Data Protection Policy

This Data Protection Policy describes how Addicnet Technologies LLC ("Addicnet", "we", "us") collects, processes, stores, and safeguards personal data in compliance with applicable data protection laws, including the General Data Protection Regulation (GDPR), South Africa's Protection of Personal Information Act (POPIA), the Nigeria Data Protection Act (NDPA), Ghana's Data Protection Act, and Rwanda's Law on Protection of Personal Data.

This policy applies to all personal data processed by Addicnet in the course of providing our digital services marketplace and partner-commerce platform and related services.

When you engage our services as a client, Addicnet acts as a Data Controller for personal data you provide directly to us (e.g., contact details, account information). Where we process personal data on your behalf as part of a service engagement (e.g., processing your end-user data within a deliverable), Addicnet acts as a Data Processor acting on your documented instructions.

As a Controller, you retain responsibility for ensuring you have a lawful basis to collect and share personal data with us. As a Processor, we process data only as necessary to deliver the agreed services and in accordance with your written instructions.

We process the following categories of personal data:

• Identity data — name, job title, company name
• Contact data — email address, phone number, postal address
• Account data — credentials, role assignments, access logs
• Project data — requirements, specifications, communications, and shared documents
• Payment data — billing address, invoice history (card data is handled exclusively by Stripe)
• Technical data — IP address, browser type, device information, usage analytics

We do not process special categories of personal data (such as health, racial origin, or biometric data) unless explicitly required and with your consent.

We process personal data on the following lawful bases:

• Contract performance — to deliver the services you have engaged us to provide
• Legal obligation — to comply with tax, accounting, and regulatory requirements
• Legitimate interests — to operate, secure, and improve our platform and services
• Consent — where you have explicitly provided consent, such as for marketing communications

We implement industry-standard technical and organisational security measures, including:

• Encryption of data in transit using TLS 1.2+ and encryption of data at rest
• Role-based access controls and least-privilege access principles
• Regular security reviews and vulnerability assessments
• Secure cloud infrastructure with monitored access logging
• Staff training on data protection and information security
• Segregation of client data to prevent cross-contamination
• Payment data handled exclusively by Stripe (PCI-DSS compliant) — we never store card details

We engage the following sub-processors to deliver our services:

• Stripe — payment processing (PCI-DSS Level 1 certified)
• Base44 — application infrastructure, database hosting, and platform services
• Email service providers — transactional and service-related email delivery
• Cloud hosting providers — secure infrastructure and data storage

All sub-processors are bound by written agreements requiring them to protect personal data to standards at least equivalent to those in this policy. We conduct due diligence before engaging any new sub-processor and will notify clients of material changes to our sub-processor list.

Addicnet operates across South Africa, Nigeria, Ghana, Rwanda, and the United States. Your personal data may be transferred to and processed in countries other than your own. Where we transfer data outside of an adequate jurisdiction, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by relevant authorities
• Binding corporate rules where applicable
• Explicit consent for specific transfers where required
• Verification of adequate data protection standards in the receiving country

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

• Active client data — retained for the duration of the engagement plus the contractually agreed period
• Account and billing records — retained for 7 years for tax and accounting compliance
• Project deliverables and communications — retained per the agreed SOW, typically 5 years
• Marketing data — retained until consent is withdrawn or you request deletion

Upon expiry of the retention period, data is securely deleted or anonymised. You may request earlier deletion of your data, subject to legal retention obligations.

Depending on your jurisdiction, you have the right to:

• Be informed about how your data is processed
• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Request erasure of your personal data ("right to be forgotten")
• Restrict or object to processing
• Receive your data in a portable, machine-readable format
• Withdraw consent at any time (where processing is consent-based)
• Lodge a complaint with your local data protection authority

To exercise these rights, contact us at support@addicnet.com. We respond to requests within 30 days, and may extend this by a further 60 days where the request is complex.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR and equivalent regulations. Where the breach is likely to result in a high risk to your rights, we will also notify affected data subjects without undue delay.

Our incident response procedures include containment, assessment, notification, remediation, and post-incident review to prevent recurrence.

We comply with the data protection laws of every jurisdiction in which we operate:

• South Africa (POPIA) — we process personal information lawfully and in accordance with the conditions for lawful processing
• Nigeria (NDPA 2023) — we adhere to the Nigeria Data Protection Commission's requirements for data processing
• Ghana (Data Protection Act 843) — we register and comply with the Data Protection Commission's standards
• Rwanda (Law N°058/2021) — we comply with the Law relating to the Protection of Personal Data
• European Economic Area (GDPR) — we process data in accordance with GDPR principles and data subject rights
• United States — we comply with applicable federal and state privacy laws, including CCPA where relevant

For data protection inquiries, you may contact our data protection contact:

We may update this Data Protection Policy to reflect changes in our practices, legal requirements, or operational needs. We will notify clients of material changes via email or a notice on our platform.