Privacy policy

1. Who we are

Speedmap is the identity verification platform of Speedily Services Limited (“Speedily”, “we”, “us”), a company incorporated in Nigeria and a licensed National Identity Management Commission (NIMC) Front-End Processor. Speedily holds NDPA certification.

You can reach our data protection team, including our Data Protection Officer, at privacy@speedmap.ng.

2. Our role

We act in two capacities, and this policy explains both.

• As a data controller for personal data about our own customers and website visitors: account holders, team members, business contacts, billing records, support conversations and security logs.
• As a data processor for personal data about individuals whose identity our business customers verify through Speedmap (“data subjects”). In that role the customer decides why and how the data is processed, and we act on their documented instructions under our terms and data processing addendum. If you were verified by a business using Speedmap, that business’s privacy notice applies and it is your first point of contact.

Where we determine the purpose of processing verification data ourselves, for example to prevent fraud against our own platform or to meet our own legal obligations, we act as a controller for that processing.

3. Data we collect

Customers and website visitors

• Account data: name, work email, role, organisation and hashed password.
• Business verification (KYB) data: company details, registration numbers, directors and documents you submit when applying for live access.
• Billing data: wallet top-ups, charges and invoices. We do not store full payment card details.
• Communications: messages you send to sales, support or other teams.
• Technical data: IP address, browser and device information, request logs and security events. Logs redact identifiers, images and credentials.

Data subjects verified through Speedmap

• Identifiers you are asked for: NIN, BVN, phone number, bank account number, CAC registration numbers or document numbers, as submitted by the business verifying you.
• Matching data: names and date of birth the business supplies for comparison.
• Biometric data: a selfie, where a business runs face liveness and match or in-person NIN verification.
• Record data returned by providers: for example name, date of birth, gender, contact details, addresses, state and local government of origin and residence, and the record photo, depending on the check and the business’s entitlement.
• Risk signals: SIM-swap recency, BVN demographic change history and watchlist status.
• Consent records: the purpose, data categories, channel, timestamps and outcome of consent requests.

4. Purposes and lawful bases

Biometric and identity data are sensitive. We process them only for the verification a customer requests, under the consent mechanism recorded with each check, or where the law otherwise permits.

5. Identity verification data

• Purpose limitation. Every identity check carries one of the 38 purpose codes prescribed for NIN validation. We reject checks without a valid purpose and store the purpose with the result.
• Consent before execution. Depending on the check, consent is attested by the customer, given in person with a selfie, given through a NINAuth share code, or granted through NIBSS Consent Hub or USSD. Consent-gated checks do not run until consent is satisfied. Consent requests are scoped to the categories needed.
• Minimisation. Many customers, webhooks, bulk results and our MCP server receive only an assertion (for example “verified” and “match”) rather than the record.
• No reverse lookup. We do not turn a phone number, name or date of birth into a NIN or BVN.
• Routing. NIN checks run through Speedily’s licensed NIMC Front-End Processor access or through NIBSS. Other checks run through NIBSS services.
• No automated decisions by us. Speedmap returns verification results and risk signals. Decisions about you, such as whether to open an account, are made by the business that requested the check.

6. Who we share data with

We do not sell personal data. We share it only as needed to provide the service or meet our obligations:

• Verification channels: Speedily’s licensed NIMC access and the Nigeria Inter-Bank Settlement System (NIBSS), to run the checks customers request.
• The customer who requested a check: the result, shaped to their entitlement.
• Service providers: hosting, infrastructure, email and support tools that process data on our instructions under contract.
• Professional advisers: lawyers, auditors and insurers, under confidentiality.
• Regulators and authorities: including the Nigeria Data Protection Commission (NDPC), NIMC, the Central Bank of Nigeria and law enforcement, where the law requires it.
• Corporate transactions: a successor in a merger, acquisition or reorganisation, subject to this policy.

7. Cross-border transfers

We aim to store and process identity verification data in Nigeria. Where personal data is transferred outside Nigeria, for example to a service provider, we do so only in line with Part VIII of the NDPA: to a country or organisation with an adequate level of protection, or with appropriate safeguards such as contractual clauses, or on another basis the Act permits.

8. Retention

We keep personal data only for as long as the purpose requires, our contract with the customer provides, and the law obliges, including record-keeping, audit, regulatory and dispute-resolution obligations. Verification records and consent logs are retained to evidence lawful processing, and then deleted or anonymised. Account data is kept for the life of the account and a limited period afterwards. Customers can ask us to delete verification records earlier, where legally permissible.

9. Security

We protect personal data with technical and organisational measures appropriate to its sensitivity, including AES-256-GCM encryption of records at rest with key rotation, keyed hashing and masking of identifiers, TLS in transit, server-side-only provider calls, role-based access with audited reveals, and an audit log of data-access events. See Security for more detail.

10. Your rights

Under the NDPA you have the right to:

• be informed about how your data is processed, and access a copy of it;
• have inaccurate or incomplete data corrected;
• have data erased, where there is no longer a lawful reason to keep it;
• restrict processing in certain circumstances;
• receive your data in a portable format;
• object to processing based on legitimate interests, and to direct marketing at any time;
• withdraw consent at any time, without affecting processing that already took place;
• not be subject to a decision based solely on automated processing that significantly affects you.

To exercise a right, email privacy@speedmap.ng. We may need to verify your identity first. If we process your data on behalf of a business, we will pass your request to that business and support it in responding. We respond within the time the law requires.

Corrections to the underlying national identity or BVN record must be made with NIMC or your bank; we cannot change those records.

11. Cookies and local storage

The dashboard uses a strictly necessary, httpOnly session cookie to keep you signed in and protect against cross-site request forgery. The website stores small preferences in your browser, such as your colour theme and preferred code language. We do not use advertising cookies. If we introduce analytics, we will update this policy and ask for consent where required.

12. Children

Speedmap is a business service and is not directed at children. Businesses may verify minors only where the law allows and with the consent of a parent or guardian where required; that responsibility rests with the business requesting the check.

13. Personal data breaches

We maintain an incident response procedure. Where a personal data breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the NDPC within 72 hours of becoming aware of it, notify affected customers without undue delay so they can meet their own obligations, and inform affected individuals where the law requires.

14. Contact and complaints

Questions or concerns: privacy@speedmap.ng. Security issues: security@speedmap.ng. If you are not satisfied with our response, you may complain to the Nigeria Data Protection Commission.

15. Changes to this policy

We will update this policy as our service and the law change. We will post the new version here with its revision date and, for material changes, notify customers by email or in the dashboard before they take effect.