processing is carried out only where our legitimate interests do not override the rights and freedoms of data subjects.

We do not sell personal data.

We may disclose personal data to:

• Cloud hosting providers
• Payment service providers
• IT infrastructure providers
• Identity verification providers
• Professional advisers
• Auditors
• Regulators and law enforcement agencies
• Service providers supporting Platform operations

All third-party service providers are required to implement appropriate safeguards and process personal data only for authorized purposes.

Where personal data is transferred outside Nigeria, we shall ensure that such transfer is conducted in accordance with the requirements of the Nigeria Data Protection Act and that appropriate safeguards are implemented to protect the personal data.

These safeguards may include:

• Contractual data protection clauses
• Regulatory approvals where required
• Adequacy determinations
• Other legally recognized transfer mechanisms

Where customer organizations upload or submit personal data to the Platform, we may act as a Data Processor and process such personal data solely on documented instructions from the customer.

In such circumstances:

• The customer remains the Data Controller.
• We implement appropriate technical and organizational measures to protect personal data.
• We will not use such personal data for our own independent purposes except where otherwise permitted by law.

We maintain appropriate technical and organizational safeguards designed to protect personal data from unauthorized access, alteration, disclosure, loss, or destruction.

Such measures include:

• Encryption of data in transit and at rest where applicable
• Multi-factor authentication
• Role-based access controls
• Network security monitoring
• Audit logging
• Secure backup procedures
• Vulnerability assessments
• Periodic security reviews
• Employee confidentiality obligations

Despite our efforts, no method of transmission or storage is completely secure, and absolute security cannot be guaranteed.

We maintain procedures for identifying, reporting, investigating, and responding to personal data breaches.

Where required by applicable law, we will notify:

• The Nigeria Data Protection Commission (NDPC); and/or
• Affected data subjects

within the timelines prescribed by law.

We retain personal data only for as long as necessary for the purposes for which it was collected, including:

• Contract performance
• Procurement activities
• Legal and regulatory compliance
• Audit requirements
• Resolution of disputes
• Enforcement of contractual rights

Upon expiration of the applicable retention period, personal data will be securely deleted, anonymized, or otherwise disposed of in accordance with our records management procedures.

Subject to applicable law, data subjects may exercise the following rights:

• Right to access personal data
• Right to correct inaccurate personal data
• Right to erase personal data
• Right to withdraw consent
• Right to object to processing
• Right to restrict processing
• Right to data portability
• Right to request information about processing activities
• Right not to be subject to unlawful automated decision-making
• Right to lodge a complaint with the Nigeria Data Protection Commission (NDPC)

Requests relating to these rights may be submitted using the contact details provided below.

The Platform may utilize automated tools for procurement workflows, analytics, risk scoring, fraud monitoring, vendor evaluation, and related operational functions.

Where significant decisions are made using automated processing, appropriate oversight and safeguards shall be applied in accordance with applicable law.

The Platform is intended for business and professional use only and is not designed for persons under the age of 18 years.

We do not knowingly collect personal data relating to children.

We may update this Privacy Policy from time to time to reflect legal, regulatory, operational, or technological changes.

Material updates will be communicated through appropriate channels.

For privacy enquiries, complaints, or requests relating to your personal data, please reach out using the contact details below.

You may also lodge complaints with the Nigeria Data Protection Commission (NDPC) at info@ndpc.gov.ng.