Privacy policy
This policy explains how Drame Corp ("we", "us"), the provider of Sentinel, collects and uses personal data, and the rights you have under the Nigeria Data Protection Act 2023 (NDPA) and other applicable law.
1. Our two roles
As a data controller, we decide how to use the personal data of people who visit our website, ask us for a demo, or use the Sentinel dashboard as staff of one of our customers. This policy covers that data.
As a data processor, we process personal data about our customers' own customers (for example account holders whose transactions are monitored) only on our customers' instructions and under a data processing agreement. For that data, the financial institution is the data controller and its privacy notice applies. If you are an account holder of one of our customers and want to exercise your rights, please contact that institution; we will help them respond.
2. What we collect
| Who | Data |
|---|---|
| Website visitors | Technical data your browser sends (IP address, browser type, pages requested) in our server and security logs. Our website does not use advertising or analytics cookies. |
| Demo and sales enquiries | Name, work email, phone number, institution, job title, institution type, approximate transaction volume and your message. |
| Dashboard users | Name, work email, role, organisation, login and security records (including two-factor settings and IP addresses), and a record of actions taken in the dashboard (the audit log). |
| Billing contacts | Name, email, and billing records. Card details are collected and held by our payment provider, Paystack, not by us. |
3. Why we use it, and our lawful basis
- To respond to enquiries and arrange demos, on the basis of your consent and our legitimate interest in answering business enquiries.
- To provide the Sentinel service to our customers and their staff, on the basis of our contract with your organisation.
- To keep the service secure, detect abuse and investigate incidents, on the basis of our legitimate interests and our security obligations under the NDPA.
- To bill customers and keep financial records, on the basis of contract and our legal obligations, including tax law.
- To send service and security notices that you need in order to use Sentinel. We will only send marketing emails with your consent, and you can unsubscribe at any time.
4. Who we share it with
We do not sell personal data. We share it only with service providers that help us run Sentinel, under contracts that require them to protect it:
| Provider | Purpose |
|---|---|
| DigitalOcean | Cloud hosting of the Sentinel service |
| Cloudflare | Network delivery, encryption in transit and protection against attacks |
| Twilio SendGrid | Delivery of service emails |
| Paystack | Payment processing for subscriptions and credit top-ups |
| Identity verification providers (such as Dojah) | BVN, NIN, CAC, bank account and phone checks that our customers request |
We may also disclose data where the law requires it, for example in response to a valid order from a court or regulator, or to protect the rights and safety of our users and the public.
5. International transfers
Our shared cloud is hosted in the United Kingdom and the European Union, and some providers above process data in other countries. When personal data leaves Nigeria, we rely on the transfer mechanisms the NDPA permits and put appropriate safeguards in place. Customers that require data to remain in Nigeria can choose a dedicated in-country deployment.
6. How long we keep it
- Sales enquiries: up to 24 months after our last contact, unless you become a customer.
- Dashboard accounts: for as long as your organisation uses Sentinel, then deleted or anonymised within 90 days, except where we must keep records longer.
- Billing and tax records: for the period required by Nigerian law.
- Security logs: for up to 12 months.
7. How we protect it
We use encryption in transit, database-level separation between customers, keyed hashing and masking of sensitive identifiers, role-based access, two-factor authentication and audit logging. Our security page describes these controls in more detail. If a personal data breach is likely to put your rights and freedoms at risk, we will notify the Nigeria Data Protection Commission and, where required, you, as the NDPA requires.
8. Your rights
Under the NDPA you have the right to:
- be informed about, and get a copy of, the personal data we hold about you;
- have inaccurate data corrected and, in certain cases, deleted;
- restrict or object to our processing, including for direct marketing;
- receive your data in a portable format;
- withdraw consent at any time, where we rely on consent; and
- not be subject to a decision based solely on automated processing that significantly affects you, without appropriate safeguards.
To exercise any of these rights, email [email protected]. We will respond within the time the law allows. You may also complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
9. Children
Sentinel is a business service and is not directed at children. We do not knowingly collect children's personal data through our website.
10. Changes and contact
We will post any changes to this policy on this page and update the date above. For significant changes affecting dashboard users, we will also notify customers by email.
Questions about this policy, or to contact our Data Protection Officer: [email protected].