Privacy Policy

1. Introduction

NEM Insurance PLC ("we", "us", or "our") is committed to protecting your personal data and respecting your privacy rights. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use NEM Salvage Salvage Auction Platform.

We process personal data in line with the Nigeria Data Protection Act 2023 (NDPA), which is overseen by the Nigeria Data Protection Commission (NDPC). This policy should be read together with our Terms of Service and our Data Protection Statement.

2. Data Controller Information

3. Personal Data We Collect

3.1 Information You Provide

• Account Information: Name, email address, phone number, password
• Identity Verification Information: BVN, NIN, ID document images, face/liveness images (collected only with your explicit consent)
• Financial Information: Bank account details, bank-transfer proofs you upload; card details are entered with and processed by Paystack, not stored by us
• Business Information: Company name, business registration number (for corporate accounts)
• Communications: Messages, support tickets, feedback

3.2 Information Collected Automatically

• Device Information: IP address, browser type, device type, operating system
• Usage Data: Pages visited, time spent, clicks, bids placed
• Location Data: Approximate location based on IP address; GPS coordinates embedded in case inspection photos
• Cookies: See our Cookie Policy

3.3 Information from Third Parties

• Dojah: identity verification results, including face/liveness check results
• Paystack: payment transaction data

4. How We Use Your Data

We process your personal data for the following purposes:

4.1 Contract Performance

• Creating and managing your account
• Processing bids and auction transactions
• Facilitating payments and refunds
• Generating auction documents

4.2 Legal Compliance

• KYC/AML verification
• Fraud detection and prevention
• Responding to legal requests
• Tax reporting

4.3 Legitimate Interests

• Improving Platform functionality
• Sending service notifications
• Protecting against security threats, including error monitoring (Sentry, with personal data scrubbed)

4.4 Consent

• Identity verification (BVN, NIN, ID documents and face/liveness checks) and sharing these with Dojah

4.5 Security, Fraud Prevention and Automated Processing

• Location on case photos: photos taken for salvage cases may include GPS coordinates and device details, which we store with the photo to evidence where and when an asset was inspected.
• Device and IP logging: we record IP address, device type and browser for sign-ins, bids and payments to prevent fraud and investigate disputes.
• Risk-based sign-in checks: a sign-in from an unfamiliar device or context may require an extra one-time code.
• Automated fraud scoring: bidding and account activity is scored automatically. A high score is sent to a member of staff, who reviews it before any suspension is decided. You can ask for a human review of, or appeal against, any such decision by emailing support@salvagebridge.com.
• AI-assisted assessment: case photos are analysed by AI providers to estimate damage and value. These estimates support staff decisions; they are not automated decisions about you.

5. Data Sharing & Disclosure

We share your data with:

5.1 Service Providers

• Supabase: Database and private file storage (Project hosting region (outside Nigeria))
• Vercel: Application hosting (United States and global edge network)
• Cloudinary: Storage and delivery of photos and documents (identity and payment documents are stored privately) (United States)
• Upstash: Caching, rate limiting and short-lived session data (Project hosting region (outside Nigeria))
• Resend: Transactional email (United States)
• Termii and Africa's Talking: SMS delivery (one-time codes and key auction notices) (Nigeria and Kenya)
• Sentry: Error monitoring (United States)
• Paystack: Card and bank payments, wallet top-ups, refunds and payouts (Nigeria)
• Dojah: Identity verification (BVN, NIN, ID documents, face/liveness checks, business registration) (Nigeria)
• Google: Gemini AI (damage analysis), Maps and geocoding (asset locations), Cloud Vision / Document AI (document text extraction) (United States and other Google regions)
• Anthropic: Fallback AI analysis of case photos (United States)
• TinyPNG: Image compression before storage (Netherlands)
• OpenStreetMap (Nominatim): Converting photo GPS coordinates into an approximate address (European Union / United Kingdom)

Market-price search services receive vehicle and asset details only, never your personal data.

5.2 Legal Requirements

We may disclose your data to:

• Law enforcement agencies
• Regulatory authorities (NDPC, NAICOM)
• Courts and tribunals
• Tax authorities (FIRS)

5.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity.

6. Your Rights Under NDPA 2023

You have the following rights:

• Right to Access: Request copies of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data (subject to legal obligations)
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a structured format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time
• Right to Lodge a Complaint: File a complaint with the Nigeria Data Protection Commission (NDPC)

7. Data Retention

We retain your data for:

• Transaction and financial records: 6 years (tax and company record-keeping requirements)
• Account data: for as long as your account is open, then as long as the related financial records
• Identity verification (KYC) data: 5 years after your account is closed (anti-money-laundering record keeping), then deleted
• Security and audit logs: 6 years
• Consent records (which Terms, Privacy Policy and identity-verification consent you accepted, and when): kept with your account data
• Marketing: we do not send marketing messages, so we hold no marketing preferences

Cookies: see our Cookie Policy.

7.1 Refunds and Withdrawals

Duplicate and overpaid payments, and payments for auctions cancelled by the seller, are refunded to your wallet or, for card and Paystack payments, to the original payment method within 14 business days of verification by our finance team.

Fees are not refunded to a winning bidder who does not sign or pay within the deadlines.

• You can withdraw your wallet balance to a verified bank account in your own (or your business's) name once your identity is verified.
• Minimum withdrawal ₦1,000; up to ₦5,000,000 per day.
• Withdrawals are reviewed by our finance team and usually paid within 1–3 business days.

8. Data Security

We implement appropriate technical and organizational measures:

• Encryption in transit (TLS); BVN and NIN are additionally encrypted in our database
• Identity and payment documents stored privately and shown to authorised staff through short-lived links
• Role-based access controls, multi-factor sign-in for risky contexts, and audit logs of staff access
• Incident response procedures

9. International Data Transfers

The following service providers process personal data outside Nigeria. Each transfer relies on the safeguard shown, as permitted by the NDPA:

• Supabase (Project hosting region (outside Nigeria)): Standard contractual clauses / contractual safeguards per NDPA
• Vercel (United States and global edge network): Standard contractual clauses / contractual safeguards per NDPA
• Cloudinary (United States): Standard contractual clauses / contractual safeguards per NDPA
• Upstash (Project hosting region (outside Nigeria)): Standard contractual clauses / contractual safeguards per NDPA
• Resend (United States): Standard contractual clauses / contractual safeguards per NDPA
• Termii and Africa's Talking (Nigeria and Kenya): Standard contractual clauses / contractual safeguards per NDPA
• Sentry (United States): Standard contractual clauses / contractual safeguards per NDPA
• Google (United States and other Google regions): Standard contractual clauses / contractual safeguards per NDPA
• Anthropic (United States): Standard contractual clauses / contractual safeguards per NDPA
• TinyPNG (Netherlands): Standard contractual clauses / contractual safeguards per NDPA
• OpenStreetMap (Nominatim) (European Union / United Kingdom): Standard contractual clauses / contractual safeguards per NDPA

10. Children's Privacy

The Platform is not intended for users under 18 years of age. We do not knowingly collect data from children. If you believe we have collected data from a child, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email or Platform notification 30 days before taking effect.

12. Contact Us