Data protection

This statement describes how CrudSavvy Technological Services handles personal and financial data in the platforms we build and operate for clients. It sits alongside the privacy policy, which covers this website only.

Our role

For a client’s platform the client is the data controller and we are the processor: we handle data on the client’s instructions, under a written agreement that sets out what we may do with it. For products we run ourselves, we are the controller and each product publishes its own privacy notice.

The commitments we build in

• Separation. Every institution’s data is scoped to that institution in every query. No shared report, cache or export crosses that line.
• Least access. Staff see what their role needs. Sensitive actions need a second person. Every access is recorded.
• Encryption. Data is encrypted in transit everywhere and at rest on our servers and backups.
• Retention. Each client sets how long records are kept; the platform enforces it and can export or erase on request, within what financial regulation requires.
• Audit. Who did what, when and from where is kept as an append-only record that the client’s auditors can read.
• Incidents. If a breach affects a client’s data we tell the client within 72 hours of confirming it, with what happened and what we did.

Where data lives

Platforms are hosted in data centres chosen with each client, with backups kept in a separate location. Nigerian clients’ data is kept where Nigerian regulation requires.

Law

We work to the Nigeria Data Protection Act 2023 and the Nigeria Data Protection Regulation, and to the UK GDPR for platforms serving the United Kingdom.

Questions

Requests and questions about data go to [email protected], or by post to 5, Abule Ake Street, behind Obasanjo Hill-Top, Abeokuta, Ogun State, Nigeria.