Privacy Policy

1. Introduction

OrbitVerse ("we", "us", "our") is a verified marketplace platform operated by O V VENTURE (trading as OrbitVerse). This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our platform at orbitverse.africa and related services.

OrbitVerse is a trading name of O V VENTURE, a business name registered with the Corporate Affairs Commission of Nigeria.

We are committed to compliance with the Nigeria Data Protection Act (NDPA) 2023 and other applicable data protection laws across our operating regions.

1A. Data protection contact

Questions, requests and complaints about how we handle personal data are handled by our data protection contact, who is also our point of contact for data subjects and regulators.

Data protection contact: privacy@orbitverse.africa

1B. Lawful Basis for Processing

In accordance with the NDPA, we only process personal data where at least one of the following lawful bases applies:

• Consent: you have given clear consent for a specific purpose
• Contract: processing is necessary to perform our agreement with you (e.g. order fulfilment, escrow)
• Legal obligation: processing is required to comply with Nigerian law (e.g. AML/CFT, tax, financial record-keeping)
• Vital interest: processing is necessary to protect life or physical safety
• Public interest: processing is necessary for functions in the public interest
• Legitimate interest: processing is necessary for our legitimate business interests, balanced against your rights and freedoms

2. Information We Collect

3. How We Use Your Information

• To create and manage your account
• To process orders and manage escrow
• To verify your identity through AfriVerify
• To calculate and display TrustScore
• To send transaction notifications and alerts
• To detect fraud and prevent abuse
• To resolve disputes
• To improve our platform and services
• To comply with legal obligations

4. Identity Verification and Data Protection

AfriVerify uses NIN and BVN data solely for the purpose of confirming your identity. This process is powered by Dojah (dojah.io), a third-party identity verification provider.

We do not:

• Sell your identity data to third parties
• Use your NIN or BVN for any purpose other than verification
• Store raw government ID numbers after verification is complete
• Share verification data with other users

5. Escrow and Wallet Data

All financial transaction records are retained for a minimum of 7 years in compliance with Nigerian financial regulations. OrbitWallet balances are recorded in append-only ledgers. No transaction record is ever deleted or modified.

6. Data Sharing

We share data only with:

• Dojah: for identity verification
• Flutterwave: for payment processing and settlement
• Resend: for transactional email delivery
• Railway: our infrastructure provider

We do not sell personal data. We do not share data with advertisers.

7. Data Retention

• Account data: retained while your account is active and for 2 years after closure
• Transaction records: retained for 7 years (regulatory requirement)
• Verification records: retained for 5 years
• Chat messages: retained for 2 years
• Usage logs: retained for 90 days

8. Your Rights

Under the NDPA and other applicable law, you have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of non-essential data
• Object to certain processing
• Data portability
• Withdraw consent where processing is based on consent

To exercise these rights, submit a request to privacy@orbitverse.africa or our data protection contact at privacy@orbitverse.africa. We will acknowledge your request and respond substantively within 30 days, as required under the NDPA. Where a request is complex, we may extend this period by up to a further 30 days, and we will notify you of the extension and the reason for it.

9. Security

We implement industry-standard security measures including:

• AES-256 encryption for sensitive data at rest
• TLS 1.3 for all data in transit
• JWT-based authentication with secure token rotation
• Rate limiting and anomaly detection
• Append-only financial ledgers

10. Cookies

We use essential cookies for authentication and session management. We do not use advertising or tracking cookies.

11. Children

OrbitVerse is not intended for users under 18 years of age. We do not knowingly collect data from minors.

12. Cross-Border Transfers

OrbitVerse operates across multiple countries. By using our platform, you consent to your data being processed in Nigeria and other countries where our service providers operate.

Where personal data is transferred outside Nigeria, we rely on appropriate safeguards consistent with NDPA requirements for cross-border transfer, including Standard Contractual Clauses (SCCs) with recipient processors, an adequacy determination by the regulator, or your explicit consent, and we require recipients to maintain a level of data protection commensurate with the NDPA.

13. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, OrbitVerse will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of the breach, in accordance with NDPA breach notification requirements.

Where a breach is likely to result in a high risk to affected users, we will also notify those users directly and without undue delay, describing the nature of the breach and the measures taken or proposed to address it.

14. Changes to This Policy

We will notify you of material changes via email and an in-app notice at least 14 days before they take effect.

15. Contact

O V VENTURE

Email: privacy@orbitverse.africa

Data protection contact: privacy@orbitverse.africa

Website: orbitverse.africa