Privacy Policy
How Pynpoint collects, uses and protects personal data.
1. Who we are
Pynpoint Nig Ltd ("Pynpoint", "we", "us") is a company incorporated in Nigeria with registration number RC100271 and registered office at 151 Lola Holloway Street, Omole Phase 1, Ikeja, Lagos State. We provide physical address verification services to regulated businesses such as banks, lenders, fintechs and insurers.
This policy explains how we handle personal data under the Nigeria Data Protection Act 2023 (the "NDPA") and the directives of the Nigeria Data Protection Commission (the "NDPC").
Contact for data protection matters: [NAME AND ROLE], [EMAIL ON OUR DOMAIN], [PHONE].
2. Our two roles — please read this section
Whether we are a data controller or a data processor depends on what we are doing, and it affects how you exercise your rights.
- As a data processor: when a bank, lender or other business instructs us to verify an address, we act on that organisation’s instructions. That organisation is the data controller, and its own privacy notice governs why your data was collected in the first place. If you want data deleted or corrected in that context, we will direct you to them and assist them in responding.
- As a data controller: we decide the purposes of certain processing ourselves — our own record of verified addresses, our quality assurance and fraud detection, our defence of disputes about work we carried out, and everything to do with our staff and field agents. For those activities this policy governs our use of the data and we answer to you directly.
3. Personal data we handle
| Category | Examples | Whose data |
|---|---|---|
| Identity and address details | Name; residential or business address; local government area; landmark; whether the address is residential or a business | The person or business being verified |
| Contact details | A telephone number, where the instructing organisation chooses to provide one. It is not required, and many verifications are carried out without it | The person being verified |
| Location data | Coordinates recorded when the agent confirms arrival and at the moment each photograph is taken, together with the accuracy reading of the device | The premises being verified |
| Photographic evidence | Photographs of the property exterior, gate, street and landmark, captured inside our Agent App. For a business, signage, frontage and the surrounding area | The premises visited |
| Field observations | What the agent recorded on site: the building and its features, how the street is numbered, whether the house number was visible, how long the occupant is said to have lived or traded there, and for a business what it does and who operates it | The person or business being verified |
| Occupancy confirmation | Confirmation of who resides or operates at the address, and the name given for that person | The occupant, who may be someone other than the subject |
| Corroborating statements | A short record of what a neighbour, security officer or other person present said when confirming occupancy, and enough detail to identify who gave it | Neighbours and other third parties — see section 6 |
| Verification outcome | Whether the address was confirmed, not confirmed or inconclusive, the assurance band reached, and the measurements behind it | The person being verified |
| Client account data | Names, work email addresses, telephone numbers, roles and login credentials of users of our client portal, and their activity in it | Our client organisations’ staff |
| Field agent data | Identity document and type, photograph or selfie, home area and address, means of transport, bank account details and the name resolved against them, tax identification where required, guarantor name, telephone number and relationship, training and performance records, and device location during an assigned job | Our field agents — see section 7 |
We do not ask for or require a Bank Verification Number, National Identification Number, bank details or payment card information from the person whose address is being verified. Our field agents are shown only the minimum needed to complete a visit: the requesting organisation, the subject’s name, and the address.
4. Why we handle it, and our lawful basis
| Purpose | Lawful basis | Our role |
|---|---|---|
| Carrying out a verification requested by a client | Performance of our contract with the client, and the client’s legal obligation under customer due diligence rules | Processor |
| Screening a submitted address before dispatch | Performance of our contract with the client | Processor |
| Producing a sealed report and audit trail | Legal obligation; our legitimate interest in accountability and dispute resolution | Processor / Controller |
| Contacting the person being verified, where the client permits it | The client’s legal obligation; our legitimate interest in completing the verification accurately | Processor |
| Detecting and preventing fraud, including falsified field submissions | Our legitimate interest, and the client’s legal obligation | Controller |
| Confirming occupancy with a neighbour where the subject is unavailable | Our legitimate interest and the client’s in preventing financial fraud | Controller |
| Repeat verification of the same address at a client’s request | Performance of our contract with the client; the client’s ongoing monitoring obligations | Processor |
| Managing, paying and vetting our field agents | Performance of the engagement contract; legal obligation in respect of tax; legitimate interest in safety and evidence integrity | Controller |
| Contacting an agent’s guarantor | Our legitimate interest in vetting the people we send to private premises | Controller |
5. Our record of verified addresses
When a verification is completed we retain a record of the address and what was established about it, separately from the report delivered to the client. We do this so that a later verification of the same premises does not have to repeat a visit unnecessarily, and so that we can detect patterns indicating fraud — for example, the same address presented under several unrelated identities.
For that record we are the controller, and this policy governs it. Where a previously verified address is reused for a different client, we do so only where a lawful basis permits it.
7. If you gave a statement about someone else’s address
This section is for neighbours, security officers, shopkeepers, caretakers and anyone else who confirmed to one of our agents that a person lives or trades at an address. You have no relationship with us or with the organisation that requested the verification, and you did not ask to be involved, so you are entitled to a plain explanation.
What we record. What you told us, in substance rather than as a quotation, and enough about who you are to show that the confirmation came from a real and identifiable person independent of the subject. We do not photograph you, and our agents are instructed not to photograph bystanders.
Why we record it. A verification that cannot show who corroborated it is worth very little in a dispute or an audit. Our basis is our legitimate interest, and our client’s, in preventing financial fraud.
Who sees it. Your statement forms part of the report delivered to the requesting organisation. It is not published, it is not shared with the person whose address was verified unless we are lawfully required to disclose it, and it is never used for marketing.
What you can do. You may decline to say anything at all when an agent approaches you, and nothing follows from declining. If you have already given a statement, you may object to our holding it, ask for a copy of what we recorded, ask us to correct it, or complain to the NDPC.
8. If you work with us as a field agent
Field agents are the people who carry out visits. Because a verification is only as reliable as the person who performed it, we hold more about our agents than about most of the people covered by this policy, and we are the controller for all of it.
Before an agent is activated we verify their own home address, confirm that the name on their bank account matches their identity records, collect identity documents and a photograph, and contact the guarantor they nominate. While an agent is carrying out an assigned job, our application records device location and accuracy at arrival and at each photograph, so that the evidence on the report can be relied upon. We do not record an agent’s location outside an assigned job, and we do not use location data for any purpose other than evidence integrity, safety and payment.
Agents are engaged as independent contractors. Where tax law requires it, we collect a tax identification number and deduct and remit tax on payments made, and provide the agent with the corresponding record.
Quality assurance reviewers assess each submission and record a rating against the agent. Those ratings affect which work an agent is offered. An agent may ask for the reasons behind a rating and may contest it.
Agents receive a fuller explanation of all of this in their engagement documentation.
9. If you were named as an agent’s guarantor
When someone applies to become a field agent, they are asked to nominate a guarantor. If you were named, we will contact you once to confirm that you are willing to stand for that person. We hold only your name, telephone number, your stated relationship to the applicant, and whether you confirmed.
You are free to decline, and we will record that and inform the applicant that their nomination was not confirmed. You may ask us what we hold about you, ask us to correct it, or ask us to delete it, in which case the applicant will be asked to nominate someone else.
11. International transfers
Some of the services we rely on — including cloud hosting, network and security services, mapping and geocoding, email delivery and payment processing — are operated by providers whose infrastructure is located outside Nigeria. Where personal data is transferred outside Nigeria we do so only in accordance with the transfer provisions of the NDPA, relying on [SAFEGUARD TO BE CONFIRMED PER PROVIDER], and you may ask us for details of the safeguards applied.
12. How long we keep it
| Record | Retention |
|---|---|
| Verification records and reports | 5 years after completion, in line with anti-money-laundering record-keeping expectations |
| Photographic evidence | Proposed 5 years, matching the report it supports. |
| Audit trail | At least 5 years, unaltered |
| Our record of verified addresses | 5 years after completion |
| Corroborator identity and statement | Would not outlast the report it supports] |
| Agent device location for a job | Proposed 90 days |
| Agent identity, vetting and guarantor records | Duration of engagement plus a defined period |
| Client portal account and activity data | Duration of the client relationship plus a defined period |
13. Your rights under the NDPA
Subject to the conditions in the Act, you have the right to be informed about how your data is used, to request access to it, to request correction of data that is inaccurate or incomplete, to request deletion where there is no lawful reason for us to keep it, to object to processing based on legitimate interest and to withdraw consent where consent is our basis, to request restriction of processing while a dispute is resolved, to data portability where applicable, and to lodge a complaint with the Nigeria Data Protection Commission.
To exercise a right, contact us using the details in section 1. We will respond within [30] days. Where we processed your data on a client’s instruction, we will forward your request to that client and support their response. We may ask you to confirm your identity before we disclose data, which is a safeguard for you.
14. How we protect your data
- Access is restricted by role on a least-privilege basis, and every access and change is recorded in an append-only audit trail.
- Every completed report is sealed with a cryptographic hash so that any later alteration is detectable.
- Photographic evidence must be captured inside our Agent App, with location recorded at the moment of capture. Uploads from a device gallery are rejected.
- Field agents are not given the subject’s telephone number. Where a call is necessary, a Pynpoint coordinator places it.
- Credentials and access keys are stored only in hashed form, never in readable text, and client portal accounts support two-factor authentication.
- Data is transmitted over encrypted connections, and our field agents are vetted before deployment and trained in their data-protection obligations.
- Field agents work on their own devices and are shown only the requesting organisation, the subject’s name and the address. Where there is no network connection, a completed submission is held on the agent’s device until it can be sent. Agents are required to send it as soon as a connection is available and in any event the same day, to keep the device locked, to report a lost or stolen device immediately, and not to copy, screenshot or store job information anywhere outside our Agent App. Access is withdrawn as soon as an agent’s engagement ends.
15. Field visits — what to expect
If a Pynpoint agent visits your address, they will identify themselves, give their Pynpoint identification, tell you which organisation requested the verification, and confirm only what is necessary: whether you reside or operate at that address. They will photograph the property exterior, not the inside of your home, and they are instructed not to photograph people or bystanders. For a business verification, photographs may include signage and publicly visible frontage, and the agent may ask a representative of the business questions about it.
You may ask to see their identification, and you may decline to answer. If you decline, we will record the visit outcome accordingly and inform the requesting organisation. We will not press you, and we will not attempt to obtain the information another way without a lawful basis.
Some clients ask us to verify an address without contacting the person first. Where that is the case, the first you may know of the verification is when an agent attends. The organisation that holds your account is responsible for telling you, in its own privacy notice, that it carries out address verification.
16. Children
Our services are directed at verifying the addresses of adults in a financial services context. We do not knowingly verify the address of a person under 18 other than as part of a household occupancy confirmation, and we do not knowingly collect a child’s personal data for any other purpose. Applicants to become field agents must be adults.
17. Changes and contact
We may update this policy. The version in force and its effective date will always appear here. For any question, or to exercise a right, contact us using the details in section 1 or write to Pynpoint Nig Ltd, 151 Lola Holloway Street, Omole Phase 1, Ikeja, Lagos State, Nigeria. You may also complain to the Nigeria Data Protection Commission.