Privacy Policy

Effective Date: January 1, 2026

Last Updated: November 8, 2025

1. Introduction

Welcome to Numus Tax calculator ("we," "our," or "us"). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and services (collectively, the "Service").

By using Numus Tax calculator, you agree to the collection and use of information in accordance with this policy. This Privacy Policy complies with the Nigeria Data Protection Regulation (NDPR) 2019 and other applicable Nigerian laws.

2. Information We Collect

2.1 Personal Information

We may collect the following personal information:

• Account Information: Name, email address, phone number, and password
• Financial Information: Income details, tax identification numbers (TIN), employment information, salary details, allowances, and deductions
• Device Information: Such as device type, operating system, and IP address (for performance and security)
• Profile Information: Job title, employer name, state of residence, and professional details
• Payment Information: When you subscribe to premium features, we collect payment card details through our secure payment processor (Paystack)

2.2 Tax Calculation Data

• Income amounts and sources
• Tax reliefs and allowances claimed
• Pension and NHF contributions
• Previous tax calculations and history
• Exported reports and documents

2.3 Technical Information

• Device Information: Device type, operating system, unique device identifiers
• Usage Data: App features used, calculation frequency, time spent on app
• Log Data: IP address, browser type, crash reports, performance data
• Analytics Data: User interactions, feature preferences, error logs

2.4 Information We Do NOT Collect

We want to be clear about what we don't collect:

• We do NOT access your device contacts
• We do NOT access your photo gallery or camera without permission
• We do NOT track your location continuously
• We do NOT share your tax data with FIRS or any tax authority without your explicit consent

3. How We Use Your Information

We use the collected information for the following purposes:

3.1 Service Delivery

• Calculate your taxes accurately according to 2026 Nigerian tax laws
• Generate detailed tax reports and breakdowns
• Store your calculation history for future reference
• Provide personalized tax recommendations

3.2 Account Management

• Create and manage your account
• Process subscription payments and manage billing
• Authenticate your identity and prevent fraud
• Provide customer support and respond to inquiries

3.3 Service Improvement

• Analyze usage patterns to improve our algorithms
• Develop new features based on user needs
• Fix bugs and optimize performance
• Conduct research and analytics (using anonymized data)

3.4 Communications

• Send service updates and important notices
• Notify you about tax law changes affecting your calculations
• Send subscription renewal reminders
• Provide customer support responses
• Send promotional materials (only with your consent)

4. Data Storage and Security

4.1 Where Your Data is Stored

Your data is stored on secure servers located in Nigeria and internationally-recognized cloud infrastructure providers. We comply with NDPR requirements for data localization where applicable.

4.2 Security Measures

We implement industry-standard security measures including:

• Encryption: All data is encrypted in transit (TLS/SSL) and at rest (AES-256)
• Access Controls: Strict role-based access controls limit who can view your data
• Authentication: Multi-factor authentication for account security
• Regular Audits: Periodic security audits and vulnerability assessments
• Secure Infrastructure: SOC 2 certified cloud hosting providers

4.3 Data Retention

We retain your personal information for as long as:

• Your account is active
• Needed to provide you services
• Required by Nigerian tax and financial laws (typically 6 years for tax records)
• Necessary for legal obligations, dispute resolution, and enforcing agreements

After account deletion, we may retain anonymized data for analytics and service improvement.

5. Data Sharing and Disclosure

5.1 We Share Your Data With:

Service Providers: Trusted third-party vendors who help us operate our service:

• Paystack (payment processing)
• Cloud hosting providers (data storage)
• Analytics services (anonymized usage data)
• Customer support platforms

All service providers are bound by strict confidentiality agreements.

5.2 We Do NOT Share Your Data With:

• Advertisers or marketing companies
• Data brokers
• Social media platforms
• Tax authorities (unless legally required or with your consent)

5.3 Legal Requirements

We may disclose your information if required to:

• Comply with valid legal processes (court orders, subpoenas)
• Protect the rights, property, or safety of NumusTax, our users, or the public
• Investigate fraud, security issues, or technical problems
• Enforce our Terms of Service

6. Your Rights Under NDPR

As a Nigerian data subject, you have the following rights:

6.1 Right to Access

You can request a copy of all personal data we hold about you.

6.2 Right to Rectification

You can update or correct inaccurate information in your account settings.

6.3 Right to Erasure

You can request deletion of your account and associated data (subject to legal retention requirements).

6.4 Right to Object

You can object to processing of your data for marketing purposes.

6.5 Right to Data Portability

You can request your data in a machine-readable format to transfer to another service.

6.6 Right to Withdraw Consent

Where we rely on consent, you can withdraw it at any time.

To exercise any of these rights, contact us at privacy@numusapp.com

7. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Keep you signed in
• Remember your preferences
• Analyze app performance
• Understand usage patterns

You can control cookies through your device settings, but some features may not work properly without them.

8. Children's Privacy

NumusTax is not intended for users under 18 years old. We do not knowingly collect information from children. If you believe we have collected information from a child, please contact us immediately.

9. International Data Transfers

While we primarily store data in Nigeria, some data may be transferred to international servers operated by our service providers. We ensure adequate safeguards are in place as required by NDPR.

10. Changes to This Privacy Policy

We may update this Privacy Policy periodically. We will notify you of significant changes via:

• In-app notifications
• Email to your registered address
• Update on our website

Your continued use after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, contact us:

• Email: privacy@numusapp.com
• Address: Lagos, Nigeria
• Data Protection Officer: dpo@numusapp.com

12. Complaints

If you believe we have violated your privacy rights, you may file a complaint with:

• Nigeria Data Protection Commission (NDPC)
• Website: www.ndpc.gov.ng
• Email: info@ndpc.gov.ng

Data Policy

Effective Date: January 1, 2026

1. Overview

This Data Policy explains how NumusTax collects, processes, stores, and protects your data in compliance with the Nigeria Data Protection Regulation (NDPR) 2019 and international best practices. This policy should be read alongside our Privacy Policy.

2. Legal Basis for Data Processing

We process your data under the following legal bases:

2.1 Contractual Necessity

Processing necessary to provide our tax calculation services as per our Terms of Service.

2.2 Consent

Where you have given explicit consent for specific purposes (e.g., marketing communications).

2.3 Legitimate Interest

Processing necessary for our legitimate business interests (e.g., fraud prevention, service improvement) that don't override your rights.

2.4 Legal Obligation

Processing required to comply with Nigerian legal obligations (e.g., tax record retention, anti-money laundering).

3. Data Collection Methods

3.1 Direct Collection

Information you provide when you:

• Create an account
• Enter tax calculation data
• Update your profile
• Contact customer support
• Subscribe to premium services

3.2 Automatic Collection

Information automatically collected through:

• App usage analytics
• Device sensors and diagnostics
• Cookies and similar technologies
• Error and crash reports

3.3 Third-Party Sources

We may receive data from:

• Payment processors (transaction confirmations)
• Authentication services (if you use social login)
• Public tax information sources (for validation purposes)

4. Data Processing Activities

4.1 Tax Calculations

Purpose: Calculate accurate tax obligations under Nigerian tax law

Data Used: Income, allowances, deductions, reliefs, personal details

Legal Basis: Contractual necessity

Retention: Duration of account + 6 years (tax law requirement)

4.2 Account Management

Purpose: Maintain your user account and preferences

Data Used: Email, name, password, profile settings

Legal Basis: Contractual necessity

Retention: Duration of account + 1 year

4.3 Payment Processing

Purpose: Process subscription payments

Data Used: Payment details (processed by Paystack), transaction history

Legal Basis: Contractual necessity

Retention: 7 years (financial record requirement)

4.4 Analytics and Improvement

Purpose: Improve app performance and user experience

Data Used: Anonymized usage data, feature interactions

Legal Basis: Legitimate interest

Retention: 2 years

4.5 Customer Support

Purpose: Respond to inquiries and resolve issues

Data Used: Contact details, support tickets, communication history

Legal Basis: Contractual necessity and legitimate interest

Retention: 3 years

4.6 Marketing Communications

Purpose: Send promotional materials and updates

Data Used: Email, name, usage preferences

Legal Basis: Consent (you can opt-out anytime)

Retention: Until consent is withdrawn

5. Data Security Measures

5.1 Technical Security

• Encryption: AES-256 encryption at rest, TLS 1.3 in transit
• Firewalls: Multi-layer firewall protection
• Intrusion Detection: Real-time monitoring for suspicious activity
• Secure Coding: Regular security code reviews and penetration testing
• Data Masking: Sensitive data masked in logs and reports

5.2 Organizational Security

• Access Control: Role-based access with principle of least privilege
• Employee Training: Regular security and privacy training for all staff
• Background Checks: Screening of employees with data access
• Confidentiality Agreements: All staff and contractors sign NDAs
• Incident Response Plan: Documented procedures for security breaches

5.3 Physical Security

• Secure data centers with 24/7 monitoring
• Biometric access controls
• Redundant power and cooling systems
• Regular physical security audits

6. Data Breach Notification

In the unlikely event of a data breach, we will:

1. Notify affected users within 72 hours
2. Report to the Nigeria Data Protection Commission as required
3. Provide details of the breach and affected data
4. Describe measures taken to address the breach
5. Offer guidance on steps you can take to protect yourself

7. Data Subject Rights

7.1 How to Exercise Your Rights

You can exercise your rights by:

• Using in-app settings for profile updates and data export
• Emailing privacy@numusapp.com for formal requests
• Contacting our Data Protection Officer at dpo@numustax.com

7.2 Request Processing

• We will respond to requests within 30 days
• We may request identity verification
• We may charge a reasonable fee for excessive or repetitive requests
• We will explain any refusal to act on a request

8. Data Minimization

We follow the principle of data minimization by:

• Collecting only data necessary for our stated purposes
• Not retaining data longer than necessary
• Regularly reviewing and deleting obsolete data
• Providing granular privacy controls

9. Third-Party Data Processors

We carefully select and monitor all third-party processors:

9.1 Current Processors

• Paystack: Payment processing (PCI-DSS compliant)
• Cloud Providers: Data hosting (SOC 2 certified)
• Analytics Services: Usage analytics (anonymized data only)

9.2 Processor Requirements

All processors must:

• Sign Data Processing Agreements (DPAs)
• Implement appropriate security measures
• Process data only as instructed
• Notify us of any breaches
• Delete data upon contract termination

10. Data Portability

You can export your data in machine-readable formats:

• Tax Calculations: PDF
• Profile Information: JSON

Use the "Export Data" feature in app settings or request via email.

11. Automated Decision-Making

NumusTax uses automated calculations for tax computations. These calculations:

• Follow Nigerian tax laws and FIRS guidelines
• Are based on data you provide
• Can be reviewed and challenged
• Do not make decisions beyond tax calculations

You have the right to request human review of any calculation.

12. Cross-Border Data Transfers

If data is transferred outside Nigeria, we ensure:

• Adequate level of protection as required by NDPR
• Use of Standard Contractual Clauses (SCCs)
• Compliance with international data transfer regulations
• Notification to users about transfer destinations

13. Data Protection Impact Assessments

We conduct regular Data Protection Impact Assessments (DPIAs) for:

• New features and services
• Changes to data processing activities
• High-risk processing operations
• Use of new technologies

14. Compliance and Certification

NumusTax maintains compliance with:

• Nigeria Data Protection Regulation (NDPR) 2019
• Nigerian tax laws regarding record retention
• Payment Card Industry Data Security Standard (PCI-DSS) via Paystack
• International data protection standards

15. Contact Information

For data-related inquiries:

• Data Protection Officer: dpo@numusapp.com
• Privacy Team: privacy@numusapp.com
• General Support: hello@numusapp.com

16. Updates to This Policy

This Data Policy may be updated to reflect:

• Changes in data processing activities
• New legal requirements
• Technological advancements
• Best practice developments

Material changes will be communicated via email and in-app notifications.