DAG CONNECT PRIVACY POLICY
This Policy explains how DAG Industries Nigeria Limited handles personal data through DAG Connect, including registration, vehicles and purchases, rewards, provider discovery, enquiries and related account services. It explains the choices you can make and how to exercise your rights under the Nigeria Data Protection Act 2023 and the General Application and Implementation Directive 2025.
1. WHO IS RESPONSIBLE AND HOW TO CONTACT US
DAG Industries Nigeria Limited (“DAG”, “we”, “us” or “our”) is the data controller for DAG Connect. This means we determine why and how personal data is processed. Our registered address is 11, Sapara Williams Street (off Ladipo Oluwole Street), Ikeja Industrial Estate, Lagos State, Nigeria.
Privacy and Data Protection Officer email: dpo@dagindustries.com
Customer support email: [__]
Customer support toll-free number: +234 800 0111 111
Website: https://connect.dagindustries.com/privacy (this Policy), https://connect.dagindustries.com/terms (Terms and Conditions) and https://connect.dagindustries.com/delete-account (account deletion requests).
You may also use the app’s privacy controls to request access, correction or erasure, and to withdraw consent, or write to our registered address marked “For the Data Protection Officer”. You do not need to send an identity number through email or support to make a request.
This Policy covers riders, prospective customers, authorised account representatives, dealers, mechanics, workshops, staff, and approved business users whose information is processed in connection with DAG Connect. Separate employment and supplier notices may provide additional detail for those relationships. Independent dealers, lenders, and other providers must give their own notices for processing they determine themselves.
2. THE SCOPE OF THIS POLICY AND YOUR MAIN CHOICES
The app supports account registration, vehicle and purchase records, provider search, rewards, communications, enquiries, and privacy requests. Some features, including Google and Facebook sign-in, technician job recording, service camps, odometer tracking, predictive maintenance, fleet tools, self-service advertising and an analytics marketplace, apply only if introduced. We provide relevant information and obtain any required consent before enabling new processing for you.
Accepting the Terms and Conditions or acknowledging this Policy is not consent to every activity described here. We collect separate, specific choices where consent is required. Optional purposes are not pre-selected, and an assisted-registration representative must not choose on your behalf. Ask for an explanation or assistance in a form you understand before deciding.
You may decline optional NIN verification, location access, marketing, personalised advertising, and non-essential tracking. The related optional function may then be unavailable, but you can still use unrelated core services. Device permission and consent to a processing purpose are separate controls; granting one does not authorise unrelated uses.
3. INFORMATION WE COLLECT AND WHERE IT COMES FROM
Account Information:
We collect your name, verified phone number, account identifier, registration reference, state, local government area and relevant town information; an email address if used or added; credential and verification records; account status; and security and recovery events. The phone number is required even if registration starts by email. We process your PIN through protected authentication mechanisms, not as content for staff or marketing use.
Optional Profile Information:
If you choose to provide it, we process your profile picture and the optional “About me” details: date of birth, sex, marital status, number of dependants, occupation or rider type, income band, State of origin, preferred language, education level, anniversary, email, vehicle type, preferred dealer, a saved location, insurance status and religion for the purposes shown when each field is requested. Each detail is optional and offers “Prefer not to say”. Religion is sensitive personal data and is handled as described under “Additional Protections” in section 4. An optional date of birth does not make child accounts permissible. Do not submit health records or other sensitive information in these fields.
Identity verification:
If you opt in, your NIN is processed transiently through the verification flow. Verification may include an OTP sent to the contact associated with the identity record. Only the outcome, verification timestamp, and provider reference are retained from this process. DAG Connect does not collect BVN. The flow does not store your NIN in a database, object store, cache, log, analytics service, backup, or test environment. Your ordinary profile name is supplied or confirmed separately; we do not retain a full identity-provider response as a profile record.
Vehicles and Purchases:
We collect chassis, engine, and serial numbers, vehicle or product type and model, dealer, town, purchase date, quantity, price in Naira, selected receipt images, account attribution, product-validation results, and transfer requests. Where scanning is available, images and extracted text are used to populate the fields you review. Receipts may contain third-party data; redact details unrelated to proving the purchase.
Service Records and Enquiries:
We process product enquiries, financing-referral requests, chosen provider, service or complaint descriptions, status changes, historical maintenance and repair events, closure confirmations, and reviews. When the relevant features are available, records may include mechanic or workshop identity, parts used, job dates, odometer readings, reading source, service reminders and disputed records. General support correspondence is kept separately from a request sent to a service provider.
Location:
We process the state, city, and/or LGA you provide and the home, park, or other location you choose to save. With separate permission and consent, we use your device’s current location for a stated purpose such as nearby-provider search. We do not continuously track your movements in the background. A location selected for discovery is not automatically permission to use it for advertising.
Rewards and Attribution:
We process point balances, earning and redemption history, coupons, milestones, reward delivery details, referrals, dealer or staff codes, QR/deep-link source, registration attribution, incentive records and related disputes. Reward fulfilment may require a phone number for airtime or data or delivery details for a product; these are requested for the specific redemption.
Device and Usage Information:
Necessary service and security records may include IP address, device and app version, session identifiers, push-notification token, authentication events, OTP delivery attempts, error reports, and security alerts. With consent for the relevant non-essential tracking, we process browsing and engagement events, campaign impressions, clicks and permitted conversions, and preferences inferred from purchases or usage.
Consent and Rights Records:
We record the purpose, notice version, choice, time and method of consent, any withdrawal, and relevant privacy requests and responses. A consent record is separate from acceptance of the Terms. We keep only the evidence needed to demonstrate and implement your choices.
Business and Staff Information:
For authorised users, we process business contact and directory details, role, territory, organisational sign-in identifier, account permissions, provider verification and listing status, access records, registration attribution, and applicable performance or incentive records. If advertiser or partner facilities are enabled, we process authorised contacts, campaign submissions, approvals, budgets, statements and access events.
Sources:
Information comes from you, your authorised representative, the device you use, authorised dealers and DAG field staff, selected providers, approved identity-verification and messaging services, DAG product and staff records, lawful historical service imports, and the previous DAG Connect service. Microsoft Entra ID supports authorised staff-portal sign-in. Indirectly supplied records remain subject to notice, lawful-source and accuracy checks.
4. WHY WE PROCESS DATA AND THE LEGAL GROUNDS WE USE
Core Account and Requested Services:
We use necessary account, vehicle, purchase, reward, and service information to register and authenticate you, maintain your records, validate products, operate the loyalty programme you join, fulfil your requests, support transfers, and handle enquiries. The ground is performance of our agreement with you or steps you request before entering an agreement. We do not treat optional advertising as necessary for that contract.
Optional Identity Verification:
We use the transient NIN and verification response with your specific consent to verify identity through the disclosed provider. You may skip verification or withdraw consent before a new verification. Withdrawal does not undo a completed verification, but you may ask us to erase retained verification metadata unless a separate lawful reason requires limited retention.
Optional Profile and Location Functions:
Consent supports optional profile enrichment and current-device location use for the stated purpose. We use a location you manually select to respond to your requested search. If you save a location for later use, we explain its purpose and provide a delete control. Consent for discovery does not cover location-based advertising.
Marketing and Personalisation:
Consent supports direct marketing, promotional notifications, targeted advertisements, behavioural profiling for offers and replacement-cycle promotions, and non-essential campaign or usage tracking. Separate controls cover the purposes and available communication channels. Personalisation may use consented profile, location, vehicle, purchase and usage information to choose offers. Before sending a marketing message or displaying a targeted advertisement, we check that your relevant consent remains valid and that you have not opted out or objected to that marketing.
Financing Referrals:
At your request and with specific sharing consent, we pass the minimum enquiry and contact details shown to the vehicle financing provider named on the referral screen so it can respond. We send a referral only to a provider with which DAG has a written agreement. We do not forward NIN verification data, complete vehicle histories, or marketing profiles by default. That provider’s own assessment and any additional identification request are governed by its notice and legal duties.
Security and Proportionate Administration:
We use limited authentication, diagnostic, fraud-prevention, and audit records under our legitimate interests in protecting accounts, preventing duplicate rewards, resolving disputes, keeping accurate systems, and administering authorised business access. We assess necessity, reasonable expectations, and the balance with your rights before relying on this ground. It does not justify undisclosed behavioural tracking, third-party targeting, or unlimited retention.
Operational Reporting and Staff Attribution:
Necessary registration, purchase, loyalty and provider information supports service management, reconciliation and fair incentive accounting. We rely on performance of the relevant agreement where necessary and otherwise on assessed legitimate interests in accurate administration. Staff rankings and performance reports have restricted, role-based audiences, and must permit corrections. Employee consent is not used as a substitute for a proper legal basis where the employment relationship makes consent inappropriate.
Legal Compliance and Claims:
We process the minimum records needed to meet applicable data protection duties, respond to valid legal orders, document breaches, and handle rights requests under legal obligation. Necessary evidence to establish, exercise or defend legal claims may be retained under an applicable legal obligation or assessed legitimate interests. A request from an authority is checked for a lawful basis and scope before disclosure.
Additional Protections:
We do not request biometric templates, health details, or other sensitive personal data for ordinary account use. Religion is the only sensitive personal data DAG Connect asks for. It is optional, collected only with your separate explicit consent at the point of entry, stored with restricted access, never used to choose who receives a campaign, never included in measurement tags or in partner, advertiser or financing referral data, and used only in aggregate reporting. You can withdraw that consent at any time, and the value is then deleted. If another optional service requires sensitive data, we will first explain the data and purpose and meet the applicable requirements of section 30 of the NDPA and GAID, including consent where required. Do not place sensitive information in free-text comments unless it is necessary for a disclosed purpose.
5. MARKETING TRACKING AND DEVICE PERMISSIONS
You can change marketing and advertising choices in the app’s privacy/notification settings and use an unsubscribe route in a message where available. You may also contact us. Withdrawal is as easy as giving consent and does not affect processing lawfully completed beforehand. We stop direct marketing and its associated profiling when you object; we do not balance that objection against a marketing business interest.
Operational notifications, such as OTPs, security alerts, and updates about an enquiry or service you requested, are distinct from marketing. We will not label promotions as essential service messages. Device-level notification controls may block delivery without changing your account’s recorded marketing choice.
The app and related portals may use session identifiers, local storage, cookies or software tools. Strictly necessary tools support functions such as sign-in, security and network stability. Non-essential analytics, advertising identifiers and similar tracking require a clear accept-or-reject choice before activation. The relevant notice identifies the responsible provider, purpose, data and duration and explains withdrawal. Closing a notice or continuing to browse does not opt you into optional tracking.
Camera and photo permissions are requested when you choose a receipt, profile image, or scan. Use a selected-image option where available. Current location can be disabled in the app or device settings; manual search remains available. Opening a phone dialler to call a provider does not grant access to your call history, and this Policy does not authorise call recording. We do not need your entire address book for referrals or ordinary app use.
6. WHO RECEIVES INFORMATION
Authorised DAG Personnel:
Staff access is limited by role and territory where relevant. Personnel involved in registration, customer care, service handling, data protection, marketing, or reporting may access the information necessary for their duties. Access to one function does not authorise unrelated browsing or marketing use.
Processors Acting for DAG:
Hostlag Limited is the development and support processor under DAG’s instructions. Amazon Web Services provides the designated cloud environment. Approved messaging and OTP providers, identity-verification providers, notification services, security/support providers, and other technical processors receive only information needed for their assigned service. They are subject to appropriate agreements, confidentiality, security, deletion, and subprocessor controls. Our processors are not permitted to use DAG data for its own marketing, benchmarking, independent analytics, or model training.
The main service providers are:
Amazon Web Services: hosting, database, file storage and email sending for DAG Connect, in South Africa (Cape Town).
Termii: SMS one-time codes and service messages. If an SMS is not delivered, the code may be sent by WhatsApp (through Meta) or by voice call.
QoreID: optional NIN verification.
Google Firebase (Google LLC): push notifications and crash reports.
Google Analytics for Firebase (Google LLC): measurement of how the app is used.
Microsoft Entra ID: sign-in for DAG staff to the staff portal only.
Airtime and data top-up provider: delivery of the rewards you choose; named in the reward rules.
Sanity: app content such as the catalogue and banners; it receives no personal data.
Dealers and Service Providers:
A selected dealer or service team receives the contact, vehicle, purchase, enquiry or job details necessary to handle your request. Assisted-registration staff see the fields needed to help you; they must not retain identity numbers or credentials. Providers acting independently for their own sales, repair or legal obligations are responsible for their own privacy compliance and notices. We do not give the entire directory access to your profile.
Reward and Referral Recipients:
A fulfilment provider receives the information needed to supply the reward you choose. The named vehicle financing provider receives the disclosed details only when you authorise the referral. Other riders receive only the limited information needed for an authorised vehicle transfer. Public reviews show only the review and the limited reviewer identifier explained at submission, not your private contact or identity data.
Advertisers and Analytics Partners:
Campaign reporting will use aggregate results rather than rider-level files. We do not sell or provide identifiable rider profiles to advertisers or analytics-marketplace partners under this Policy. Any materially different personal-data sharing must be explained separately, assessed for lawfulness and supported by any required specific consent before it begins. Consent to receive targeted ads is not permission to sell your personal data.
Advertiser Measurement:
If you agree to marketing messages or to personalised offers and adverts, sponsored items may carry measurement links from the advertiser or its measurement provider. When a sponsored item is shown to you or you tap it, that provider receives standard technical data such as your IP address, device type and the time. We never send your name, phone number, email address, NIN, religion or DAG Connect account number with these signals. If you have not agreed, or you withdraw, no advertiser measurement link is used for you; we count impressions and taps ourselves and report them to advertisers only in aggregate.
Authorities and Advisers:
We may disclose necessary information to a competent authority under a valid legal requirement, or to professional advisers to address a complaint, claim, or legal obligation subject to confidentiality. Any business reorganisation involving personal data must preserve purpose limits, lawful processing, security, and required notice; it does not confer unrestricted rights to use your information.
VEHICLE TRANSFERS MIGRATED RECORDS AND ANALYTICS
Vehicle transfers are limited to relevant vehicle and maintenance information. Before confirmation, you will be told what the recipient can see. Private account details, NIN-verification metadata, unrelated purchases, personal reward balances, and complaints are excluded. Receipts, free-text service notes, and prior-owner information will be redacted or removed where not necessary. Please ask us to review a record if a transfer would expose someone else’s data.
In bringing records from the previous DAG Connect service or authorised service-history files into the current service, we validate matches and handle disputed or unmatched records with restricted access. Plaintext NIN and BVN from the previous service will not migrate into DAG Connect V2. Legacy copies will be securely removed under the controlled migration and lawful retention process. Old marketing choices are not assumed valid unless we can demonstrate that the specific consent covers the new activity.
If an analytics marketplace is introduced, partners will receive approved aggregated reports that have been effectively anonymised. Removing names alone is insufficient: vehicle identifiers, precise locations, small groups and unusual combinations can still identify a person. We apply minimum-group and disclosure controls and test re-identification risk before release. Pseudonymised or re-identifiable data remains personal data and subject to this Policy. Partners must not attempt re-identification or link reports to identify riders.
Preparing anonymous reports still involves processing personal data before anonymisation. For optional commercial marketplace analytics, we obtain the applicable specific consent before using identifiable source records for that purpose. Withdrawing that consent stops future inclusion of your personal data; a genuinely anonymous report already produced cannot be linked back to you to extract an individual contribution.
7. PROFILING AUTOMATION AND HUMAN REVIEW
Automated functions may validate product numbers, identify duplicate registrations, calculate points, select nearer providers and generate reminders. With the relevant consent, campaign systems may group users by vehicle, location, purchase or usage patterns to choose promotions. This can affect which offers or reminders you see; it does not authorise lending decisions or unrestricted monitoring.
Future maintenance predictions or vehicle health scores would use information such as service history and validated mileage. They may be incomplete or inaccurate and are not professional inspections. Future AI recommendations or other materially new profiling require appropriate impact assessment, notices and consent before use.
You may ask us to explain and correct a result, object to profiling, express your views and request human review of a decision affecting you. We will not make a solely automated decision producing legal or similarly significant effects without satisfying the applicable NDPA and GAID requirements, including the required consent and safeguards. Automated flags must be open to meaningful review before a significant adverse decision is finalised. A financing provider must separately explain its own decisions and review route.
8. PROCESSING OUTSIDE NIGERIA
DAG Connect’s designated hosting location is DAG-controlled Amazon Web Services infrastructure in the Africa Cape Town region, af-south-1, in South Africa. This is processing outside Nigeria. Production and other environments holding personal data are restricted to that approved location unless a lawful alternative is approved; test environments use masked or synthetic data. Google Firebase and Google Analytics for Firebase process data in the United States and other Google locations. Microsoft Entra ID (DAG staff only) processes data in Microsoft data centres outside Nigeria. Termii and QoreID process data from Nigeria [each provider to confirm its hosting location].
Before an international transfer, we document its legal basis and assess the protection available under sections 41 to 43 of the NDPA and Article 45 and Schedule 5 of GAID. Where applicable, we require enforceable contractual safeguards and appropriate security and onward transfer restrictions. A country’s own privacy law or the choice of a reputable cloud provider does not by itself establish that the NDPC has issued an adequacy decision.
Where the Commission has not made an adequacy decision for a destination, we transfer account data to the hosting location in South Africa, and to the service providers named in section 6, because the transfer is necessary to provide the DAG Connect service you ask for, or to take steps you request before you open an account (section 43 of the NDPA). Optional analytics or advertising measurement outside Nigeria takes place only with your consent for that purpose.
You may ask our privacy contact for the destinations and a summary or copy of relevant safeguards, with unrelated confidential information redacted where appropriate.
9. HOW LONG WE KEEP INFORMATION
We retain personal data only for a specified lawful purpose and for no longer than necessary. The periods below are DAG Connect’s retention rules, not a statement that Nigerian law imposes the same period on every record. We erase data earlier where the purpose has ended and there is no lawful reason to retain it. “Closure” means account closure is confirmed, not merely uninstalling the app.
Account and Optional Profile Data:
We keep while the account remains active and the information is needed to provide it. We remove an optional field when you delete it, normally within 30 days from active systems. Following closure, we remove or irreversibly anonymise the account and ordinary profile data within 30 days, except the specific records and lawful holds described below. We review unused accounts after 24 months without activity; give 30 days’ notice before closing an inactive account unless an unresolved service or legal reason justifies keeping it open.
NIN and Identity Results:
We do not retain the NIN after the transient verification attempt; it will never enter persistent app stores, logs, or backups. We retain only verification outcome, timestamp, and provider reference while needed for the active account; we remove these within 30 days of closure or earlier when no longer needed. The verification provider’s own lawful retention, if any, will be disclosed in its notice before you choose verification. BVN is not collected.
Vehicle Purchase Service and Reward History:
We keep the history for the active account or vehicle service relationship so the user can access and use it. On closure or an approved erasure request, we remove personal links within 30 days unless continued retention is justified for an unresolved transaction, warranty, dispute, or legal requirement. After a transfer, the new keeper may retain only necessary, redacted vehicle history. We do not retain a former owner’s identity merely because a vehicle record continues. Keep the minimum transaction or incentive evidence needed to complete settlement and resolve a known dispute; we apply a documented legal hold where required rather than retaining every attachment indefinitely.
Uncompleted Enquiries and Referrals:
Where information is collected for steps towards a contract that does not materialise, we delete it within six months of collection if the proposed transaction does not materialise, unless a justifiable need to preserve evidence for a future legal claim applies, in line with Article 21 of GAID. A fresh purpose requires its own legal basis; this period does not permit continued marketing without consent.
Support Records:
We keep ordinary closed support enquiries for up to 12 months after resolution to manage follow-up and recurring issues, then delete or anonymise them. Escalated complaints, rights requests, and legal claims follow the accountability or legal rules below. We do not keep unnecessary identity-document copies as support evidence.
Location:
We use current coordinates for the requested search or feature session and discard them when that purpose ends; we do not keep a movement history. We keep a location you deliberately save until you delete it or close the account, then we remove it from active systems within 30 days. Any separate consented location-based campaign processing follows the campaign limit below.
Technical and Campaign Records:
We keep routine identifiable security, diagnostic and OTP-delivery logs for up to 90 days, unless a specific incident requires a documented hold. We expire OTP secrets when used or when their short validity period ends. We remove obsolete push tokens when replaced, invalidated, or on account closure. We keep identifiable optional analytics and ad-event records for up to 90 days from collection, then erase or effectively anonymise them; we stop consent-based collection immediately upon withdrawal and remove unneeded existing personal records without undue delay.
Consent and Accountability Records:
We keep the minimum consent evidence while relying on that consent and for up to 24 months after withdrawal or closure to demonstrate compliance and resolve related requests, unless a specific legal obligation or claim requires longer. We keep closed rights-request and breach records for up to 24 months after closure of the matter, subject to the same necessity and legal-hold review. We retain only a minimal suppression record for as long as needed to honour a marketing objection; it must not be used to market to you.
Staff and Business Accounts:
We remove access promptly when authorisation ends. We remove routine profile and access data under the account and log periods above. We retain necessary incentive, billing, employment, or supplier records only for the applicable relationship, statutory recordkeeping period or documented claim period explained in the relevant employment or business notice.
Backups and Holds:
Residual copies in protected backups expire within 90 days of deletion from active systems and are not used for marketing or ordinary operations. If a backup is restored, deletion instructions are reapplied. A genuine legal hold must identify the records, reason, access restriction and review point; when it ends, we erase the records without undue delay unless another lawful retention reason remains. These limited exceptions do not authorise blanket preservation of personal audit trails.
Deletion Scope and Access Requests:
Erasure covers relevant operational stores, uploaded files, reporting copies, personal audit trails, and processors, subject only to explained lawful exceptions and the backup cycle. We take reasonable steps to communicate required correction, restriction or deletion to recipients. Once information has been securely erased or irreversibly anonymised, we cannot retrieve it for a later access request. Ask for a copy before closing your account if you need your history.
10. SECURITY AND PERSONAL DATA BREACHES
We use proportionate technical and organisational safeguards, including encryption, restricted and logged access, protected credentials, environment separation, secure development, testing, backup and recovery measures, and staff confidentiality requirements. Vendor access is authorised, time-limited where appropriate, and revocable. No system eliminates every risk, but this does not reduce our legal duty to protect your information.
We assess suspected breaches, contain harm, and maintain the required breach records. Where a breach is likely to create a risk to individuals’ rights and freedoms, we notify the NDPC within 72 hours of becoming aware, as required by section 40 of the NDPA. Where a breach is likely to create a high risk to you, we communicate it to you immediately as required by law, in clear language explaining the likely consequences, response and steps you can take. A processor’s reporting arrangements do not extend DAG’s own statutory deadline.
We keep credentials confidential and report a lost account, suspicious message, or exposed record promptly. We will never need your bank PIN or banking OTP to investigate a DAG Connect privacy complaint.
To ask us to delete your account, see Delete your account.
11. YOUR RIGHTS AND HOW TO USE THEM
You may ask whether we process your data and obtain information about its purposes, source, recipients and retention, and a copy in a commonly used electronic form. You may ask us to correct inaccurate, incomplete, outdated or misleading data, erase data where the legal grounds apply, or restrict processing while a request, objection or claim is resolved.
You may withdraw consent at any time, object to processing including profiling, and stop direct marketing and related profiling. You may request portability of data you provided where processing is based on consent or contract and the applicable conditions are met, in a structured, commonly used, machine-readable format, including direct transfer where technically possible. These rights must respect other people’s data and applicable lawful exceptions.
You may seek human intervention, give your view and contest a solely automated decision producing legal or similarly significant effects. You may also seek statutory remedies and compensation where available. Your rights are not conditional on continuing to use the app or receiving marketing.
Use the app’s privacy controls or the privacy contact in section 1. You can also ask for your account to be deleted on our website at https://connect.dagindustries.com/delete-account. Give enough information to locate your account and understand the request. We use proportionate verification and may ask an authorised representative for evidence of authority. We do not routinely require a NIN/BVN copy, affidavit or newspaper publication. We do not charge to correct an error we made.
We act without undue or unreasonable delay our service target is to acknowledge a request within 7 days and respond within 30 days of receipt; these are operational targets, not permission to delay a request that requires earlier action. Consent withdrawals and marketing objections are implemented promptly. If identity clarification or complexity affects completion, we explain what is needed and the expected timing while observing applicable legal deadlines. If we refuse or limit a request, we give the legal reason and explain how to challenge it. Requests are ordinarily free; any exceptional lawful cost must be explained in advance.
Erasure is not absolute where a specific lawful obligation or claim requires limited retention. We will explain what is retained, why, the applicable period or review criteria, and restrictions on use. We do not rely on a general desire to keep audit logs to refuse deletion of all your data.
12. CHILDREN AND PEOPLE NEEDING ASSISTANCE
DAG Connect accounts are intended for adults aged 18 or over. We do not knowingly open child accounts or target children with behavioural advertising. If we learn that a child’s data was submitted, we assess the circumstances, restrict inappropriate processing and securely erase information that has no lawful reason to be retained. A parent or guardian may contact us.
Where a person lacks legal capacity to consent, any consent-based processing requires an appropriately verified parent or legal guardian, and the safeguards required by law. Help with reading or completing registration is not authority to give consent for a person who can decide for themselves. We provide reasonable assistance and understandable explanations for people who need them.
13. COMPLAINTS AND CHANGES TO THIS POLICY
You may contact our privacy team, but you may also complain directly to the Nigeria Data Protection Commission at any time. The Commission’s privacy-violation reporting portal is https://services.ndpc.gov.ng/breach/ and its website is https://ndpc.gov.ng/. You may use the GAID Standard Notice to Address Grievance if you wish; neither that notice nor our internal process is a condition for approaching the Commission or a competent court.
We publish the current Policy in the app and at https://connect.dagindustries.com/privacy and notify you of material changes before relevant new processing begins. The version and effective date appear above. We obtain fresh consent where the purpose or scope changes in a way that requires it; continued app use is not fresh consent. Changes do not retrospectively validate unlawful processing or erase an earlier objection.
This Policy is guided by NDPA sections 24 to 43 and 46, and the relevant GAID provisions, including Articles 17 to 19, 21, 26 to 28, 33 to 40 and 45, and Schedules 1, 5, 8 and 9. If mandatory law affords greater protection, that protection applies.