CSRISE TECHNOLOGY LTD

Privacy & Data Governance Policy

Effective Date: September 2026

1. Introduction & Scope

CSRise Technology Ltd (“CSRise”, “we”, “us”, or “our”) operates an Enterprise Corporate Impact Operating System (the “Platform”) providing social-investment governance infrastructure for corporate organizations, verified implementing partners (NGOs and project developers), and institutional stakeholders across Nigeria.

This Privacy Policy explains how we collect, process, store, and safeguard enterprise and personal data in connection with corporate social-investment portfolios, milestone escrow release workflows, and evidence verification. This Policy is designed in strict compliance with the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation (NDPR).

2. Information We Collect

2.1 Corporate Social Investors & Institutional Clients

Corporate entity details: company name, CAC registration number, corporate address, and corporate mandate parameters.
Authorized representative information: full name, business email, professional title, corporate telephone, and identity verification credentials.
Financial and allocation records: funding tranches, virtual account allocations, disbursement authorizations, and decision registers (processed via PCI-DSS certified payment infrastructure; CSRise does not store raw credit card numbers).

2.2 Verified Implementing Partners (NGOs & Developers)

Institutional registration records: CAC certificates, NGO constitution or governing documents, Tax Identification Numbers (TIN), SCUML registration certificates, and bank confirmation letters.
Trustee and leadership identification: full names, dates of birth, government ID types and numbers, and professional background records of authorized trustees and project leads.
Corporate banking coordinates: NUBAN account details validated through automated NIP banking lookup for escrow disbursement execution.
Project & Evidence Records: milestone execution documents, geo-audited photographic proof, contractor invoices, delivery sign-off sheets, and verified KPI metrics.

2.3 Information Collected Automatically

Immutable audit logs: timestamped user actions, sign-off approvals, decision register entries, and status changes across the governance lifecycle.
Technical telemetry: IP addresses, session data, browser metadata, and access tokens collected to enforce enterprise session security.

3. How We Use Information

We process collected data strictly for lawful, institutional governance purposes:

Operating the enterprise social-investment governance operating loop: Mandate → Allocate → Execute → Evidence → Verify → Decide → Reallocate.
Verifying institutional eligibility and conducting Know-Your-Customer (KYC) and anti-money laundering (AML) checks on implementing partners.
Managing milestone escrow allocations, generating dedicated Paystack virtual accounts, and reconciling disbursement releases against approved evidence.
Enforcing fraud prevention controls, including media fingerprinting against duplicate photo/receipt re-use.
Maintaining immutable audit trails for statutory ESG reporting, FIRS tax compliance verification, and regulatory examinations.
Administering corporate decision registers and formal milestone dispute escalation workflows.

4. Legal Basis for Processing

We process data pursuant to NDPA Section 25 on the following lawful grounds: (a) Performance of a contract, to deliver enterprise impact governance infrastructure; (b) Legal obligation, including anti-money laundering, counter-terrorism financing, and statutory record-retention requirements; (c) Legitimate interest, in protecting platform security, preventing grant fraud, and verifying capital deployment; and (d) Consent, where explicitly requested.

We do not sell personal data. Information is shared strictly under confidential enterprise protocols:

Licensed Financial Processors: Paystack and licensed settlement banks, to execute escrow-governed capital disbursements and virtual account reconciliation.
Verification & Accreditation Partners: Identity and corporate registry verification providers to confirm CAC status and trustee credentials.
Enterprise Governance Participants: Implementing partner project proposals, milestone deliverables, and verified evidence are shared with authorized corporate fund managers under whose mandate the project is funded.
Regulators & Statutory Bodies: Regulatory authorities (including Central Bank of Nigeria, NUPRC, NCDMB, SCUML, NFIU) where mandated by law or necessary for compliance audit defense.

6. Data Retention & Audit Logs

In accordance with enterprise financial governance and statutory compliance requirements, transaction logs, milestone evidence, and verification records are retained for a minimum of seven (7) years following project closure. Immutable audit logs are maintained for corporate compliance traceability.

7. Enterprise Data Security

We implement enterprise-grade technical and organizational controls: TLS 1.3 in-transit encryption, AES-256 at-rest encryption, role-based access control (RBAC), multi-factor authentication (MFA) enforcement, and automated tamper-detection on media evidence.

8. NDPA Data Subject Rights

Under the Nigeria Data Protection Act 2023, data subjects hold the right to request access, correction, restriction, or deletion of personal data, subject to statutory retention exceptions. Inquiries may be submitted to our Data Protection Officer.

9. Minors & Beneficiary Data Protection

Where corporate initiatives document impact on children (such as educational scholarships or pediatric healthcare), all beneficiary imagery and identification records must comply with strict safeguarding guidelines. Full names and identifiable records of minors are redacted from public surfaces and accessible only to authorized compliance verifiers.

10. Changes to This Policy

Any updates to this Policy will be published on the Platform with a revised effective date. Corporate clients will receive formal notification of material operational amendments.

11. Contact & Data Protection Officer

To exercise data rights or for data governance inquiries, contact:

Data Protection Officer (DPO)
CSRise Technology Ltd
Email: dpo@csrise.africa / support@csrise.africa