NDPA 2023 & GDPR Compliant · Enterprise Grade

Privacy Policy & Data Protection Statement

Effective Date: 29 October 2026 · Version 2.0 · Resolytics AI Solutions Limited · Compliant with the Nigeria Data Protection Act (NDPA) 2023 & General Data Protection Regulation (GDPR)

1Statutory Framework & Regulatory Scope

Sales Wizard (“we”, “our”, “the Platform”), developed and operated by Resolytics AI Solutions Limited, provides enterprise conversational intelligence, real estate qualification automation, and CRM software for property developers and licensed real estate agencies across Nigeria and internationally.

We process personal data in strict compliance with:

The Nigeria Data Protection Act (NDPA) 2023 and regulations issued by the Nigeria Data Protection Commission (NDPC).
The Nigeria Data Protection Regulation (NDPR) 2019 where applicable.
The General Data Protection Regulation (EU GDPR 2016/679) and UK GDPR for international clients and cross-border property buyers.
Relevant anti-money laundering (AML) directives by the Special Control Unit Against Money Laundering (SCUML) and the Nigerian Financial Intelligence Unit (NFIU).

2Data Governance Roles: Controller vs. Processor

Client Real Estate Agency (Data Controller)

Your organization determines the purpose, criteria, and lawful basis for engaging prospective buyers and tenants. You control lead qualification thresholds, assignment rules, and customer communications.

Sales Wizard / Resolytics AI (Data Processor)

We process data solely on your instructions. Database records, inquiry transcripts, and qualification matrices are cryptographically segregated using Postgres Row-Level Security (RLS) under your tenant ID.

3Lawful Bases for Processing (NDPA Section 25)

Every data processing operation conducted by Sales Wizard relies on verified legal bases:

Explicit Consent (NDPA Sec. 25(1)(a))

Obtained when a website visitor initiates a chat session, selects consent options on the interactive cookie and privacy banner, checks the agreement box during account registration, or contacts your verified WhatsApp Business line.

Performance of a Contract / Pre-contractual Inquiries (NDPA Sec. 25(1)(b))

Processing property criteria (bedrooms, preferred location, price bracket) necessary to provide property recommendations and schedule physical inspections requested by the prospect.

Legitimate Business Interests (NDPA Sec. 25(1)(f))

Fraud prevention, preventing platform abuse via rate limiting, and ensuring tenant isolation across our real estate CRM ecosystem.

4AI Profiling, Lead Scoring & Automated Decisions (NDPA Section 37)

Notice of Algorithmic Processing & Human Oversight Mandate

Sales Wizard incorporates deterministic property matching algorithms and generative language models to evaluate buyer requirements and score purchase readiness (0–100 Lead Score). In compliance with Section 37 of the NDPA 2023:

Automated scores serve as priority indicators for sales agents and do not produce legal consequences or deny access to housing services.
Right to Human Review: Prospects and clients may request human evaluation at any time. When a prospect types “speak to an agent” or discusses binding transactions, our pipeline flags the conversation for instant human CSR takeover.
No Bias in Scoring: Scoring models evaluate objective financial parameters (budget fit, timeline, inventory match) and strictly exclude demographic, religious, ethnic, or regional characteristics.

5Data Retention Periods & Schedules (NDPA Section 24(1)(d))

Under Section 24(1)(d) of the NDPA 2023, personal data is retained no longer than necessary for the purposes for which it is processed. We enforce the following statutory retention schedules:

Data Category	Retention Period	Statutory / Operational Purpose
Lead & Customer Contact Records	Duration of active account + 90 days	Enables active client sales pipeline; purged 90 days post-cancellation or upon valid DSAR erasure request.
Conversation Transcripts & Inquiries	24 months	Contextual qualification continuity, inspection follow-up, and proof of customer inquiry history.
Audit Logs & Access Histories	7 years	Compliance with Nigerian SCUML, NFIU, and anti-money laundering statutory audit mandates.
Financial, Subscription & Tax Records	6 years	Compliance with Federal Inland Revenue Service (FIRS) and Companies and Allied Matters Act (CAMA 2020).
AI Model Inference Payloads	0 days (Transient / In-memory)	Real-time processing only; zero data retention by external AI providers for foundation model training.

6Authorized Sub-Processors & Hosting Locations (NDPA Sections 41–43)

Sales Wizard utilizes vetted third-party service providers (sub-processors) operating under strict data processing agreements to maintain infrastructure security and deliver core features:

Supabase Inc.

Database & Auth

Primary PostgreSQL database with Row-Level Security, encrypted user authentication, and secure asset storage.

Hosting Location: AWS eu-west-1 (Dublin, Ireland)

Meta Platforms, Inc. / Ireland

WhatsApp Cloud API

Official WhatsApp Business Cloud API infrastructure for automated messaging, tour booking, and lead intake.

Hosting Location: Ireland & USA (Standard Contractual Clauses)

Vercel Inc.

Application Edge

Edge application hosting, Next.js serverless compute, global content delivery network (CDN), and DDoS protection.

Hosting Location: Global Edge / AWS eu-west-1

Resend, Inc.

Transactional Email

SMTP relay and transactional email dispatch for user registration confirmation, team invites, and security notices.

Hosting Location: AWS eu-central-1 (Frankfurt, Germany) / eu-west-1

AI Model Providers (Anthropic, OpenAI, DeepSeek)

Language Models

Natural language requirement extraction and conversation generation. Under enterprise API terms, customer conversation payloads are never used to train foundation models and are retained solely for transient API inference.

Hosting Location: USA (Enterprise Zero Data Retention DPA)

7Data Breach Notification Protocol (NDPA Section 40)

Statutory 72-Hour Breach Notification Protocol

In strict adherence to Section 40 of the NDPA 2023 and GDPR Article 33:

Regulatory Notification: In the event of a personal data breach likely to result in a risk to the rights and freedoms of individuals, Resolytics shall notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of the incident.
Controller Notification: Where Resolytics acts as Data Processor, we shall notify affected client real estate agencies (Data Controllers) without undue delay upon confirming any unauthorized access, alteration, or data disclosure.
Data Subject Notification: Where a breach is likely to result in high risk to data subjects' rights, affected individuals shall be communicated with directly, detailing the nature of the breach, the name and contact of the Data Protection Officer, potential consequences, and recommended mitigation steps.

8Protection of Children & Age Restriction (NDPA Section 31)

Strict Prohibition Against Minor Data Collection

Pursuant to Section 31 of the NDPA 2023, Sales Wizard services, real estate prospect engagement tools, and CRM workspaces are strictly directed to individuals who are at least eighteen (18) years of age. We do not knowingly solicit, collect, or process personal data from children or persons under the age of majority.

If an agency or parent discovers that a minor has submitted personal data through our website chat or WhatsApp integration without verified parental consent, contact our Data Protection Officer immediately at privacy@resolyticsai.com. Upon verification, we will promptly and permanently purge all associated records from our active databases and backup logs.

9Technical Safeguards & Security Architecture (NDPA Section 39)

Sales Wizard implements rigorous technical and organizational measures to prevent unauthorized disclosure, alteration, or data destruction:

AES-256-GCM Encryption at Rest

Meta WhatsApp Cloud API permanent tokens, app secrets, and database credentials are encrypted using AES-256-GCM authenticated cipher with SHA-256 key derivation.

TLS 1.3 Encryption in Transit

All traffic across web browsers, WhatsApp webhooks, and backend APIs is secured with HTTPS TLS 1.3 encryption with Perfect Forward Secrecy.

PostgreSQL Row-Level Security (RLS)

Verified tenant isolation across all 26 database tables. Queries strictly execute within authenticated organization_id boundaries.

Write-Time Sensitive PII Redaction

Automated regex and Luhn-check redaction removes Bank Verification Numbers (BVN), NIN, credit card numbers, and CVV before messages are persisted to disk.

10Real Estate Security Caveats & Anti-Money Laundering (SCUML)

Caveat 1: Non-Collection of Financial Secrets (BVN, PINs, CVV)

Sales Wizard will NEVER ask for or store Bank Verification Numbers (BVN), National Identity Numbers (NIN), debit/credit card CVV codes, or banking passwords. Built-in guardrails immediately filter and redact accidental submissions.

Caveat 2: Non-Binding Property Quotes & Legal Representation

Property descriptions, prices, and availability shared by AI agents are informational estimates. Legal conveyancing, contract signing, title search (Governor's Consent, Certificate of Occupancy, Gazette), and fund disbursements must be executed with licensed real estate solicitors.

Caveat 3: SCUML & KYC Verification Protocol

In compliance with Nigerian anti-money laundering regulations, client agencies must perform in-person KYC verification and collect official proof of identity before accepting property reservation funds.

11Data Subject Rights (NDPA Sections 34–38 & GDPR Art. 15–22)

Every individual whose data is processed through Sales Wizard possesses enforceable rights:

Right of Access (NDPA Sec. 34): Obtain confirmation and an itemized transcript of all personal data held.
Right to Rectification (NDPA Sec. 35): Request prompt correction of inaccurate or incomplete contact details or preferences.
Right to Erasure / “Right to Be Forgotten” (NDPA Sec. 36): Delete prospect profile, phone number, and conversation history. Sales Wizard provides a one-click “Delete Lead (GDPR Erasure)” feature in the CRM workspace.
Right to Data Portability (NDPA Sec. 38): Export lead records in standardized, machine-readable JSON or CSV format.
Right to Object & Opt-Out: Withdraw consent to automated marketing or communication on WhatsApp by replying “STOP”.

12Data Protection Officer & Regulatory Contacts

To exercise data subject rights, submit a Data Subject Access Request (DSAR), or report a security concern, contact our designated Data Protection Office:

Data Protection Officer (DPO)

Resolytics AI Solutions Limited (RC 7291842)

Email: privacy@resolyticsai.com

Headquarters: Lagos, Nigeria

You also maintain the statutory right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.