Data Protection Statement
Updated 1 October 2026
Nigeria Data Protection Act 2023 (NDPA), overseen by the Nigeria Data Protection Commission (NDPC)
1. Our Commitment to Data Protection
NEM Insurance PLC ("we", "us", or "our") is committed to protecting the privacy and personal data of all users of NEM Salvage Salvage Auction Platform. Our processing is designed around:
- Nigeria Data Protection Act 2023 (NDPA) - the primary data protection law in Nigeria, enforced by the Nigeria Data Protection Commission (NDPC)
- NDPC regulations and guidance issued under the NDPA
- Insurance industry rules - NAICOM requirements applicable to insurer salvage disposal
2. Data Protection Principles
We adhere to the following data protection principles as required by NDPA 2023:
2.1 Lawfulness, Fairness, and Transparency
We process personal data lawfully, fairly, and in a transparent manner. We clearly communicate how we collect, use, and protect your data.
2.2 Purpose Limitation
We collect personal data for specified, explicit, and legitimate purposes only. We do not process data in a manner incompatible with those purposes.
2.3 Data Minimization
We collect only the personal data that is adequate, relevant, and limited to what is necessary for the purposes for which it is processed.
2.4 Accuracy
We take reasonable steps to ensure personal data is accurate and kept up to date. Inaccurate data is erased or rectified without delay.
2.5 Storage Limitation
We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law (6 years for financial records, 5 years after account closure for KYC data).
2.6 Integrity and Confidentiality
We implement appropriate technical and organizational measures to ensure data security, including protection against unauthorized or unlawful processing and accidental loss, destruction, or damage.
2.7 Accountability
We are responsible for applying these principles and keep records of our processing, consents and staff access to identity documents.
3. Legal Basis for Processing
We process personal data based on the following lawful grounds under NDPA 2023:
- Consent: You give explicit consent before identity verification (BVN, NIN, ID documents, face/liveness checks) and their sharing with Dojah; we record the time and version of each consent
- Contract Performance: Processing is necessary to perform our contract with you (auction participation, payments)
- Legal Obligation: Processing is required to comply with Nigerian laws (KYC/AML, tax reporting, insurance regulations)
- Legitimate Interests: Processing is necessary for our legitimate business interests (fraud prevention, platform improvement)
4. Data Subject Rights
Under NDPA 2023, you have the following rights regarding your personal data:
Your Rights:
- ✓ Right to Access: Request copies of your personal data
- ✓ Right to Rectification: Correct inaccurate or incomplete data
- ✓ Right to Erasure: Request deletion of your data (subject to legal obligations)
- ✓ Right to Restrict Processing: Limit how we use your data
- ✓ Right to Data Portability: Receive your data in a structured, machine-readable format
- ✓ Right to Object: Object to processing based on legitimate interests
- ✓ Right to Withdraw Consent: Withdraw consent at any time (where consent is the legal basis)
- ✓ Right to Lodge a Complaint: File a complaint with the Nigeria Data Protection Commission (NDPC)
How to Exercise Your Rights: Contact our Data Protection Officer atsupport@salvagebridge.com. We aim to respond within 30 days.
5. Data Security Measures
We implement comprehensive technical and organizational security measures:
Technical Measures
- • TLS encryption in transit
- • BVN and NIN encrypted in the database
- • Identity and payment documents stored privately, shown via short-lived links
- • Risk-based multi-factor sign-in
- • Rate limiting of sign-in and verification requests
- • Automated database backups
Organizational Measures
- • Role-based access control
- • Audit logs of staff access to identity documents
- • Incident response procedures
6. Data Breach Notification
We have procedures for managing personal data breaches as required by the NDPA:
72-Hour Notification Requirement
In the event of a personal data breach, we will:
- 1. Notify the Nigeria Data Protection Commission (NDPC) within 72 hours
- 2. Notify affected data subjects without undue delay
- 3. Provide details of the breach, its likely consequences, and remedial measures
- 4. Document all breaches in our breach register
7. International Data Transfers
The following service providers process personal data outside Nigeria. Each transfer relies on the safeguard shown, as permitted by the NDPA:
- Supabase (Project hosting region (outside Nigeria)): Standard contractual clauses / contractual safeguards per NDPA
- Vercel (United States and global edge network): Standard contractual clauses / contractual safeguards per NDPA
- Cloudinary (United States): Standard contractual clauses / contractual safeguards per NDPA
- Upstash (Project hosting region (outside Nigeria)): Standard contractual clauses / contractual safeguards per NDPA
- Resend (United States): Standard contractual clauses / contractual safeguards per NDPA
- Termii and Africa's Talking (Nigeria and Kenya): Standard contractual clauses / contractual safeguards per NDPA
- Sentry (United States): Standard contractual clauses / contractual safeguards per NDPA
- Google (United States and other Google regions): Standard contractual clauses / contractual safeguards per NDPA
- Anthropic (United States): Standard contractual clauses / contractual safeguards per NDPA
- TinyPNG (Netherlands): Standard contractual clauses / contractual safeguards per NDPA
- OpenStreetMap (Nominatim) (European Union / United Kingdom): Standard contractual clauses / contractual safeguards per NDPA
8. Data Protection Officer (DPO)
Our Data Protection Officer (DPO) is responsible for:
- Monitoring how we apply the NDPA
- Advising on data protection impact assessments
- Serving as the point of contact for data subjects and the NDPC
Contact Our DPO:
Email: support@salvagebridge.com
Phone: 08141252812
Address: 199 Ikorodu-Ososun Road, Obanikoro, Lagos 100232, Lagos, Nigeria
9. Third-Party Data Processors
We engage the following service providers to process personal data on our behalf:
| Processor | Purpose | Location | Safeguard |
|---|---|---|---|
| Supabase | Database and private file storage | Project hosting region (outside Nigeria) | Standard contractual clauses / contractual safeguards per NDPA |
| Vercel | Application hosting | United States and global edge network | Standard contractual clauses / contractual safeguards per NDPA |
| Cloudinary | Storage and delivery of photos and documents (identity and payment documents are stored privately) | United States | Standard contractual clauses / contractual safeguards per NDPA |
| Upstash | Caching, rate limiting and short-lived session data | Project hosting region (outside Nigeria) | Standard contractual clauses / contractual safeguards per NDPA |
| Resend | Transactional email | United States | Standard contractual clauses / contractual safeguards per NDPA |
| Termii and Africa's Talking | SMS delivery (one-time codes and key auction notices) | Nigeria and Kenya | Standard contractual clauses / contractual safeguards per NDPA |
| Sentry | Error monitoring | United States | Standard contractual clauses / contractual safeguards per NDPA |
| Paystack | Card and bank payments, wallet top-ups, refunds and payouts | Nigeria | Processed in Nigeria under a data processing agreement |
| Dojah | Identity verification (BVN, NIN, ID documents, face/liveness checks, business registration) | Nigeria | Processed in Nigeria under a data processing agreement |
| Gemini AI (damage analysis), Maps and geocoding (asset locations), Cloud Vision / Document AI (document text extraction) | United States and other Google regions | Standard contractual clauses / contractual safeguards per NDPA | |
| Anthropic | Fallback AI analysis of case photos | United States | Standard contractual clauses / contractual safeguards per NDPA |
| TinyPNG | Image compression before storage | Netherlands | Standard contractual clauses / contractual safeguards per NDPA |
| OpenStreetMap (Nominatim) | Converting photo GPS coordinates into an approximate address | European Union / United Kingdom | Standard contractual clauses / contractual safeguards per NDPA |
10. Automated Processing & Fraud Prevention
- Location on case photos: photos taken for salvage cases may include GPS coordinates and device details, which we store with the photo to evidence where and when an asset was inspected.
- Device and IP logging: we record IP address, device type and browser for sign-ins, bids and payments to prevent fraud and investigate disputes.
- Risk-based sign-in checks: a sign-in from an unfamiliar device or context may require an extra one-time code.
- Automated fraud scoring: bidding and account activity is scored automatically. A high score is sent to a member of staff, who reviews it before any suspension is decided. You can ask for a human review of, or appeal against, any such decision by emailing support@salvagebridge.com.
- AI-assisted assessment: case photos are analysed by AI providers to estimate damage and value. These estimates support staff decisions; they are not automated decisions about you.
11. Filing a Complaint with NDPC
If you believe we have not adequately addressed your data protection concerns, you have the right to lodge a complaint with the Nigeria Data Protection Commission:
Nigeria Data Protection Commission (NDPC)
Website: www.ndpc.gov.ng
Current contact details and the complaint process are published on the NDPC website.
12. Updates to This Statement
We review and update this Data Protection Statement when there are material changes to our data processing activities or applicable laws. The "Last Updated" date at the top of this page indicates when this statement was last revised.