Nigeria
Data protection
This sets out the data-protection position for merchants in Nigeria, alongside the privacy policy. It says which of us is responsible for what, and how to exercise a right.
This is a draft. It says what Smilelink actually does, written plainly, and it is with our lawyers. The signed version publishes here before anyone can sign up, with the date it takes effect.
Who is responsible for what
For your business's own information, Smilelink is the controller. For your customers' information, you are the controller and Smilelink is the processor acting on your instruction.
That distinction matters: a request from one of your customers is yours to answer, and we give you the tools to answer it.
Lawful basis
Performing the contract with you; complying with legal obligations that apply to holding and moving money; and our legitimate interest in keeping the service secure and working.
Your rights
Access, correction, deletion, portability and objection. Export is self-service in the dashboard; the rest reaches a person, not a queue.
Transfers
Where data is processed outside the country it was collected in, it is under contractual protections at least equivalent to the local regime.
Breaches
We notify the regulator and the affected merchants within the required window, and we publish what happened once the facts are established.
Complaints
Raise it with us first — the WhatsApp button reaches a person. You can also complain to the data-protection regulator directly, and we will not treat that as a reason to close an account.