Privacy Policy for HuSec

Effective Date: August 3, 2026

1. Introduction & Data Controller Information

Harkein Synergies ("we," "our," or "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how the HuSec mobile application ("App") collects, uses, protects, and discloses your personal data when you use our universal identity and payment routing services.

Under the Nigeria Data Protection Act (NDPA) 2023 and applicable global frameworks (such as the GDPR), Harkein Synergies acts as the "Data Controller" for the personal data processed through HuSec.

By using the App, you acknowledge that you have read and understood the practices described in this policy.

2. Information We Collect and the Lawful Basis for Processing

We only collect personal information that is adequate, relevant, and limited to what is necessary for our services. Below is a description of the data we collect and the specific lawful basis for processing it:

• Basic Identity Information: Such as your name, email address, and phone number.
  Lawful Basis: Performance of a Contract (necessary to create and manage your HuSec account).
• Government ID Data & Biometrics: To verify your identity for advanced KYC tiers (Tier 2 and Tier 3), we process a scan of a government-issued ID and a facial liveness check. Biometric data is considered a special category of sensitive data.
  Lawful Basis: Explicit Consent. You will be prompted to explicitly consent to this processing before initiating Tier 2/3 verification. This data is processed securely through our identity verification partners and is not retained by us after verification.
• Device and Usage Data: We may collect device identifiers (like the device's advertising identifier), crash logs, performance data, and information on how you interact with the app.
  Lawful Basis: Legitimate Interest (necessary for us to improve app functionality, ensure security, and resolve technical bugs).
• Transaction Metadata: We collect data related to transactions facilitated by the App, such as purchase amounts and merchant connections. (Note: We do not directly collect or store your raw payment card information; this is handled securely by our payment gateway partners).
  Lawful Basis: Performance of a Contract (necessary to facilitate secure split-ledger checkouts) and Legal Obligation (necessary for anti-fraud and financial compliance).

3. How We Use Your Information

We use your data strictly for the specified, explicit, and legitimate purposes outlined in Section 2. We do not collect data for one reason and use it for another unrelated purpose without fresh consent.

4. Data Retention

We define and justify our data retention periods as required by law. We will retain your personal data only for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Specifically:

• Account data is retained as long as your account is active.
• Transaction metadata may be retained for up to 6 years to comply with Nigerian financial and tax auditing requirements.
• Biometric and ID verification data is processed instantly by our partners and is not permanently stored by HuSec after the verification session concludes.

5. Third-Party Services and International Data Transfers

We do not sell your personal data. We share data only with trusted third-party data processors to enable our services:

• Identity Verification: (e.g., Stripe Identity, Sumsub) For global document OCR and biometric checks.
• Database and Authentication: (Supabase) For secure data storage and user authentication.
• Payment Gateways: (e.g., Paystack) To process transactions securely.
• Analytics and Diagnostics: (e.g., Sentry) To monitor app performance.

International Transfers: The third-party services listed above may store and process your data on servers located outside of Nigeria (such as in the United States or the EU). In these cases, we ensure that these cross-border data transfers are protected by adequate safeguards, such as the use of Standard Contractual Clauses (SCCs) or reliance on adequacy decisions recognized by the Nigeria Data Protection Commission (NDPC).

6. Data Security

We implement robust technical and organizational measures, including AES-256 encryption and TLS, to protect your data during transmission and storage against unauthorized access, breaches, loss, or damage.

7. Your Data Subject Rights

Under the NDPA 2023 and GDPR, you have the following rights regarding your personal data:

• The Right to Access: You can request copies of your personal data.
• The Right to Rectification (Correction): You can request that we correct any information you believe is inaccurate or incomplete.
• The Right to Erasure (Deletion): You can request that we erase your personal data, under certain conditions. You can manage this directly within the App settings. (Note: We may decline a deletion request if retaining the data is legally required for financial auditing or anti-fraud purposes).
• The Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data, under certain conditions.
• The Right to Withdraw Consent: Where we rely on your consent to process data (e.g., biometrics), you can withdraw that consent at any time.
• The Right to Data Portability: You have the right to request that we transfer the data that we have collected to another organization, or directly to you, under certain conditions.
• The Right to Lodge a Complaint: If you believe we are mishandling your data, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) or your local supervisory authority.

To exercise any of these rights, please contact us using the details in Section 9.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We are responsible for keeping our privacy responses accurate and up to date. We will notify you of any significant changes by updating the "Effective Date" at the top of this policy or through an in-app notification.

9. Contact Us & Data Protection Officer

If you have any questions regarding this Privacy Policy, your data, or if you wish to exercise your data subject rights, please contact our Data Protection Officer (DPO) at:

• Email: privacy@husec.com
• Business Address: No.9, Reservoir Area, Ejigbo, Osun State