1. Who is responsible
Servixus Limited is the data controller. Website: https://www.servixus.com. Registered office: [Insert CAC registered office], Nigeria. Data Protection Officer: dpo@servixus.com. Privacy requests: privacy@servixus.com. Support: support@servixus.com. Account deletion: https://www.servixus.com/delete-account.
2. What we collect
- Account: name, phone, email, role, device and login security data.
- Customer: addresses, job descriptions, photos/videos of the fault.
- Artisan: trades, service areas, portfolio, bank account for payouts.
- KYC (artisans only, with separate consent): BVN, NIN, ID image, optional live selfie.
- Jobs: quotes, chat, completion events, reviews, dispute files.
- Payments: Paystack references, amounts, payout batch status.
- Optional: whether you paid extra off the app after a job (skippable).
3. Why we use it, and the legal basis
| Why | Legal basis |
|---|---|
| Run your account, jobs, chat and reviews | Contract |
| Collect payment and pay artisans weekly | Contract; legal duty (tax / payments) |
| Verify artisan identity (BVN / NIN) | Explicit consent; contract to onboard; legal duty if payments rules require it |
| Stop fraud, abuse and off-app leakage | Legitimate interests; legal duty |
| SMS / email about your job | Contract |
| Optional extra-payment question | Consent (you may skip) |
| Answer NDPC, FCCPC, CBN or police | Legal obligation |
4. Who we share with
We do not sell your data. We share the minimum needed with: the other party on a job; Paystack; Dojah (current KYC provider) and NIMC/NIBSS for verification; Termii (SMS) and the contracted email host; cloud storage for photos; and regulators or police when the law requires it. Customers never see an artisan’s BVN or NIN — only a badge.
5. Transfers outside Nigeria
Some vendors may process data outside Nigeria. We only do that with an NDPA-compliant mechanism (adequacy, approved clauses, or another lawful basis). Nigerian payment-transaction data will be stored as CBN localisation rules require (in-country from 1 January 2027 as published).
6. How long we keep it
Active account: for as long as you use Servixus. KYC pack: typically up to 5 years after last payout or closure. Job, chat, payment and dispute files: typically 6 years. OTP logs: a few months. After that we delete or anonymise, unless a legal hold applies.
7. Your rights
You may access, correct, erase (with legal exceptions), restrict, object, withdraw consent, and port your data. You will not be subjected to a solely automated ban, KYC reject or dispute decision. Email privacy@servixus.com or use https://www.servixus.com/privacy-requests. Delete your account at https://www.servixus.com/delete-account or in Settings. You may complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
8. Security and breaches
We use TLS, access control, webhook checks and audit logs. If a breach is likely to put you at high risk, we will tell you and notify the NDPC within 72 hours where the Act requires it.
9. Children
Servixus is for people 18 and over. We do not knowingly collect children’s data.
10. More detail
This is the short notice. The full Privacy Policy explains processors, retention tables, DPIA, DCPMI registration and how to delete your account. Opening the full Policy is not the same as giving KYC consent.