Privacy & Data Protection (NDPR)

1. Who we are

Bacenik provides a Decision Readiness Platform for Nigerian oil & gas procurement and fabrication. We process personal and company data under the Nigeria Data Protection Regulation (NDPR).

2. Data we collect

• Company profile (legal name, CAC, address, services)
• Compliance documents uploaded by your organization
• Tender/RFQ text you paste for checklist and qualification
• Readiness scores, submission readiness, and decision outcomes
• Advisory requests and Bacenik review deliverables
• Your account email and activity history (sign-in, score views, advisory requests)

3. How we use data

To generate Procurement Readiness Scores, submission readiness, tender checklists, executive PDFs, and Bacenik advisory deliverables. We do not sell your data. We do not replace official NipeX, NOGIC JQS, or government certification processes.

4. Storage, subprocessors & security

Each organization's data is kept separate. Documents are stored securely on AWS S3 (recommended region: af-south-1) or approved storage. Access is role-based; Bacenik reviewers only see organizations that request advisory review.

Subprocessors include:

• Vercel — web application hosting
• Railway — API hosting
• Neon / PostgreSQL — database
• Amazon Web Services (S3) — document storage

5. Data Protection Officer

Contact our DPO at dpo@bacenik.com for NDPR-related requests.

6. Your rights (NDPR)

You may request access, correction, export, or deletion of your organization's data. Contact privacy@bacenik.com. We respond within 30 days.

7. Retention & breach notification

We keep your data for the period you use Bacenik, plus up to 12 months unless you ask us to delete it sooner. Aggregated, anonymised trends may be used to improve the product. If a breach affects your organization, we will notify you within 72 hours where required under NDPR.