Data Processing Policy

Introduction

This Data Processing Policy explains how UPVS processes personal data in compliance with applicable data protection laws, including the Nigeria Data Protection Regulation (NDPR) and other relevant international standards.

Data Processing Principles

We adhere to the following principles when processing personal data:

• Lawfulness, fairness, and transparency: We process personal data lawfully, fairly, and in a transparent manner.
• Purpose limitation: We collect personal data for specified, explicit, and legitimate purposes.
• Data minimization: We only process personal data that is adequate, relevant, and limited to what is necessary.
• Accuracy: We ensure personal data is accurate and kept up to date.
• Storage limitation: We keep personal data in a form that permits identification for no longer than necessary.
• Integrity and confidentiality: We process personal data in a manner that ensures appropriate security.

Legal Basis for Processing

We process personal data based on one or more of the following legal grounds:

Consent

We process personal data when you have given clear consent for specific purposes.

Contractual Necessity

We process personal data when necessary for the performance of a contract with you.

Legal Obligation

We process personal data when necessary to comply with a legal obligation.

Legitimate Interests

We process personal data when necessary for our legitimate interests, provided these interests are not overridden by your rights and interests.

Categories of Personal Data

We process the following categories of personal data:

Data Category	Examples	Purpose
Identity Data	Name, username, government ID numbers	User authentication, account management
Contact Data	Email address, phone number, physical address	Communication, service delivery
Financial Data	Payment card details, bank account information	Payment processing, billing
Technical Data	IP address, browser type, device information	System administration, security
Usage Data	Website usage, service interaction patterns	Analytics, service improvement
Metering Data	Energy consumption, vending transactions	Service provision, billing

Data Processing Activities

Collection

We collect personal data directly from you when you register for our services, use our platforms, or interact with our customer support.

Storage

We store personal data on secure servers with appropriate technical and organizational measures to protect against unauthorized access.

Usage

We use personal data to provide, maintain, and improve our services, process transactions, and communicate with you.

Sharing

We may share personal data with trusted third parties who assist us in operating our services, conducting our business, or servicing you.

Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, or reporting requirements.

Data Security

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit and at rest
• Regular security assessments and testing
• Access controls and authentication mechanisms
• Physical security measures for data centers
• Incident response and breach notification procedures

Data Transfers

We may transfer personal data to countries outside Nigeria. When we do so, we ensure appropriate safeguards are in place, such as:

• Adequacy decisions by relevant authorities
• Standard contractual clauses
• Binding corporate rules
• Certification mechanisms

Data Subject Rights

You have the following rights regarding your personal data:

• Right to access: You can request copies of your personal data.
• Right to rectification: You can request correction of inaccurate or incomplete data.
• Right to erasure: You can request deletion of your personal data in certain circumstances.
• Right to restrict processing: You can request limitation of how we use your data.
• Right to data portability: You can request transfer of your data to another organization.
• Right to object: You can object to certain types of processing.
• Rights related to automated decision-making: You have rights regarding automated decision-making and profiling.

Data Protection Officer

We have appointed a Data Protection Officer (DPO) to oversee compliance with this policy and data protection laws. You can contact our DPO at:

Email: dpo@upvs.com.ng

Changes to This Policy

We may update this Data Processing Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last Updated" date.