Privacy & Data Protection Notice

1. Legal Commitment & NDPA 2023

Roma Intelligence is committed to protecting personal data in accordance with the Nigeria Data Protection Act, 2023 (NDPA), subsidiary regulations issued by the Nigeria Data Protection Commission (NDPC), and internationally recognised privacy principles where applicable.

2. Data Controller & Data Processor Roles

Roma Intelligence operates as a Data Controller in respect of user registration data, platform analytics, and account administration. Researchers using the Platform act as independent Data Controllers in respect of the personal data collected through their research projects where they determine the purpose and means of processing.

3. Personal Data Collected

4. Lawful Basis for Processing

We process personal data only where there is a valid lawful basis under Section 25 of the NDPA 2023, including: (i) informed consent of the data subject; (ii) performance of a contract to which the user is party; (iii) compliance with legal obligations; and (iv) legitimate business interests of Roma Intelligence.

5. Identity Verification (NIN & CAC)

Roma Intelligence reserves the right to verify user identity through lawful verification mechanisms including government-issued identification, National Identification Number (NIN), Corporate Affairs Commission (CAC) records, or other legally permissible verification systems.

NIN verification is conducted via secure API calls to official database protocols. Roma Intelligence does not publicly disclose or sell raw identification credentials.

6. Data Subject Rights & NDPC Complaints

Under the Nigeria Data Protection Act 2023, every data subject has the right to:

Requests may be submitted through Roma Intelligence's designated privacy contact at legal@romaintel.org. Identity verification may be required prior to fulfilling requests.

7. Data Retention & Erasure

Personal data shall be retained only for as long as reasonably necessary to: (i) complete research projects; (ii) fulfil contractual obligations; (iii) comply with legal or regulatory requirements; (iv) resolve disputes; and (v) enforce Terms of Service.

Following expiration of applicable retention periods, personal data shall be securely deleted, anonymised or archived in accordance with applicable law.

8. Cross-Border Data Transfers

Where personal data is transferred outside Nigeria, Roma Intelligence shall ensure that such transfers comply with Section 41 and 42 of the Nigeria Data Protection Act, 2023, guaranteeing adequate data protection safeguards.

9. Confidentiality & Security Measures

We employ strict technical and organizational safeguards including TLS 1.3 encryption in transit, AES-256 database encryption at rest, role-based access controls, and automated fraud prevention algorithms.