Privacy Policy

1. Who we are

Cortiva [insert full registered company name], a company incorporated under the laws of the Federal Republic of Nigeria (RC [insert RC number]), with its registered address at [insert registered address], operates slotmi. For data-protection purposes, Cortiva is the data controller for personal data processed through the Services, except where a Business User is itself acting as a controller of its own Customers' data — see Section 6.

2. Information we collect

1. 2.1 What business owners give us. When a business signs up for slotmi, we collect the business's name, category, address, and contact details, and the name, email address, and phone number of the account owner and any staff added to the account.
2. 2.2 Information about a business's customers. A business owner who uses slotmi to manage bookings, invoices, or marketing may enter their own customers' names, phone numbers, email addresses, and booking or purchase history into the Services. Where the slotmi customer app is available, a Customer may also create an account directly and provide the same categories of information, plus their search and booking activity.
3. 2.3 Payment information. Payments made through slotmi are processed by Paystack, a licensed Nigerian payment service provider. We do not store full card numbers, card security codes, or full bank account credentials — Paystack collects and processes that data directly, subject to Paystack's own privacy policy. We store the payment outcome (amount, status, timestamp, and payment method type) needed to reconcile invoices and bookings.
4. 2.4 Communications. If you contact us — through the "Contact us" form, the waitlist form, email, or phone — we collect what you provide (name, email, phone, and the content of your message) to respond. If we send you a booking confirmation, reminder, or receipt, we do so over WhatsApp (via Meta's WhatsApp Business Cloud API) or email (via our email provider, Resend); those providers process the message content and your phone number or email address as needed to deliver it.
5. 2.5 App and device information. If you use the slotmi business app or, once available, the customer app, we may collect a device token for push notifications (delivered through Firebase Cloud Messaging, a Google service), your device type, operating system, and app version.
6. 2.6 Usage and log data. Like most websites and apps, our servers automatically log standard technical information — IP address, browser type, pages or screens visited, and timestamps — for security, debugging, and service-reliability purposes.
7. 2.7 Cookies. This website uses only the cookies strictly necessary to run it (for example, to remember a submitted form). We do not currently use third-party advertising or analytics cookies. If that changes, we will update this policy and, where required by law, ask for your consent first.

3. How we use information

We use the information described above to: create and administer Business User and Customer accounts; operate the booking, invoicing, and payment features of the Services; send transactional communications such as booking confirmations, reminders, invoices, and receipts; respond to enquiries submitted through our contact and waitlist forms; detect, investigate, and prevent fraud, abuse, and security incidents; comply with legal and regulatory obligations, including tax and e-invoicing requirements under Nigerian law; and maintain, troubleshoot, and improve the Services.

4. Legal basis for processing

Where the Nigeria Data Protection Act, 2023 ("NDPA") or a similar law applies, we rely on one or more of the following legal bases for each use described in Section 3: performance of a contract with you (for example, operating your slotmi account); your consent (for example, if we ever ask to send you non-essential marketing messages); our legitimate interests, balanced against your rights (for example, securing the Services against fraud); and compliance with a legal obligation (for example, tax reporting).

5. How we share information

We do not sell personal data. We share personal data only as follows:

1. (a) Service providers, who process data on our behalf and only for the purposes described in this policy: Paystack (payment processing), Resend (transactional email delivery), Meta Platforms, Inc. (WhatsApp Business Cloud API, for message delivery), and Google/Firebase (push notification delivery).
2. (b) The other side of a booking, to the extent necessary to complete it — for example, a business needs a Customer's name and phone number to confirm an appointment.
3. (c) Nigerian tax and regulatory authorities, where required by law, including in connection with e-invoicing obligations.
4. (d) A professional adviser, law enforcement, or a court, where we are required to by law, or to establish, exercise, or defend our legal rights.
5. (e) A successor entity, in the event of a merger, acquisition, financing, or sale of assets, subject to that entity agreeing to honor the commitments in this policy.

6. Business Users as data controllers

When a Business User enters their own Customers' personal data into slotmi (for example, to record a booking or send an invoice), the Business User is the data controller for that data, and slotmi acts as a data processor on the Business User's instructions. Business Users are responsible for having a lawful basis to collect and use their Customers' data (for example, obtaining consent where required) and for responding to their own Customers' data-protection requests, with slotmi's reasonable technical assistance.

7. Data retention

We keep personal data for as long as needed to provide the Services and for the additional period required to comply with legal, tax, and accounting obligations (which, for financial records under Nigerian law, is typically at least six years) or to resolve disputes. When a Business User closes their account, we delete or anonymize their data within a reasonable period, except where we must keep it longer for the reasons above.

8. Data security

We use administrative, technical, and physical safeguards designed to protect personal data, including encrypting data in transit, restricting internal access on a need-to-know basis, and never storing full payment card details ourselves. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your rights

If the NDPA or a similar law applies to you, you have the right to: request confirmation of whether we process your personal data and access a copy of it; request correction of inaccurate data; request deletion of your data, subject to our legal retention obligations; object to or request that we restrict certain processing; request a portable copy of data you provided to us; and withdraw consent at any time where we rely on consent. To exercise any of these rights, contact us using the details in Section 14. If you are not satisfied with our response, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng. If a Business User entered your data into slotmi on their own behalf (see Section 6), you may need to direct some requests to that business directly; we will assist them in responding.

10. Children's privacy

The Services are not directed at, and we do not knowingly collect personal data from, individuals under the age of 18. If you believe a child has provided us with personal data, please contact us so we can delete it.

11. International data transfers

Some of our service providers (including Meta and Google/Firebase) may process data outside Nigeria. Where personal data is transferred outside Nigeria, we take steps required by the NDPA to ensure it receives an adequate level of protection, including relying on standard contractual protections or another lawful transfer mechanism.

12. Third-party links

The Services may link to third-party websites or services (for example, Paystack's payment page during checkout). This policy does not cover those third parties' practices; please review their own privacy policies.

13. Changes to this policy

We may update this policy from time to time. If we make material changes, we will post the updated policy here with a new "Last updated" date and, where required by law, notify you by other means.

14. Contact us

Questions about this policy or your data can be sent to enquiry@cortiva.ng or +234 802 068 9069.