Privacy Policy for Vetify Portal

Under Nigerian data protection law, Vetify operates primarily as a Data Processor for the services provided to our financial institution clients.

• Financiers as Data Controllers — Regulated and unregulated financiers who use Vetify to structure Murabaha, Ijarah, and Istisna contracts act as the Data Controllers. They determine the legal basis, purpose, and lifecycle of your data. Vetify never lends, prices, or decides a financing outcome.
• Vetify as a Data Controller — Vetify acts as a Data Controller only regarding the business-to-business (B2B) account information of the financiers' administrators, our employees' data, and direct inquiries sent to our corporate marketing channels.

To facilitate onboarding, verification, AI-assisted review, and lifecycle monitoring, we process the following categories of data under the strict direction of our Controller clients:

• Identity Data — Full names, government-issued identification numbers (BVN, NIN), photographs, and biometric signatures.
• Corporate & Asset Data — Registration documents, asset purchase records, structural invoices, and title deeds related to Murabaha, Ijarah, or Istisna agreements.
• Financial & Contact Data — Bank statements, credit history reports, corporate addresses, email addresses, and phone numbers.
• Technical & Usage Data — IP addresses, browser types, portal access timestamps, and telemetry logs from our AI-assisted review system.

We process your information solely to deliver our platform's automated functionalities, including:

1. Onboarding & Verification — Validating identity and corporate records against trusted registries.
2. AI-Assisted Structure Review — Parsing documents to ensure asset-backed compliance (e.g., checking cost-plus elements in Murabaha or leasing bounds in Ijarah).
3. Lifecycle Monitoring — Tracking contract fulfillment and asset delivery statuses between financiers and businesses.
4. Security & Audit Logs — Maintaining immutable transaction trails to prevent fraud and ensure platform integrity.

As a Data Processor, Vetify processes data based on the instructions of the Data Controller, who relies on one or more of the following lawful bases under the NDPA:

• Performance of a Contract — The processing is necessary to execute or monitor the asset-backed financing structure requested by the business data subject.
• Legal Obligation — Compliance with regulatory mandates from the Central Bank of Nigeria (CBN) or anti-money laundering (AML/CFT) frameworks.
• Consent — Explicit authorization provided by the data subject to the financier during the financing application phase.

We do not retain personal data longer than necessary. Our retention periods are strictly aligned with our Data Controllers' instructions and Nigerian statutory laws:

• Onboarding & Verification Data — Retained for the duration of the evaluation phase or as mandated by the financier's risk policy.
• Active Transactional Records — Retained for up to seven (7) years post-contract termination to comply with statutory financial record-keeping laws in Nigeria.
• AI-Assisted Review Logs — Temporary processing files are cleared within thirty (30) days of structural analysis completion, leaving only final metadata.

Vetify implements robust technical and organizational security measures:

• Encryption — Data is encrypted at rest using AES-256 standards and in transit using TLS 1.3 protocol.
• AI Zero-Retention Isolation — Our AI model processing layer parses text from identity or asset documents in memory. It does not use your personal information to train public models or retain unauthorized document copies.
• Access Control — Strict Role-Based Access Control (RBAC) ensures only verified administrators of the designated financier can view associated dossiers.

• No Selling of Data — Vetify never sells, rents, or monetizes personal data.
• Regulatory Compliance — We may share data with official regulatory agencies if required by a valid legal order or court subpoena.
• Cross-Border Transfers — Any data stored or processed outside Nigeria (such as on global cloud hosting platforms) complies strictly with Part V of the NDPA, ensuring the destination country has adequate data protection laws or uses standard contractual clauses approved by the NDPC.

Under the NDPA, data subjects have clear rights regarding their personal data. Because Vetify acts as a processor, requests to exercise these rights should primarily be directed to your financier (the Data Controller). However, we will fully support the controller in honoring your rights to:

• Access your personal data held on our platform.
• Rectify inaccurate or incomplete profiles.
• Erasure (“Right to be Forgotten”) subject to statutory retention mandates (e.g., active loan histories cannot be deleted instantly due to banking laws).
• Object or restrict further automated profiling.

For any inquiries regarding this Privacy Policy or Vetify's internal data handling methods, contact our Data Protection Team at:

Vetify Data Protection Unit
Email: privacy@getvetify.com.ng
Portal: https://getvetify.com.ng
Ibadan, Nigeria