Privacy Notice

Docufast Integrated Services Limited ("Docufast", "we") is a company registered in Nigeria under the Companies and Allied Matters Act 2020, RC 1893484, at Suite 100, Adebola House, 38 Opebi Road, Ikeja, Lagos. We run docufast.ng and its WhatsApp support line. We decide how your personal data is used for our services, so we are the data controller under the Nigeria Data Protection Act 2023 (NDPA). Our registration with the Nigeria Data Protection Commission is NDPC/DCP/07770.

Data Protection Officer: Sheriff Lasisi, privacy@docufast.ng. This notice is issued under the NDPA, and references to sections are to the NDPA.

Identity documents, photos and signatures

To prepare and file your document, we ask for your government-issued ID, NIN, a passport photograph, your signature and, for some services, a supporting document. We use them only to prepare, swear, file or publish the document you ordered, to check your identity as required by anti-money laundering laws, and to check that the details are correct. They are shared only with the people who must see them to complete your order: the Commissioner for Oaths or court registry, the Corporate Affairs Commission, the newspaper placing your notice, and our licensed identity verifier where an identity check is required. They are stored securely, opened only by the staff handling your order, and every view is recorded. We keep them for 6 months after your order is created if it is unpaid, and for 5 years after your order is completed if it is paid, as a financial and legal record. We then delete them, unless the law requires us to keep them longer, or unless we need them to establish, exercise or defend a legal claim.

We do not sell your data. We do not use it to make automated decisions that have legal effects on you; fraud alerts are always reviewed by a person.

Only what each one needs to do its part of your order:

• Courts and commissioners for oaths, to swear and commission affidavits.
• Government registries, such as the Corporate Affairs Commission and the National Population Commission, when you order a filing or application.
• Newspapers, for the notice you order and approve.
• Our licensed identity verifier, to check your NIN or BVN and face match.
• Payment providers, to take your payment on docufast.ng.
• Technology suppliers that host our platform, store encrypted files and send messages, under written data processing agreements. Some of them, such as our database host and our email provider, also use limited account and usage information for their own purposes as separate controllers, under their own privacy notices.
• People you choose, when you share a document or give an agent, accountant or AI assistant access in your account.
• Authorities, when the law requires it, such as a court order or a report required by the Money Laundering (Prevention and Prohibition) Act 2022.

Some of our technology suppliers store or process data outside Nigeria, in Ireland, Western Europe and the United States. We transfer personal data outside Nigeria only where the NDPA allows it, and we record the legal basis for each transfer before it happens. Where the destination country has not been approved by the Nigeria Data Protection Commission and no approved transfer instrument is in place, we rely on the transfer being necessary to perform our contract with you (section 43(1)(b) of the NDPA), for example to store your documents in the Vault or to process your order. We record this in our records of processing and our cross-border transfer register, and we will move to an approved transfer instrument once the Commission publishes one.

Legal hold: we may keep data beyond these periods where required by law, a court order or a regulatory investigation, or where necessary to establish, exercise or defend legal claims.

Data is encrypted in transit and at rest. Files you upload are encrypted on your device with a key only you hold, so our staff cannot open them. Documents we prepare are handled only by the staff working on your order. Every view, download, share and print of a document is logged for everyone, including our own leadership, and nobody can delete those entries. Accounts use email and password, with two-step sign-in through an authenticator app on every account. If a breach puts your data at risk, we tell the Nigeria Data Protection Commission within 72 hours and tell you without delay.

You can ask us to: tell you what we hold and give you a copy, correct it, delete it unless the law requires us to keep it, or limit how we use it (s.34); object to some uses (s.36); not be subject to decisions based solely on automated processing (s.37); move it to you in a common format (s.38); and withdraw consent at any time, without affecting what was done before (s.35). Email privacy@docufast.ng or use Privacy choices in your account. We acknowledge your request within 2 working days and respond in full within 30 days. You may also complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

Our services are for adults (18 and over). A parent or guardian may order services that involve a child, such as an age declaration or birth registration; we verify the parent or guardian's identity and their consent first, and apply the strictest access controls to children's data.

Analytics. If you agree, we use PostHog to measure how our website is used: pages visited, steps completed in an order, the language and type of device used, and how you reached us. We do this to improve the service (consent, NDPA s.25(1)(a)). PostHog stores this data in the European Union on our behalf. We do not record your screen, we discard your IP address, and we never send PostHog your name, contact details, identity numbers, payment details or the content of your documents. We keep analytics data for 13 months, and you can withdraw consent at any time in Privacy choices; withdrawing stops new analytics data being collected. Essential storage that keeps you signed in and your order saved does not need consent.

We will post any change here with a new date, and tell you directly about important changes. Questions: privacy@docufast.ng, or write to the Data Protection Officer at our registered address.