Privacy Policy

Summary (plain language) We collect information you provide when registering or transacting on the Platform. We use it to deliver our services, process payments, and improve the Platform. We do not sell your data. You have the right to access, correct, or delete your data at any time. For full details, read the sections below.

Who We Are
Data We Collect
How We Collect Data
Why We Use Your Data
Legal Basis for Processing
Data Sharing
International Transfers
Data Retention
Your Rights
Cookies & Tracking
Children's Privacy
Security Measures
Changes to This Policy
Contact & Complaints

Section 01

Who We Are

Next Digital Solutions (FoodBank) ("we", "us", or "our") is the data controller responsible for your personal data collected through the Foodbank CRM platform ("Platform").

We operate in compliance with the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Regulation (NDPR), and all applicable data protection legislation.

Contact details:

Address: Emeka Anyaoku Street, Garki, Area 11, FCT, Abuja, Nigeria
Email: info@xdigitalsolutions.com
Phone: +234 701 389 2929

Section 02

Data We Collect

Depending on how you use the Platform, we may collect the following categories of personal data:

Category	Examples
Identity Data	Full name, date of birth, gender, national ID details
Contact Data	Email address, phone number, physical address
Account Data	Username, password (hashed), account type (beneficiary/vendor), subscription tier
Financial Data	Bank account number, bank name, payment transaction records (processed via Paystack)
Business Data	Business name, CAC registration number, product categories (vendors only)
Usage Data	Login timestamps, pages visited, actions performed, device type, browser type, IP address
Communication Data	Emails, support messages, feedback forms
Content Data	Documents, images, or files you upload to the Platform

We do not intentionally collect sensitive personal data (e.g., health, biometric, or political data) unless strictly necessary for service delivery and with your explicit consent.

Section 03

How We Collect Your Data

We collect personal data through:

Direct interactions — when you register, subscribe, submit forms, or contact us;
Automated technologies — cookies, log files, and analytics tools that record your usage of the Platform;
Third-party sources — payment processors (e.g., Paystack) that share transaction data with us to fulfil your request;
Mobile application — when you use the Foodbank CRM mobile app, device identifiers and push notification tokens may be collected.

Section 04

Why We Use Your Data

We use your personal data for the following purposes:

Account management — creating and managing your account, authenticating logins, and maintaining your subscription;
Service delivery — processing orders, managing food distribution logistics, and facilitating vendor-beneficiary matching;
Payment processing — verifying payment details and processing transactions securely through Paystack;
Communications — sending service notifications, transaction confirmations, support responses, and (where opted in) marketing updates;
Platform improvement — analysing usage patterns to improve features, performance, and user experience;
Legal compliance — maintaining records as required by Nigerian law and responding to lawful regulatory requests;
Security — detecting and preventing fraud, abuse, and unauthorised access.

Section 05

Legal Basis for Processing

Under the NDPA 2023, we process your personal data on the following lawful bases:

Contract performance — processing necessary to provide the services you have subscribed to;
Consent — where you have freely given explicit consent (e.g., marketing emails, push notifications);
Legitimate interests — for fraud prevention, security, and platform analytics, where these interests are not overridden by your rights;
Legal obligation — where processing is required to comply with applicable Nigerian law or regulatory requirements.

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

Section 06

Data Sharing & Disclosure

We do not sell, rent, or trade your personal data. We may share your data with:

Payment processors (Paystack) — to process financial transactions securely;
Cloud hosting providers — that host our servers and databases under confidentiality agreements;
Authorised staff — employees or contractors who need access to deliver our services, bound by confidentiality obligations;
Regulatory authorities — where disclosure is required by law, court order, or lawful regulatory request;
Business successors — in the event of a merger, acquisition, or asset sale, where the successor commits to protect your data under equivalent terms.

Any third-party processors we engage are bound by data processing agreements that require them to protect your data in accordance with applicable law.

Section 07

International Data Transfers

Your data is primarily stored and processed within Nigeria. Where data is transferred outside Nigeria (for example, to cloud infrastructure providers), we ensure adequate safeguards are in place, including:

Data processing agreements incorporating NDPA-compliant standard contractual clauses;
Transfers only to countries or organisations providing equivalent data protection standards;
Your explicit consent where required by law.

Section 08

Data Retention

We retain your personal data only as long as necessary for the purposes it was collected, or as required by law. Retention periods are as follows:

Account data — retained for the duration of your active account plus 12 months after closure;
Transaction records — retained for 7 years to comply with Nigerian financial regulations;
Usage and log data — retained for up to 12 months;
Support communications — retained for 3 years from the date of resolution.

After the applicable retention period, data is securely deleted or anonymised.

Section 09

Your Data Rights

Under the NDPA 2023, you have the following rights regarding your personal data:

Right of Access

Request a copy of the personal data we hold about you.

Right to Rectification

Request correction of inaccurate or incomplete data.

Right to Erasure

Request deletion of your data where it is no longer necessary or lawfully held.

Right to Restriction

Request that we limit processing of your data in certain circumstances.

Right to Data Portability

Request your data in a structured, machine-readable format for transfer.

Right to Object

Object to processing based on legitimate interests or for direct marketing.

Right to Withdraw Consent

Withdraw consent at any time where processing is based on consent.

Right to Complain

Lodge a complaint with the Nigeria Data Protection Commission (NDPC).

To exercise any of these rights, email us at info@xdigitalsolutions.com with the subject line "Data Rights Request". We will respond within 30 days.

Section 10

Cookies & Tracking Technologies

The Platform uses cookies and similar technologies to:

Maintain your login session;
Remember your preferences;
Measure Platform usage and performance.

We use the following types of cookies:

Essential cookies — required for the Platform to function (e.g., session authentication). These cannot be disabled.
Analytics cookies — help us understand how users interact with the Platform. You may opt out via your browser settings.

You can control cookies through your browser settings. Disabling essential cookies may affect Platform functionality.

Section 11

Children's Privacy

The Platform is not directed to children under the age of 13. We do not knowingly collect personal data from children under 13 without verifiable parental consent.

Users between 13–17 may use the Platform only with the consent and supervision of a parent or legal guardian. If we become aware that we have inadvertently collected data from a child under 13 without consent, we will promptly delete it.

If you believe a child's data has been collected without appropriate consent, contact us at info@xdigitalsolutions.com.

Section 12

Security Measures

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction, including:

TLS/HTTPS encryption for all data in transit;
Password hashing using industry-standard algorithms (bcrypt);
Role-based access control limiting data access to authorised personnel;
Regular security assessments and vulnerability monitoring;
Secure payment processing handled entirely by Paystack (PCI-DSS compliant).

In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected users and the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of the breach, in accordance with the NDPA 2023.

Section 13

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

Update the effective date at the top of this page;
Notify registered users via email or a prominent notice on the Platform;
Where required by law, seek your consent before applying material changes.

Your continued use of the Platform after changes are posted constitutes acceptance of the revised policy. We encourage you to review this page periodically.

Section 14

Contact & Complaints

For any privacy-related questions, requests, or concerns, please contact our Data Protection Officer:

Company: Next Digital Solutions (FoodBank)
Address: Emeka Anyaoku Street, Garki, Area 11, FCT, Abuja, Nigeria
Email: info@xdigitalsolutions.com
Phone: +234 701 389 2929

If you are not satisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC):

Table of Contents