This Privacy Notice explains how CodeTag ("we", "our", or "the platform") collects, processes, protects, and retains technical and account data when businesses register, access, or utilize our barcode, voucher, and equipment asset tracking systems. We operate in compliance with the Nigeria Data Protection Act (NDPA) and recognized data protection standards.
1. Purpose of Data Processing
CodeTag is a business-to-business platform. We process personal and technical information strictly for legitimate commercial, operational, and cybersecurity purposes, including:
- Authenticating authorized business account holders and personnel.
- Enforcing platform security, preventing unauthorized access, and defending against credential stuffing or brute-force attacks.
- Detecting and mitigating free-trial abuse, automated bot registrations, and multi-account creation on single devices.
- Administering barcode quota allowances, transactional audit ledgers, and subscription billing.
- Complying with statutory accounting and regulatory obligations under applicable Nigerian laws.
2. Information We Collect
We restrict data collection strictly to what is necessary to deliver our services securely:
- Account Information: Business legal name, business contact email, phone number, operating physical address, authorized administrator name, and cryptographic password hashes. We do not store plaintext passwords.
- Network Identifiers: Internet Protocol (IP) addresses observed during account registration, email verification, session authentication, and logout events.
- Device and Browser Telemetry: User-Agent header strings, browser vendor, operating system family, screen resolution, timezone offset, platform architecture, and a persistent pseudonymous client identifier stored via local storage and secure HTTP cookies.
- Operational Ledger Records: Transaction timestamps, credit balances before and after operations, barcode batch identifiers, and administrative review records.
Scope Limitation: We do not access, scan, or extract private files, personal contact lists, location GPS coordinates, or unrelated data from your computer or mobile device.
3. Device and Network Telemetry Governance
In accordance with Section 3 and Section 11 of our operational framework, client telemetry and network identifiers are used to maintain system integrity. An IP address or device identifier alone does not prove the identity of a specific human individual, as households, mobile gateways, and offices routinely share addresses.
Consequently, telemetry matches generate internal review flags for administrative inspection rather than automated permanent bans. Legitimate businesses operating on shared commercial or institutional networks are safeguarded against arbitrary system lockouts.
4. Data Retention Schedule
We maintain defined retention windows to ensure data is not held longer than operationally necessary:
| Data Category | Operational Purpose | Retention Period |
|---|---|---|
| Login & IP Access Logs | Security monitoring and breach investigation | 12 Months (Rolling) |
| Verification & Reset Tokens | One-time authentication transactions | 30 Minutes (Auto-consumed) |
| Credit & Quota Ledger | Financial reconciliation and auditability | 7 Years (Statutory Requirement) |
| Security Risk Flags | Abuse prevention and administrative review | 24 Months |
5. Security Controls & Confidentiality
All communications with CodeTag are encrypted in transit using Transport Layer Security (TLS/HTTPS). Stored passwords are salted and hashed using standard bcrypt algorithms. Sensitive tokens are stored solely as cryptographic SHA-256 hashes. Database access is strictly confined to authenticated backend application layers, and audit logs are append-only to prevent tampering.
6. Data Subject Rights Under NDPA
Under the Nigeria Data Protection Act (NDPA), registered users and designated representatives possess statutory rights regarding their personal information, including:
- The right to request confirmation of whether their personal data is being processed.
- The right to rectify inaccurate, incomplete, or outdated account information via the account management console.
- The right to request erasure of their personal data, subject to ongoing statutory, fraud prevention, or financial retention requirements.
- The right to lodge an inquiry or complaint with data protection supervisory authorities.
7. Inquiries & Contact Information
For inquiries regarding this Privacy Notice, data handling practices, or data deletion requests, contact our security administration desk:
CodeTag Platform Administration
Domain: codetag.com.ng
Direct Electronic Contact: privacy@codetag.com.ng