Privacy Policy

Last updated: 17 August 2026

1. Who we are

RABSTEL (“RABSTEL”, “we”, “us”) operates the identity verification platform at rabstel.com.ng. For the purposes of the Nigeria Data Protection Act 2023 (NDPA) we act as a data controller for the account information of our customers, and as a data processor when we transmit a search request on a customer's instruction to an upstream data provider.

Operator: complete this section before launch with your registered company name, RC number and registered office address.

2. What we collect

2.1 Information you give us

• Account details — full name, email address, phone number and password (stored only as a cryptographic hash, never in readable form).
• Profile information — an optional profile picture.
• Support correspondence — messages you send us and the replies we send you.

2.2 Verification data

When you run a check you supply an identifier — a NIN, a BVN, a phone number, a tracking ID or an RC number — together with any supporting details the service requires. We use this solely to perform the check you asked for.

Note that this data often relates to a third party, not to you. You are responsible for having a lawful basis to submit it. See section 8.

2.3 Financial information

• Your wallet balance and full transaction ledger.
• The virtual account number issued to you for funding.
• Records of funding credits received from our payment partner.

We do not collect or store card numbers, CVVs or bank login credentials. Funding happens by bank transfer to your virtual account.

2.4 Technical information

• IP address, browser and device type, and approximate location derived from IP.
• Sign-in history, including failed attempts, for account-security purposes.
• An audit record of verifications performed and results viewed.

3. Why we process it, and on what basis

Purpose	Lawful basis (NDPA s.25)
Creating and running your account	Performance of a contract
Carrying out verifications you request	Performance of a contract
Processing wallet funding and debits	Performance of a contract
Fraud prevention, rate limiting and audit logging	Legitimate interest; legal obligation
Service and security notification emails	Performance of a contract
Marketing emails	Consent (withdrawable at any time)
Retaining transaction records	Legal obligation

4. How we protect it

Privacy is designed into the platform, not added afterwards:

• Minimisation — each service asks only for the fields that check requires.
• Masking — identity numbers appear masked (for example 123******01) throughout the interface. The full value is shown only to the account that submitted it.
• Encryption in transit — the platform is HTTPS-only, with HTTP Strict Transport Security enforced.
• Encryption at rest — provider credentials are stored encrypted with AES-256-GCM.
• Password security — passwords are stored as salted bcrypt hashes and are never recoverable, by us or anyone else.
• Access control — role-based permissions separate customer and administrative access; sensitive administrative tools are restricted further.
• Audit logging — access to identity data is recorded. Audit rows store a masked identifier and a one-way keyed hash, never the raw number.
• Automatic deletion — generated slip files are purged automatically once their retention window ends.
• Rate limiting — sign-in, registration, password reset and verification submission are all throttled against abuse.

5. Who we share it with

We share personal data only with:

• Verification data providers — the identifier you submit is passed to the provider that holds the relevant records, purely to perform your search.
• Our payment partner — to issue your virtual account and confirm transfers into it.
• Our email delivery provider — to send transactional and security emails.
• Regulators and law enforcement — where we are legally required to.

We do not sell personal data, and we do not share it for third-party advertising.

6. How long we keep it

Data	Retention
Account records	For the life of the account, then up to 6 years
Wallet and transaction records	6 years (financial record-keeping)
Generated slip and result files	48 hours by default, then automatically deleted
Verification history (metadata)	For the life of the account
Sign-in and audit logs	12 months
Support correspondence	24 months

7. Your rights

Under the NDPA you have the right to:

• Access the personal data we hold about you.
• Rectify data that is inaccurate or incomplete.
• Erasure of your data, where no legal obligation requires us to keep it. Note that financial records must be retained.
• Restrict or object to certain processing.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent at any time, where consent is the basis (for example marketing email).
• Complain to the Nigeria Data Protection Commission (NDPC).

To exercise any of these, email support@rabstel.com.ng. We respond within 30 days. We may ask you to verify your identity first, so that we do not disclose your data to someone else.

8. Your obligations when submitting third-party data

Most checks on RABSTEL concern someone else's identity. When you submit another person's NIN, BVN, phone number or company details, you confirm that:

• you have a lawful basis to process that person's data — normally their informed consent, or a legal or contractual necessity;
• you will use the result only for the stated, lawful purpose;
• you will keep the result secure and will not publish or resell it; and
• you accept the role of data controller for that data in your own business.

Using RABSTEL to look up people without a lawful basis — including out of curiosity, to trace or harass someone, or to build a dataset for resale — is a breach of these terms and of Nigerian law. Accounts found doing so are suspended and reported.

9. Cookies

We use a single strictly necessary cookie to keep you signed in. It is marked HttpOnly, Secure and SameSite=Lax, so it cannot be read by scripts and is not sent on cross-site requests. We do not use advertising or cross-site tracking cookies.

10. Children

RABSTEL is for business use and is not directed at children. We do not knowingly create accounts for anyone under 18.

11. Data breaches

If a breach occurs that is likely to result in a risk to your rights, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and will inform affected users without undue delay.

12. Changes

We may update this policy. The “last updated” date at the top always reflects the current version, and material changes will be notified to you by email or in your dashboard.

13. Contact

Questions about this policy, or about how we handle your data:
Email: support@rabstel.com.ng
Phone: 07044448788
WhatsApp: message us

If you are not satisfied with our response, you may complain to the Nigeria Data Protection Commission.