Privacy Policy

This policy explains how Form40 ("Form40") handles personal data, in line with the Nigeria Data Protection Act 2023.

1. Our role

We are the controller of account, organization, verification, payment, payout and payer-receipt data. For the answers and files people submit to an organization's form, the organization is the controller and we are its processor: we store and process them only to provide Form40 to that organization, keep them confidential, protect them, use only the sub-processors listed below, help the organization respond to rights requests, and delete them when the organization deletes them or closes its account.

2. Data we collect

• Account data: name, email, password (stored only as a hash), two-step verification settings.
• Organization and verification data: business details, logo, owner's NIN or BVN (encrypted) and the legal name and date of birth returned by the identity check, CAC details, payout bank account (encrypted).
• Payer data: name, email, amount and payment status. Card details are handled by Bachs; Form40 never receives or stores card numbers.
• Form answers and uploaded files submitted to organizations.
• Technical data: IP address (stored hashed for submissions and reports), device and browser information, and security events.

3. Why we use it

To provide the service, process payments, payouts and subscriptions, verify identity, prevent and investigate fraud and complaints, comply with the law, and improve Form40.

4. Fraud and enforcement

We may use data to investigate complaints and fraud and share it with Bachs, banks, law enforcement and regulators. When an organization is banned we keep keyed fingerprints of its owner's email, NIN or BVN and bank accounts to stop it registering again.

5. Sub-processors

• Bachs (payments, payouts, subscriptions, bank account checks)
• Dojah (NIN and BVN identity checks)
• Cloudflare (network security, bot protection with Turnstile, and file storage on R2)
• Our email provider (account and receipt emails)
• Our hosting and error-monitoring providers

6. Retention

Financial and payout records are kept for at least 6 years, as required by law. Form answers and files are kept until the organization deletes them or closes its account. Exports are deleted after 24 hours. We delete other data on request, subject to legal holds.

7. Your rights

You may ask to access, correct, delete or move your data, object to its use, or withdraw consent, and you may complain to the Nigeria Data Protection Commission. If your request is about answers you gave to an organization's form, we pass it to that organization. Contact [email protected] (Data Protection Officer: Ochayi Peace).

8. International transfers

Some providers (such as Cloudflare and our email provider) may process data outside Nigeria. We use providers with appropriate safeguards as required by the NDPA.

9. Security

We encrypt identity numbers, bank details and authentication secrets, keep financial records append-only, scan uploaded files, offer two-step verification, and restrict staff access to form answers. If a breach is likely to put you at risk, we will notify the NDPC within 72 hours where required and tell affected people.

10. Cookies

We use only essential cookies: one to keep you signed in and a security cookie for forms. Cloudflare Turnstile may set a cookie to tell people from bots. We don't use advertising cookies.