Privacy Policy

Haleph Business Systems Limited (RC 9747138), Suite 111, GCL Plaza, Aminu Kano Crescent, Wuse 2, Abuja, FCT, Nigeria, is the data controller for the personal data described in section 3, except where section 2 says otherwise. This policy explains what we collect, why, who we share it with, where it is kept, how long we keep it and what your rights are under the Nigeria Data Protection Act 2023 (the "NDPA"). Privacy contact: privacy@haleph.com.

For you, the account holder, and the people you authorise to use your account, we are the data controller. For the people whose details your business enters into Haleph (your customers, suppliers and employees), your business is the data controller and we are its data processor: we handle that data only on your business's instructions and under the data-processing section of the Terms of Service. Those people should contact the business about their data, and we help the business respond.

• Account data: your name, email address, password (stored only as a one-way hash, never as the password itself), phone number if you give it, and your display preferences.
• Business data: business name and type, registration number, Tax Identification Number, addresses, logo, and the bank account you nominate to receive payments (account number, bank and account name).
• Financial records: the invoices, credit notes, payments, expenses, journal entries and the customer, supplier and employee records you create; and the audit trail of actions in your account (who did what, and when).
• Banking data: where you connect a bank account through our licensed open-banking provider, read-only transaction and balance data for the accounts you choose. We never receive your online-banking sign-in details.
• Payment data: when a customer pays through the Service, we receive the payment's reference, amount, status and the payer details the processor provides. We never see or store card numbers.
• Technical data: IP address, device and browser type, timestamps and request logs, used to keep the Service secure and working.
• Communications: what you send to support.

We do not ask for, and do not knowingly collect, special categories of personal data.

• To provide the Service (keep your books, issue invoices, collect payments, produce reports): performance of our contract with you.
• To meet our legal obligations (tax record-keeping, e-invoicing where enabled, lawful requests from authorities): legal obligation.
• To keep the Service secure and reliable (sign-in, rate limits, the audit trail, fraud prevention): our legitimate interests, balanced against yours.
• To tell you about changes to the Service and your account: our contract and legitimate interests.
• To send you marketing: only with your consent, which you can withdraw at any time.
• To share your data with a financing partner: only with your explicit, revocable consent, given for that purpose.

We do not sell personal data. We share it only with:

• the Nigeria Revenue Service, where e-invoice transmission is enabled for your account, to the extent the law requires;
• a licensed Nigerian payment processor, to collect and settle payments you choose to accept;
• a licensed open-banking provider, when you connect a bank account;
• service providers that host, store, back up and deliver the Service and its emails on our behalf, bound by contract to protect your data and to act only on our instructions;
• a financing partner, only with your explicit consent;
• authorities and courts, where the law requires, or to protect rights, property and safety;
• a successor, if Haleph is sold or merged, with notice to you.

Our hosting, database and email providers are located in the United States, so your personal data is transferred to and stored outside Nigeria. We do this under contractual safeguards that require each provider to protect the data to a standard consistent with the NDPA, with encryption in transit and at rest, and we remain responsible for it. Payments and banking data are processed by licensed providers in Nigeria. Fingerprints, never data, are published to a public blockchain network, which has no single location.

Every action in your account is recorded in an audit trail that cannot be edited or deleted. Each record carries a fingerprint (a cryptographic hash) linked to the record before it. Once a day, one combined fingerprint of all new records is published to a public blockchain network. The published fingerprint contains no personal data, amount, name or identifier, and cannot be turned back into the records it came from. This is how your records can be proven unchanged to a customer, a lender or a tax officer. It also means that the records and their fingerprints are kept as section 8 sets out.

Encryption in transit and at rest; passwords and sign-in tokens stored only as one-way hashes; an audit trail the database itself refuses to alter; daily publication of fingerprints to a public network; access to production systems limited to named people and recorded; rate limits and session controls; no card data stored. No system is perfectly secure. If a breach affects your personal data, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it and tell you without undue delay where the risk to you is high.

Under the NDPA you may ask us to: give you access to your personal data; correct it; delete it; restrict or object to our processing of it; give it to you in a portable form; and withdraw consent where our processing rests on consent. Write to privacy@haleph.com. We respond within 30 days. Exercising these rights does not affect records the law requires us to keep, or fingerprints that contain no personal data; we will tell you what we can and cannot do, and why. You may also complain to the Nigeria Data Protection Commission.

We use only the cookies needed to keep you signed in and secure. We do not use advertising or tracking cookies. Our website's visitor statistics do not use cookies and do not identify you.

The Service is for businesses and for people aged 18 or over. We do not knowingly collect data from children.

We do not make decisions about you by automated means that have legal or similarly significant effects. If a feature flags a transaction for review, a person decides what happens.

We send marketing only if you opt in, and every marketing message has an unsubscribe link. Messages about your account, security or the Service are not marketing.

We will post changes here with a new date, and tell you of material changes by email or in the Service.

Haleph Business Systems Limited, Suite 111, GCL Plaza, Aminu Kano Crescent, Wuse 2, Abuja, FCT, Nigeria. privacy@haleph.com.