Privacy policy

1. Who we are and what this policy covers

IDEX is an independent Nigerian technology platform that provides identity verification services — principally National Identification Number (NIN) and Bank Verification Number (BVN) checks — through a web dashboard and a REST API.

IDEX is not the National Identity Management Commission, the Nigeria Inter-Bank Settlement System, the Central Bank of Nigeria or any other government body, and is not affiliated with, endorsed by or acting on behalf of any of them. We do not maintain the national identity databases; verification results are supplied to us by third-party verification providers.

This policy covers the website at https://idex.com.ng, the customer dashboard, the REST API and any email we send you in connection with your account. It does not cover a third-party website you reach from a link on ours.

In this policy, you means the person using the platform — the account holder — and data subject means any individual whose personal data is processed, including a person whose identifier one of our customers submits for verification.

2. The personal data we collect

2.1 Account data

Your full name, business name where you give one, email address, telephone number, account type, hashed password, two-factor authentication state and, where you enable it, an encrypted TOTP secret and encrypted backup codes.

2.2 Verification data

The identifier you submit for a check — for example a NIN or a BVN — together with any supporting field the service requires, and the result the provider returns. The identifier is encrypted before it is stored. Alongside it we keep a masked form of the identifier (for example 123*****901), a one-line summary of the result, the service used, the channel, the reference, the amount charged, the status and timestamps.

Where you submit somebody else's identifier, that person is a data subject and you are responsible for having a lawful basis and, where required, their consent. See our acceptable use policy.

2.3 Wallet and payment data

Your wallet balance, every ledger entry with the balance before and after it, funding references, the amount and status of each payment, and the reference the payment processor returns. We do not receive or store card numbers, card expiry dates or card security codes — those are handled by the payment processor on its own systems.

2.4 Technical and security data

Your IP address, browser user agent, session identifier and session fingerprint, login attempts and their outcome, rate-limit counters, API key identifiers and usage, and audit records of consequential actions taken in your account.

2.5 Communications

The name, email address, optional telephone number, subject and message you send through the contact form, plus the IP address the message came from, and any subsequent correspondence.

3. Where the data comes from

• From you — registration, profile changes, verification submissions, wallet funding and messages you send us.
• From your device — IP address, user agent and session data, collected automatically when you use the platform.
• From verification providers — the result of a check you submitted, returned to us and passed on to you.
• From payment processors — confirmation that a payment succeeded, with its reference and amount.

We do not buy personal data, we do not scrape it, and we do not enrich your account with data obtained from anywhere other than the sources listed above.

4. Why we process personal data, and our lawful basis

We process personal data under the Nigeria Data Protection Act 2023 (the NDPA). The table below sets out each purpose and the lawful basis we rely on for it.

We do not use your personal data for advertising, we do not sell it, and we do not share it with anyone for their own marketing purposes.

5. Data minimisation

Each service asks only for the fields it needs to perform the check, and the form rejects a submission that carries more than that. When a provider returns a response, we map it to a defined set of fields and store only the mapped result — we do not archive the provider's entire raw response for its own sake.

Outside the result panel of the verification you have just paid for, identifiers are shown in masked form everywhere in the product: lists, notifications, exports, receipts and any screen our support team can see. Sensitive values are scrubbed before anything is written to the audit log, and identifiers are never written to an application log file.

6. How we protect personal data

• Encryption at rest. Submitted identifiers, result payloads and two-factor secrets are encrypted with AES-256-GCM. The key is held in an environment file outside the web root — never in the database and never in the code repository. Because GCM is authenticated, a stored value that has been tampered with fails to decrypt rather than decrypting to something else.
• Encryption in transit. The site and API are served over HTTPS only, with HTTP Strict Transport Security.
• Password storage. Passwords are hashed with a modern memory-hard algorithm and are never stored or logged in a readable form. We cannot tell you your password; we can only help you reset it.
• API secrets. An API secret is displayed once, at creation, and stored only as a hash. Authentication compares it in constant time.
• Session integrity. Sessions are fingerprinted, use secure and HTTP-only cookies with SameSite protection, and can be revoked centrally by you or by us.
• Access control. Administrative access is limited to staff who need it for their role, is authenticated separately from customer access and is recorded in the audit log.
• Application hardening. All database access uses bound parameters, every form carries a cross-site request forgery token, all output is escaped, a strict content security policy is enforced and abusable endpoints are rate limited.

No system is perfectly secure, and we do not claim otherwise. What we do claim is that the controls above are implemented in the product rather than promised in a document, and that we will tell you promptly if something goes wrong. Our data protection page describes our breach notification process.

7. How long we keep personal data

We keep personal data only for as long as it serves the purpose it was collected for, or for as long as the law requires.

Result payloads are cleared by a scheduled job after 30 days. The job stamps the record so the history still reconciles and your ledger still balances, but the encrypted result and the encrypted identifier are gone: after that point the verification can be proved to have happened and cannot be re-read. If you need a result for longer than that, export or record it while it is available.

8. Who we share personal data with

We share personal data only with the following categories of recipient, and only as far as each needs it.

• Verification providers. To perform a check you submit, we send the identifier and any required supporting field to the provider mapped to that service. We do not send them your account details beyond what the request requires. A provider that has not been mapped and activated receives nothing, because the service cannot be submitted at all.
• Payment processors. To take a wallet funding payment. They receive the amount, the reference and the contact details needed to process the transaction.
• Email delivery. To send account, security and receipt emails to your address.
• Hosting and infrastructure. Our hosting provider stores the application and its database on our instruction.
• Professional advisers. Auditors, accountants and lawyers, where they need access in order to advise us and under a duty of confidentiality.
• Regulators, courts and law enforcement. Where we are legally required to disclose. We check that a request is valid and properly issued before we act on it, and we disclose only what the request covers.
• A successor. If the business is reorganised, merged or acquired, personal data may transfer as part of that transaction, subject to this policy continuing to apply.

Every processor acting on our behalf is bound by a written agreement requiring it to act only on our documented instructions, to keep the data confidential and to apply appropriate security measures. The current list of categories of sub-processor is on our data protection page.

9. International transfers

The platform and its database are hosted so that customer data is processed in or for the Nigerian market. Some of the services we rely on — for example email delivery or a payment processor — may process limited personal data outside Nigeria.

Where personal data is transferred outside Nigeria, we do so only under a transfer mechanism permitted by the NDPA: an adequacy determination by the Nigeria Data Protection Commission, appropriate contractual safeguards binding the recipient, or another lawful basis recognised by the Act. We do not transfer verification results to a jurisdiction simply because it is cheaper to process them there.

10. Cookies and similar technologies

IDEX sets one cookie: the session cookie that keeps you signed in and carries the cross-site request forgery protection for forms you submit. It is marked HTTP-only and secure, uses SameSite protection and is removed when you sign out. If you choose the "remember me" option at sign-in, a second cookie holds a long-lived sign-in token which you can revoke at any time from your account.

We do not run advertising cookies, analytics cookies, tracking pixels, session recorders, fingerprinting scripts, social media widgets or third-party tag managers. Nothing on this site reports your browsing to a third party, which is why you are not asked to dismiss a cookie banner in order to read this page.

Blocking the session cookie in your browser will prevent you from signing in, because there is then no way to keep you signed in.

11. Your rights under the Nigeria Data Protection Act

Subject to the conditions and exemptions in the NDPA, you have the right to:

• Be informed about how your personal data is processed — which is what this policy is for.
• Access the personal data we hold about you, and receive a copy of it.
• Rectification — have inaccurate personal data corrected and incomplete data completed.
• Erasure — have personal data deleted where it is no longer necessary, where you withdraw consent that we relied on, or where it has been processed unlawfully. This right does not override our legal duty to keep financial and audit records.
• Restrict processing while an accuracy dispute or an objection is being resolved.
• Object to processing carried out on the basis of a legitimate interest.
• Data portability — receive the personal data you gave us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible.
• Withdraw consent at any time where processing is based on consent. Withdrawal does not affect processing already carried out.
• Lodge a complaint with the Nigeria Data Protection Commission.

To exercise a right, write to us using the details in section 15 or through the contact form with "Data request" in the subject line. We will verify your identity before we act, so that the process cannot be used to reach somebody else's data, and we will respond within one month. If a request is complex we may extend that period and will tell you why. There is no charge for a reasonable request.

If your identifier was submitted for verification by one of our customers, that customer decided to run the check and is the controller for that decision. We will assist you in reaching them, and we will act on any request that concerns data we hold as controller in our own right.

12. Automated decision-making and profiling

IDEX does not make automated decisions that produce legal effects concerning a data subject. A verification returns a factual result — whether a record matching the details supplied was found, and the fields that record contains. It does not score, rank or classify anybody.

Any decision taken on the basis of a verification result — to open an account, to decline an application, to onboard an agent — is taken by our customer, not by us. Our customers are responsible for their own decisions and for any obligation they have to explain them.

We do apply automated controls to the platform itself, such as rate limiting and abuse detection. These may temporarily block a request or lock an account after repeated failed sign-in attempts. You can ask us to review any such block.

13. Children

The platform is intended for businesses and for individuals aged 18 or over. We do not knowingly create accounts for children. If you believe a child has created an account, tell us and we will close it and delete the associated personal data, subject to any record we are legally required to keep.

Where a customer lawfully submits the details of a minor for verification, the ordinary protections in this policy apply, and the customer remains responsible for having the consent of a parent or guardian where the law requires it.

14. Changes to this policy

We update this policy when the platform changes or when the law does. The date at the top of this page shows when it was last revised.

Where a change materially affects how we handle your personal data, we will tell you before it takes effect — by a notice in your dashboard, by email, or both — and, where the change requires your consent, we will ask for it rather than assume it. Continuing to use the platform after a change takes effect means you accept the revised policy.

15. How to contact us, and how to complain

For any question about this policy, about how your personal data is handled, or to exercise one of the rights in section 11:

If you are not satisfied with our response, you may complain to the Nigeria Data Protection Commission, which supervises compliance with the NDPA. We would appreciate the chance to put things right first, but you are not required to come to us before you go to the Commission.

Related documents: terms of service, data protection, acceptable use policy.