Privacy Policy

1. Commitment to NDPA Compliance

The Digital Financial Flow Monitoring System (DFFMS), managed by the National Co-ordination Office (NCO) for the Special Agro-Industrial Processing Zones (SAPZ) programme, is committed to protecting the privacy, confidentiality, and security of personal and institutional data. DFFMS is designed to operate in alignment with the Nigeria Data Protection Act (NDPA) of 2023, subject to the programme's required assessments, records and accreditation decisions.

2. Legal Basis for Processing Personal & Institutional Data

We process your data under one or more of the following lawful bases defined by the NDPA:

• Public Interest & Mandate Execution: Processing is necessary for the performance of tasks carried out in the public interest under the Federal Ministry of Agriculture and Food Security (FMAFS).
• Contractual Necessity: Verifying eligibility and disbursement requirements for cooperatives, agribusinesses, and financial intermediaries participating in the SAPZ program.
• Legal Obligation: Ensuring compliance with Central Bank of Nigeria (CBN) rules, anti-money laundering (AML) protocols, and federal auditing requirements.
• Explicit Consent: Provided by cooperative heads and agribusiness operators upon enrollment into state-level value chain programs.

3. Data Categories Collected & Processed

To guarantee full traceability of development funding, we collect and process the following information:

• Portal Operator Credentials: Full name, official government or institutional email address (personal accounts are restricted), phone numbers, assigned roles, and authentication attributes (MFA tokens and device passkeys).
• Farmer & Cooperative Profiles: Identity verification data, cooperative names, state/zonal locations, coordinates of farm clusters, value chain commodities (ginger, cocoa, cassava, dairy, etc.), and farm yield assessments.
• Financial Transaction Records: Transaction IDs, disbursement amounts, bank accounts, linked NIRSAL credit guarantees, NAIC index-based crop insurance data, and uploaded proof-of-performance invoices.
• Telemetry & Session Logs: Physical IP addresses, browser footprints, page navigation history within secure views, audit trail events, and download logs.

4. Database Architecture & Row-Level Security (RLS)

We employ advanced multi-tenant isolation technologies to ensure that sensitive data remains locked to authorized parties:

• Row-Level Separation: The Neon PostgreSQL database operates under strict RLS policies. When a state coordinator logs in, their session attributes restrict database queries. A Kaduna State coordinator cannot view, search, or edit data belonging to Kwara, Imo, or Cross River states.
• Credential Segregation: User credentials and multi-factor hashes are stored in separate, isolated tables protected by cryptographic verification models.

5. Data Sovereignty & Hosting Environment

DFFMS currently uses Vercel for application delivery and Neon PostgreSQL in the EU Central region for its authoritative database. These approved service providers may process data outside Nigeria under applicable contractual, security, and cross-border transfer safeguards.

Production handling of government personal data remains subject to completion of the programme's NDPA/NDPC data-residency assessment, transfer documentation, retention decisions, and accreditation gates. DFFMS does not represent the current deployment as locally hosted where that has not yet been established.

6. Cryptographic Protection & Session Security

We implement industry-standard cryptographic techniques to secure data throughout its operational lifecycle:

• In Transit: All HTTP calls are encrypted using Transport Layer Security (TLS 1.3). Access attempts via unencrypted protocols (HTTP) are blocked automatically.
• At Rest: Tables containing personal profiles, coordinates, bank accounts, and credentials are encrypted using AES-256 keys.
• Session Expiry: Active user tokens expire automatically after 15 minutes of inactivity. High-privilege actions (such as initiating or checker-approving disbursements) require step-up MFA challenge confirmations.

7. Data Retention & Append-Only Record Rules

DFFMS keeps transaction logs for the entire duration of the SAPZ project lifecycle, plus an additional statutory audit window of 7 years post-project closure to satisfy donor and national auditor requirements.

Because DFFMS utilizes an append-only ledger system, completed transactions cannot be deleted. Corrections are handled by posting balancing adjustment transactions, ensuring the historical ledger database remains chronologically intact.

8. Sharing, Disclosure & Multilateral Partners

We do not monetize, rent, or trade personal data. Data is shared strictly with verified project partners to execute de-risking and disbursement approvals:

• NIRSAL: Sharing transaction amounts and coordinates to validate Credit Risk-Sharing Guarantees.
• NAIC & NAICOM: Sharing cooperative profiles to trigger index-based crop insurance underwriting and claims.
• FMAFS & State Governments: Providing aggregated, de-identified dashboards monitoring gender/youth participation, infrastructure progress, and overall value chain performance.
• Approved infrastructure processors: Vercel and Neon provide application and database infrastructure under configured access controls and contractual safeguards.
• Optional public-page translation: When you choose Pidgin, Hausa, Yorùbá, or Igbo, the visible public-page text and normal request metadata are sent to Google Translate. Translation is not enabled on signed-in account or administrative pages and translated text is informational, not an authoritative programme decision.

9. Data Subject Rights Under the NDPA

Under the NDPA, registered farmers, agribusiness leads, and operators have specific data rights:

• Right of Access: The right to request confirmation of whether their personal data is being processed, and to obtain a copy of recorded files.
• Right to Rectification: The right to update inaccurate contact details, coordinates, or commodity focus mappings.
• Right to Restriction: The right to object to processing under certain conditions (such as disputing coordinate accuracy or yield entries).
• Right to Portability: The right to request structured exports of their profiles for transfer to other government programs.

10. Contacting the Data Protection Officer & Regulatory Referrals

If you have questions about this Privacy Policy, wish to exercise your data subject rights, or believe your data has been handled in violation of the NDPA, please contact the DFFMS Data Protection Officer at:

National Co-ordination Office (NCO), Special Agro-Industrial Processing Zones (SAPZ)
# 3 Aguleri Street, off Gimbiya Street, Area 11, Garki, Abuja, Nigeria.
Email: info@sapz.gov.ng

You also have the right to lodge complaints directly with the Nigeria Data Protection Commission (NDPC).