Privacy Policy — NACCIMA

Effective date: 9 July 2026

Data controller: Nigerian Association of Chambers of Commerce, Industry, Mines and Agriculture, 8A Oba Akinjobi Way, Ikeja GRA, Lagos, Nigeria.

Contact: mne@naccima.com · Data Protection Officer (DPO): mne@naccima.com

1. Who we are & scope

This policy explains how the Nigerian Association of Chambers of Commerce, Industry, Mines and Agriculture (“NACCIMA”, “we”) collects, uses, and protects personal data when you use the NACCIMA MNE mobile app. We are the data controller for that data. It applies to the mobile app and the supporting API at mne.naccima.com.

2. Personal data we collect

We collect only what we need to provide the service:

Data	Examples	Source
Account / identity	Email address; verification status	You (sign-in)
Device & push	Install ID (random UUID), FCM push token, platform + OS version	Your device
Business records	Business name, RC number, country/state, ISIC sector codes	You (entered)
Verification documents	PDF documents you upload (e.g. CAC certificate)	You (uploaded)
Usage / diagnostics	Notification read-state; crash reports & basic analytics (if enabled)	App

We do not intentionally collect special-category data. Please don’t upload documents containing sensitive personal data beyond what verification requires.

3. Why we use it & legal basis

Under NDPA/NDPR and GDPR Art. 6, our lawful bases are:

Purpose	Legal basis
Create & secure your account (email OTP)	Contract (Art. 6(1)(b)); consent for the initial sign-up
Register your business & submit for verification	Contract
Send you chamber notifications (push + in-app)	Consent (you may withdraw anytime) / legitimate interests
Keep the app reliable & secure; diagnose crashes	Legitimate interests (Art. 6(1)(f))
Comply with legal/regulatory obligations	Legal obligation (Art. 6(1)(c))

4. Who we share it with

We do not sell your personal data. We share it only with:

Google / Firebase (Cloud Messaging for push; Crashlytics/Analytics if enabled) — acting as our data processor. See Google’s privacy policy.
Our hosting / API infrastructure for mne.naccima.com.
Authorities or regulators where required by law.

Processors are bound by contract to protect your data and process it only on our instructions.

5. International data transfers

Some processors (e.g. Google/Firebase) may process data on servers outside Nigeria and the EEA. Where we transfer personal data internationally, we rely on lawful transfer mechanisms — adequacy decisions, Standard Contractual Clauses (SCCs), or your explicit consent — and take steps to ensure it remains protected to NDPA/GDPR standards.

6. How long we keep it

Account & business data: for as long as your account is active.
On account deletion (in-app): we delete or irreversibly anonymize your account and deactivate/soft-delete your business records; verification documents are retained for 6 months for audit purposes, then deleted.
Diagnostics/crash data: retained for a limited period (up to 90 days).
We retain data longer only where a legal obligation requires it.

7. How we protect it

Transport encryption (HTTPS/TLS) for all API traffic.
Session tokens stored in the device’s secure keystore (iOS Keychain / Android Keystore).
Access controls on the backend; the principle of least privilege.
Local app data is not backed up to third-party cloud backups.

8. Your rights

Under NDPA/NDPR and GDPR you have the right to: access your data; rectify inaccurate data; erase your data (“right to be forgotten”); restrict or object to processing; data portability; and to withdraw consent at any time (without affecting prior processing).

How to exercise them:

Delete your account & data directly in the app: Account → Delete account.
For any other request, contact mne@naccima.com. We respond within the timeframes required by law (GDPR: within one month; NDPA: without undue delay).

9. Children

The app is intended for business owners and is not directed at children under 18. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

10. Complaints

If you have concerns we haven’t resolved, you may lodge a complaint with:

Nigeria Data Protection Commission (NDPC) — info@ndpc.gov.ng · ndpc.gov.ng.
(EU/EEA users) your local data protection supervisory authority.

11. Changes to this policy

We may update this policy; we’ll post the new version with a revised effective date and, for material changes, notify you in-app.

12. Contact

Questions or requests: mne@naccima.com · DPO: mne@naccima.com · Nigerian Association of Chambers of Commerce, Industry, Mines and Agriculture, 8A Oba Akinjobi Way, Ikeja GRA, Lagos, Nigeria.