Privacy Policy

011. Introduction

Porta ("we," "our," or "us"), operated under Nigerian law by Porta Technologies Limited, is committed to safeguarding your privacy and protecting the sensitive enterprise financial operations you entrust to us. This Privacy Policy outlines the standards, procedures, and statutory protocols we implement to collect, handle, store, and process your organizational and personal information.

By accessing our Expense Management Software-as-a-Service (SaaS), generating virtual corporate cards, provisioning departmental sub-wallets, or submitting regulatory identity proofs, you agree to the practices described in this document.

Enterprise Standard: All processing strictly adheres to the provisions of the Nigeria Data Protection Act (NDPA) 2023, the Nigeria Data Protection Regulation (NDPR) 2019, and operational rules issued by the Central Bank of Nigeria (CBN).

022. Data We Collect

To operate an institutional-grade financial workflow engine and enforce strict approval ladders, Porta collects specific corporate and transactional metrics:

Account Data

Full personal names, institutional email addresses, legal corporate names, designated job designations, phone numbers, and tiered managerial approval levels.

Financial Data

Expense requests, categorical line-item receipts, departmental budget caps, multi-sig approval logs, settlement bank account details, and corporate ledger histories.

KYB (Know Your Business) Data

Corporate Affairs Commission (CAC) RC/BN numbers, status reports, and identity proof of Ultimate Beneficial Owners (UBOs) for Tier 2 Wallets.

Technical & Telemetry Data

Internet Protocol (IP) addresses, cryptographic session cookies, hardware fingerprints, browser types, geo-location checks, and operational audit timestamps.

033. How We Use Data

We process customer data solely to honor contractual agreements and fulfill state statutory compliance. Specific operational purposes include:

Core Workflow Engine Provisioning

Powering rule-based routing for corporate expense claims, threshold approvals, departmental real-time spend sync, and receipt reconciliations.

Automated Wallet Transactions & Payouts

Executing local NIP (NIBSS Instant Payment) vendor transfers, funding corporate fuel cards, and settling employee out-of-pocket reimbursements.

Regulatory Compliance (KYB / CBN / NFIU)

Verifying business operational legitimacy, cross-referencing sanctions lists, and maintaining anti-money laundering monitoring as required by Nigerian financial watchdogs.

Administrative Communications

Sending automated multi-tiered approval pings, low-balance wallet warnings, audit trail exports, security multi-factor authentication tokens, and tax invoices.

044. Nigeria Data Protection Regulation (NDPR) & NDPA

Kosten operates as a Data Controller and Data Processor under the Nigeria Data Protection Act (NDPA) 2023 and the Nigeria Data Protection Bureau (NDPB). We take zero shortcuts in enforcing statutory data protection mechanisms.

256-Bit Encryption

All stored database tables use AES-256 at rest. Network requests use TLS 1.3 protocol encryption.

Data Sovereignty

Financial records and identity proofs are redundantly mirrored in Tier-4 local data centers with geo-redundancy.

Annual Auditing

Annual compliance audits executed through certified DPCOs (Data Protection Compliance Organizations).

044. Nigeria Data Protection Regulation (NDPR) & NDPA

Kosten operates as a Data Controller and Data Processor under the Nigeria Data Protection Act (NDPA) 2023 and the Nigeria Data Protection Bureau (NDPB). We take zero shortcuts in enforcing statutory data protection mechanisms.

256-Bit Encryption

All stored database tables use AES-256 at rest. Network requests use TLS 1.3 protocol encryption.

Data Sovereignty

Financial records and identity proofs are redundantly mirrored in Tier-4 local data centers with geo-redundancy.

Annual Auditing

Annual compliance audits executed through certified DPCOs (Data Protection Compliance Organizations).

055. Wallet & KYB Data Specifics

For activation of Tier 2 Virtual Corporate Wallets, corporate entities must provide verified government-issued identification. Corporate Affairs Commission (CAC) status reports, certificates of incorporation are routed via zero-knowledge isolated channels directly to identity verification partners.

Absolute Strict Isolation Guarantee

KYB registries and identity documents uploaded by corporate directors are never aggregated, profiled, or traded for behavioral advertising or third-party marketing under any circumstance.

066. Data Sharing & Third Parties

Porta does not sell, lease, or monetize customer records. We interact with third-party service vendors strictly under tightly defined Data Processing Agreements (DPAs):

Licensed Payment Processors

CBN-licensed partners (e.g., Paystack, Flutterwave, NIBSS) for card tokenization, direct debit settlements, and automated vendor disbursement.

Identity & KYB Infrastructure

Verified compliance conduits (e.g., VerifyMe, Smile Identity) strictly to query live CAC registries and validate TIN authenticity.

Regulatory & Law Enforcement

Judicial subpoenas or statutory demands from the Nigerian Financial Intelligence Unit (NFIU) or Federal Inland Revenue Service (FIRS).

077. Your Rights

Under NDPR and NDPA frameworks, data subjects hold enforceable rights concerning the collection and retention of personal identification markers:

Right to Access

Request a complete ledger export of all personal transactions, approval signatures, and account profiles held by kosten.

Right to Rectification

Require prompt updates or corrections to any incomplete or inaccurate corporate personnel records.

Right to Erasure ("To Be Forgotten")

Request deletion of non-mandatory user records, subject to mandatory 6-year financial audit ledger retention rules under Nigerian tax laws.

Right to Data Portability

Obtain structured, universally readable JSON/CSV exports of organizational financial reports for external integration.

Submit a Data Subject Request

088. Contact Us & DPO Escalations

For security disclosures, queries regarding our privacy protections, or to reach our designated Data Protection Officer:

Data Protection Officer

Int+ Technology Ltd.

legal@kosten.com