Data Protection Policy (NDPA)

TopLogical Nigeria Limited is registered as a Data Controller and Data Processor of Major Importance pursuant to the Nigeria Data Protection Act, 2023 (NDPA) and regulatory directives issued by the Nigeria Data Protection Commission (NDPC).

This Policy applies to all personal data collected, stored, processed, or transmitted by TopLogical through the TopSafeAI fraud prevention, KYC/KYB identity verification, and transaction scoring engines.

In accordance with Section 24 of the NDPA 2023, personal data must be:

• Lawful, Fair, and Transparent: Processed with explicit legal authority and clear transparency disclosures to data subjects.
• Purpose Limited: Collected solely for specified, explicit, and legitimate AML compliance and fraud risk scoring purposes.
• Data Minimization: Adequate, relevant, and limited strictly to what is necessary for risk verification.
• Accuracy: Maintained accurately and kept up to date; reasonable steps are taken to erase or rectify inaccurate data immediately.
• Storage Limitation: Kept in identifiable form for no longer than is necessary for statutory regulatory purposes.
• Integrity and Confidentiality: Secured against unauthorized access, destruction, alteration, or accidental disclosure.

TopSafeAI processes institutional customer data under the following legitimate bases recognized by Section 25 of the NDPA:

• Compliance with Legal Obligations: Fulfilling mandatory AML/CFT/CPF obligations under the Money Laundering (Prevention and Prohibition) Act 2022 and CBN regulations.
• Performance of a Contract: Providing contracted fraud detection, sanctions screening, and transaction scoring to licensed partner institutions.
• Legitimate Interests: Preventing cybercrime, securing banking rails against fraud syndicates, and safeguarding financial stability.

Every Nigerian citizen and data subject possesses statutory rights under Chapter IV of the NDPA:

• Right of Access: Right to obtain confirmation and a copy of personal data processed.
• Right to Rectification: Right to correct inaccurate, outdated, or incomplete records.
• Right to Erasure ("Right to be Forgotten"): Right to request data deletion, subject to overriding statutory AML record retention obligations (e.g. 5-year MLPPA mandate).
• Right to Restrict Processing: Right to limit processing during verification disputes.
• Right to Data Portability: Right to receive data in a structured, machine-readable format.

TopLogical has designated an independent Data Protection Officer (DPO) registered with the NDPC. The DPO monitors internal compliance, conducts staff data privacy training, provides expert counsel on Data Protection Impact Assessments (DPIAs), and serves as the primary liaison with regulatory authorities.

TopLogical implements state-of-the-art security safeguards:

• AES-256 encryption at rest across all PostgreSQL databases and document vaults.
• TLS 1.3 encryption in transit for all client-facing REST APIs and WebSocket telemetry.
• Strict multi-tenant data separation preventing cross-client data contamination.
• Pseudonymization and tokenization of high-risk customer identifiers (BVN, NIN).

TopLogical adheres to Sections 41, 42, and 43 of the NDPA 2023. Primary financial transaction records and customer biometrics are stored within verified infrastructure adhering to Nigerian data residency requirements. Any cross-border transmission to international cloud providers requires verified Standard Contractual Clauses (SCCs) and NDPC adequacy decisions.

Where a personal data breach occurs that is likely to result in a risk to the rights and freedoms of individuals, TopLogical will notify the Nigeria Data Protection Commission (NDPC) and affected data controllers within seventy-two (72) hours of becoming aware of the incident, in strict adherence to Section 40 of the NDPA.

A Data Protection Impact Assessment (DPIA) is mandatory before deploying new AI models or high-risk algorithmic scoring pipelines. TopLogical engages licensed Data Protection Compliance Organizations (DPCO) to perform annual data protection compliance audits filed with the NDPC.