Privacy Policy

OnadaVerify collects information from two categories of users: registered organizations that issue documents, and members of the public who use the verification portal.

From registered organizations, we collect the organization's name, type, country of operation, and website, along with the contact person's name, email address, and phone number. Billing and payment information is also collected at the point of subscription, though full card details are handled exclusively by our third-party payment processor. We additionally collect account login credentials and session data including IP addresses.

When an organization issues a document through the platform, the record created contains the document holder's full name, document type, issue date, expiry date, internal reference number, and any additional description the organization provides. This data is entered directly by the issuing organization and stored as the verifiable record associated with that document.

From members of the public who use the verification portal, we collect the Verification ID or QR code data submitted for lookup, along with the IP address, approximate geographic location, browser type, and timestamp of each verification request. These entries are stored in our Verification Logs and form an immutable audit record of all verification events on the platform.

We also collect standard usage and device data automatically as users interact with the platform, including session information and data gathered through cookies and similar tracking technologies, which are described further in Section 8

Organization account data is used to create and manage your OnadaVerify account, process subscription payments, enforce usage limits, and communicate service notices, platform updates, and support responses to you.

Document record data is used to generate unique Verification IDs, QR codes, and shareable verification links at the moment of issuance. It populates the public verification portal when a document is queried, supports document revocation and status management, and provides issuance and verification analytics within the organization dashboard.

Verification log data is used to return real-time results to verifiers, populate the analytics dashboard for the issuing organization, detect suspicious verification patterns that may indicate fraud, and maintain a complete audit trail for compliance purposes.

OnadaVerify does not sell personal data to third parties and does not use any personal data for advertising purposes.

Security is foundational to OnadaVerify's design, not an optional feature. All document metadata and organization records are encrypted both at rest and in transit using industry-standard protocols, meaning records cannot be read or altered by unauthorized parties even in the event of infrastructure compromise.

Every Verification ID is generated using cryptographically secure random number generation, making IDs impossible to guess, enumerate, or predict. The system also maintains cryptographic integrity checks on all stored records, so any unauthorized modification to a document record is automatically detected and flagged.

Within organization accounts, role-based access control governs what each user can do. Administrators have full platform access, while team members can be restricted to specific actions such as document issuance only, preventing unauthorized revocations or account changes. Every action performed within an organization account including issuance, revocation, user management, and settings changes is logged with a timestamp and user identifier. These audit logs are append-only and cannot be modified or deleted by organization users.

All API access requires authenticated tokens, and rate limiting is applied to prevent automated enumeration attacks, brute-force attempts, and denial-of-service scenarios. The platform is hosted on AWS cloud infrastructure with global availability zones to maintain performance and availability.

In the event of a data breach, Onada Innovative Ltd will notify the Nigeria Data Protection Commission and affected parties within the timeframes required under the NDPA 2023.

OnadaVerify engages a limited set of third-party service providers to operate the platform. AWS provides the cloud hosting, object storage, and global infrastructure that OnadaVerify runs on. Supabase Auth manages account authentication, session handling, and access control.

A third-party payment processor handles all billing transactions, and OnadaVerify does not store full card details at any point. QR code generation and all verification logic are handled internally within OnadaVerify's own infrastructure.

No third-party behavioral analytics tools are used to track organization users or public verifiers. No personal data is shared with advertising networks.

All third-party processors operate under data processing agreements requiring them to protect personal data to a standard consistent with the NDPA 2023 and NDPR 2019. Personal data is shared with these providers only to the extent necessary to deliver the services described in this policy.

Onada Innovative Ltd processes personal data under the following legal bases as defined by the NDPA 2023 and NDPR 2019.

Processing of organization account data and document records is carried out on the basis of contract performance, as this data is necessary to deliver the subscription services you have signed up for. Processing of verification log data including IP addresses, geographic location, and timestamps is carried out on the basis of legitimate interests, specifically maintaining platform security, detecting fraud, and providing analytics to issuing organizations. Audit log retention and security incident reporting are carried out to meet legal obligations under applicable Nigerian law.

Where non-essential cookies and tracking technologies are used, processing is based on your consent, which is obtained at first visit and can be withdrawn at any time.

It is important to note that document holder data - the names and details entered into OnadaVerify by issuing organizations - is processed by OnadaVerify as a data processor acting on behalf of the issuing organization, which acts as the data controller for that information. Issuing organizations are responsible for ensuring they have a valid legal basis for entering individuals' data into the platform.

Under the NDPA 2023 and NDPR 2019, you have the right to request confirmation of what personal data we hold about you and to obtain a copy of it. You have the right to request correction of any personal data that is inaccurate or incomplete, and the right to request deletion of your data where retention is no longer legally required. You may also request that your personal data be provided to you in a structured, machine-readable format for portability purposes. Where processing is based on legitimate interests, you have the right to object to that processing based on your individual circumstances. Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing that took place before withdrawal.

To exercise any of these rights, contact us using the details in Section 9. We will respond within 30 days. We may require identity verification before fulfilling a request.

If your personal data appears in a document record entered by an issuing organization, your primary rights of access and erasure should be directed to that organization, as they are the data controller for that record. OnadaVerify will cooperate with verified erasure requests where legally permissible.

Onada Innovative Ltd may update this Privacy Policy at any time. When changes are made, the revised policy will be published at verify.onadaverify.com/privacy with a new effective date.

For material changes that affect how personal data is processed, registered organization administrators will be notified by email at least 14 days before those changes take effect. Continued use of OnadaVerify after the effective date constitutes acceptance of the updated policy. Prior versions of this policy are available on request.

OnadaVerify uses cookies and similar technologies to operate the platform. Strictly necessary cookies are required for core functionality - they manage session authentication, security tokens, and login state - and cannot be disabled without breaking the platform. Functional cookies store user preferences such as dashboard settings and notification configurations across sessions. Analytics cookies collect aggregated, anonymized usage data used solely to improve platform performance; no personal identifiers are shared with external analytics providers through these cookies.

OnadaVerify does not use advertising cookies or third-party tracking technologies of any kind.

On your first visit, a consent banner will request your permission for non-essential cookies. You may accept all, reject non-essential cookies, or manage your preferences individually. Your consent choice can be changed at any time using the cookie settings link in the platform footer.

The public verification portal applies only minimal cookies necessary for session security and rate-limit enforcement. No persistent tracking is applied to members of the public who verify documents.

For privacy-related enquiries, rights requests, or complaints, contact Onada Innovative Ltd at privacy@onadaverify.com. For general support, reach us at support@onadaverify.com.

Onada Innovative Ltd

RC: 7947458

If you are unsatisfied with our response to any privacy concern, you have the right to lodge a complaint with the Nigeria Data Protection Commission at ndpc.gov.ng.

This policy applies to OnadaVerify (verify.onadaverify.com) operated by Onada Innovative Ltd.