1. Who we are
This policy is issued by Bamaja Integrated Online Services Limited ("Bamaja", "we", "us"), a company registered in Nigeria under RC 8992176, with its registered office at 22 Afolabi Brown Street, Akoka, Lagos State, Nigeria.
Bamaja operates several products. This policy covers the company website and the business messaging platform, which provides merchants with an AI-assisted sales and customer-service assistant.
Data protection contact: privacy@nigeriafaces.com · Telephone: +234 805 607 6355
2. Scope of this policy
This policy applies to:
- the public website at nigeriafaces.com;
- the merchant dashboard and onboarding flow for the messaging platform, once released;
- messages exchanged between a participating merchant and that merchant's customers through the Bamaja platform.
It does not apply to a merchant's own separate systems, nor to WhatsApp or Meta services themselves, which are governed by their own policies.
3. Our role: controller and processor
Our responsibilities differ depending on whose data is involved.
| Data | Our role |
|---|---|
| Merchant account data | We are the data controller. We decide what account information is needed to provide the service. |
| Customer messages and order details | We are a data processor acting on the merchant's instructions. The merchant is the controller of their own customer relationships. |
| Website visitors | We are the data controller, though this website collects no personal data (see section 16). |
Merchants who use the platform are responsible for having a lawful basis to message their own customers and for giving those customers their own privacy notice.
4. Data we collect
From merchants
- Business name, registration details, trading address and business category
- Contact name, email address and telephone number of the account owner and authorised staff
- The business phone number connected to the messaging platform
- Identifiers for the merchant's connected business messaging account
- Access tokens issued during authorised onboarding
- Catalogue content the merchant uploads: products, prices, stock, policies and service instructions
- Billing and subscription records, where a paid plan applies
- Platform usage and audit logs, including sign-in events and configuration changes
From a merchant's customers
- The phone number the customer used to contact the business
- The display name the customer has set on their messaging profile
- The content of messages exchanged with that business, including any images, documents or voice notes sent
- Order details the customer chooses to provide: name, delivery address, item selections and preferences
- Message metadata such as timestamps and delivery status
5. How we use data
- To deliver a customer's message to the merchant and generate an accurate reply from that merchant's catalogue and policies
- To record orders and enquiries so the merchant can fulfil them
- To hand a conversation to human staff when it needs one
- To give the merchant a history and summary of their own conversations
- To operate, secure, debug and improve the platform
- To handle support requests and account administration
- To meet legal, regulatory, tax and audit obligations
We do not sell personal data. We do not share customer messages with advertisers, and we do not use one merchant's data to serve another merchant.
6. Lawful basis
Under the Nigeria Data Protection Act 2023 we rely on:
- Performance of a contract — providing the platform to merchants who have signed up for it
- Consent — where a customer opts in to receive messages from a business, and for any optional communications
- Legitimate interests — securing the platform, preventing abuse, and improving reliability, balanced against the rights of the people concerned
- Legal obligation — record-keeping and responses to lawful requests from authorities
7. WhatsApp Business Platform data
Where a merchant connects their own WhatsApp Business Account, Bamaja acts as a technology provider on that merchant's behalf. We request only the permissions needed to run the service:
| Permission | Purpose |
|---|---|
| whatsapp_business_messaging | Receive customer messages sent to the merchant's number and send the merchant's replies. |
| whatsapp_business_management | Register the merchant's phone number, read connected account details, and manage message templates the merchant has approved. |
| business_management | Complete Embedded Signup so the merchant links their own Business Portfolio without sharing passwords with us. |
We do not request or access a merchant's personal social profile, contact lists, friends, advertising accounts or any business asset unrelated to the connected messaging account. Access tokens are stored encrypted, are used only for the merchant that granted them, and are revoked when the merchant disconnects or closes their account.
Merchants remain the owners of their phone number, Business Portfolio and WhatsApp Business Account, and can disconnect at any time and retain them.
8. AI processing
Replies are generated by large language models. To produce a reply, the relevant part of a conversation and the merchant's own catalogue content may be sent to a third-party AI model provider under a service agreement.
- Only the content needed to answer the current enquiry is sent.
- We contract for the data not to be used to train the provider's general models.
- A current list of AI and infrastructure providers is available to merchants and reviewers on request from privacy@nigeriafaces.com.
- Automated replies do not make decisions with legal or similarly significant effects. Any dispute, refund or complaint is routed to a human.
9. Who we share data with
- The merchant whose business the customer contacted — they see their own conversations and orders.
- Messaging platform operators, to deliver messages to and from customers.
- Infrastructure providers supplying hosting, storage, databases and backups.
- AI model providers, as described in section 8.
- Payment processors, where a merchant pays for a subscription.
- Professional advisers and authorities, where we are legally required to disclose.
Every processor is engaged under a written agreement limiting them to our documented instructions.
10. International transfers
Some providers process data outside Nigeria. Where that happens we rely on the transfer conditions permitted by the Nigeria Data Protection Act 2023, including adequacy, contractual safeguards and, where required, the data subject's consent. We assess each provider's security posture before engaging them.
11. How long we keep data
| Category | Retention |
|---|---|
| Customer conversation history | Up to 24 months from the last message, unless the merchant sets a shorter period or requests earlier deletion. |
| Order and enquiry records | Kept while the merchant's account is active, then deleted within 90 days of account closure. |
| Merchant account and catalogue | Deleted within 90 days of account closure. |
| Access tokens | Revoked and deleted immediately on disconnection. |
| Billing and tax records | Retained for the period Nigerian law requires, currently six years. |
| Security and audit logs | Up to 12 months. |
Encrypted backups are rotated out within 35 days of a deletion.
12. Security
- Encryption in transit (TLS) and encryption at rest for credentials and access tokens
- Logical separation of every merchant's data in a multi-tenant architecture
- Role-based access control and least-privilege administrative access
- Audit logging of administrative and configuration actions
- Regular patching, dependency review and backup testing
- A documented breach response process, with notification to the Nigeria Data Protection Commission and affected people where the law requires it
No system is perfectly secure. If you believe you have found a vulnerability, please report it to security@nigeriafaces.com and we will respond.
13. Your rights
Under the Nigeria Data Protection Act 2023 you may ask us to:
- confirm whether we hold your data, and give you a copy;
- correct data that is wrong or incomplete;
- delete data we no longer have a reason to keep;
- restrict or object to certain processing;
- provide your data in a portable format;
- withdraw consent at any time, without affecting processing already carried out.
Write to privacy@nigeriafaces.com. We respond within 30 days. We may ask for enough information to confirm your identity before acting.
If your data was collected through a merchant's business account, we will normally pass your request to that merchant, since they control the customer relationship, and we will support them in fulfilling it.
14. Deleting your data
Full step-by-step instructions, including how merchants disconnect their business account and how customers request erasure, are on our data deletion page.
15. Children
The platform is a business tool and is not directed at children. We do not knowingly collect data from anyone under 18. If we learn that we have, we delete it. Contact privacy@nigeriafaces.com if you believe this has happened.
16. Cookies
This website sets no advertising or analytics cookies and runs no third-party trackers. The merchant dashboard, once released, will use a strictly necessary session cookie to keep you signed in. If we ever add optional analytics, we will ask for consent first and update this policy.
17. Changes to this policy
We will update this page when the platform changes. The effective date and version at the top will change with it. Material changes affecting merchants will also be notified by email.
18. Contact and complaints
Bamaja Integrated Online Services Limited
RC 8992176
22 Afolabi Brown Street, Akoka, Lagos State, Nigeria
Email: privacy@nigeriafaces.com
Telephone: +234 805 607 6355
If you are not satisfied with our response, you may complain to the Nigeria Data Protection Commission (NDPC), the supervisory authority for data protection in Nigeria.