Data Protection

Roles

For verification requests, the customer is the data controller and Semper Technologies Ltd is its data processor. We process request data only on the customer’s documented instructions, which are the API requests it sends, and only to provide the service. For account, workspace and website data we are the controller, as our Privacy Policy explains.

What customers must do

• Have a lawful basis and a defined purpose for every check, and give the notices the law requires.
• Send only the identifiers and details the check needs. Keep identity numbers out of URLs, analytics, support messages and general application logs.
• Call the API from your servers only, and keep keys in a secret store.
• Apply your own retention period to results and references, and delete what you no longer need.

How we protect data

• All traffic to the website, console and API is encrypted in transit over HTTPS.
• API secrets and webhook signing secrets are shown once and can be rotated or revoked at any time. Keys are scoped to the checks they may call.
• Live access requires an approved business verification and two-factor sign-in.
• Request logs store payloads masked. Webhook deliveries carry sanitised payloads and an HMAC-SHA256 signature.
• Business verification documents are uploaded and opened only through short-lived private links, and every upload is checked for integrity and scanned for malware.
• Account holders can see their active sessions and recent security events, and revoke any session.

Sub-processors and transfers

We use the identity and registry sources each check queries, a payment partner for wallet top-ups, and providers for hosting and email. Each is bound by obligations that protect the data to the standard in these rules. Where data leaves Nigeria, we transfer it only as the Nigeria Data Protection Act 2023 permits.

Retention and deletion

We keep verification records and logs only for as long as we need them to provide the service, bill accurately, resolve disputes and meet our legal and regulatory obligations, then delete or anonymise them. When a customer deletes its workspace, we delete its data except where the law requires us to keep it.

Requests and incidents

If an individual contacts us about a verification a customer made, we refer them to that customer and help it respond. If we become aware of a personal data breach affecting a customer’s data, we notify that customer without undue delay and notify the Nigeria Data Protection Commission within the 72 hours the law requires.

Contact us about data protection through the contact page, or open a support ticket from the console.