1. Introduction and Overview
Welcome to the Avetium E-Invoicing System ("we", "our", "us"). We are committed to protecting your Personal Data and respecting your privacy whenever you use our e-invoicing application built on the Zoho platform (the "Platform").
This Privacy Policy explains how we collect, use, disclose, store, and protect your Personal Data and your rights under applicable data protection laws, including the Nigeria Data Protection Act, 2023 (NDPA).
This Privacy Policy applies to:
- Businesses that register to use the Platform
- Users authorised by registered businesses to access the Platform
- Individuals whose Personal Data is processed through the Platform
2. About the Platform
The Avetium E-Invoicing System is a cloud-based invoicing application built on the Zoho platform that enables businesses to create, issue, manage, track, and store electronic invoices and related financial records.
Avetium Technologies provides implementation, configuration, onboarding, technical support, and ongoing management of the Platform.
Accordingly:
- Avetium Technologies acts as a Data Controller in relation to Personal Data collected for account management, customer support, and administration of the Platform.
- Where customers upload or process Personal Data relating to their own customers, employees, or suppliers through the Platform, Avetium Technologies acts as a Data Processor on behalf of those customers.
3. Personal Data We Collect
Depending on how you use the Platform, we may collect:
- Name
- Email address
- Telephone number
- Company name
- Business address
- Tax Identification Number (TIN)
- Customer and supplier information
- Invoice information
- Payment and billing records
- User account credentials
- IP address
- Device and browser information
- System activity logs
- Technical support communications
4. How We Collect Personal Data
4.1 Platform Registration
When you register an account, subscribe to the Platform, or create user accounts.
4.2 Use of the Platform
When invoices are created, managed, transmitted, or stored and when users interact with Platform features.
4.3 Customer Support
When you contact us for implementation, onboarding, maintenance, or technical support.
4.4 Website and Technical Information
We may automatically collect technical information including cookies, browser information, IP addresses, and usage analytics.
5. Lawful Basis for Processing
Where the Nigeria Data Protection Act applies, we process Personal Data based on one or more of the following lawful bases:
- Performance of a contract
- Compliance with legal and regulatory obligations
- Legitimate interests, including maintaining system security, fraud prevention, service improvement, and customer support
- Consent, where required by law. You may withdraw your consent at any time, although this will not affect processing already carried out.
6. How We Use Personal Data
We use Personal Data to:
- Provide and maintain the Platform
- Generate and manage electronic invoices
- Process customer accounts and subscriptions
- Provide implementation and technical support
- Improve the Platform and user experience
- Monitor system security and prevent fraud
- Respond to enquiries and support requests
- Comply with legal, tax, accounting, and regulatory obligations
7. Sharing of Personal Data
We do not sell Personal Data.
We may share Personal Data as follows:
7.1 Within Avetium Technologies
Where necessary for customer support, administration, security, and service delivery.
7.2 Third-Party Service Providers
We use trusted service providers to host, operate, and support the Platform. These providers:
- Process Personal Data only for authorised purposes
- Are bound by contractual confidentiality and data protection obligations
- Implement appropriate technical and organisational security measures
7.3 Legal Obligations
We may disclose Personal Data where required by law, court order, regulatory authority, or other lawful governmental request.
8. Cross-Border Data Transfers
Personal Data may be transferred to or stored outside Nigeria where required for the operation of the Platform.
Where international transfers occur, we implement appropriate safeguards, including:
- Contractual data protection obligations
- Compliance with applicable data protection laws
- Appropriate safeguards implemented by our technology partners
9. Data Security
We implement appropriate technical and organisational measures to protect Personal Data, including:
- Multi-factor authentication where applicable
- Encryption of sensitive information
- Role-based access controls
- System monitoring and audit logging
- Regular security assessments
Avetium Technologies maintains internationally recognised information security and privacy management practices, including ISO 27001 and ISO 27701 certifications.
10. Data Retention
We retain Personal Data only for as long as necessary to:
- Provide, maintain, and improve the Platform and our services;
- Manage user accounts and customer relationships;
- Comply with applicable legal, regulatory, accounting, tax, and record-keeping obligations;
- Detect, investigate, and prevent fraud, security incidents, and other unlawful activities;
- Resolve disputes, enforce our contractual rights, and respond to legal claims;
- Maintain business continuity, backup, and audit records where required.
The length of time we retain Personal Data depends on the nature of the information, the purpose for which it was collected, and any applicable legal or regulatory requirements. Personal Data that is no longer required for these purposes will be securely deleted, anonymised, or otherwise rendered irreversibly unreadable in accordance with our data retention and disposal procedures.
Account Deactivation and Deletion
Users may choose to deactivate or request the deletion of their account at any time, subject to any contractual or legal obligations.
- Account Deactivation: When an account is deactivated, access to the Platform is suspended, but Personal Data may continue to be retained for a reasonable period to facilitate account reactivation, comply with legal obligations, maintain audit trails, resolve disputes, or protect our legitimate business interests.
- Account Deletion: Where a user requests permanent deletion of their account, we will take reasonable steps to delete or anonymise Personal Data without undue delay, except where retention is required by applicable law, regulation, court order, tax obligations, fraud prevention requirements, security investigations, or the establishment, exercise, or defence of legal claims.
- Backups: Personal Data may remain in encrypted backup systems for a limited retention period following deletion. Such data will not be restored except where necessary for disaster recovery, legal compliance, or security purposes and will be securely overwritten or deleted in accordance with our backup retention schedule.
- Residual Information: Certain information, such as transaction records, invoices, audit logs, system logs, and records required to demonstrate compliance with applicable laws, may be retained for the period prescribed by law or our legitimate business requirements, even after an account has been deleted.
Once the applicable retention period expires and there is no lawful basis for continued processing, Personal Data will be securely destroyed, erased, or irreversibly anonymised using industry-standard methods designed to prevent reconstruction or recovery.
11. Your Rights
Subject to applicable law, you have the right to:
- Request access to your Personal Data
- Request correction of inaccurate information
- Request deletion of your Personal Data
- Request restriction of processing
- Object to certain processing activities
- Request data portability
- Withdraw consent where processing is based on consent
- Lodge a complaint with the Nigeria Data Protection Commission (NDPC)
12. Children's Privacy
The Platform is intended for business use only and is not designed for individuals under the age of 18. We do not knowingly collect Personal Data from children.
13. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. Any updates will be published on the Platform, and the revised version will become effective on the stated effective date.
14. Contact Us
If you have any questions regarding this Privacy Policy or the processing of your Personal Data, please contact us:
Email: [email protected]
Address:
3rd Floor, Sunny Motors Building
3 Otunba Adedoyin Ogungbe Crescent
Lekki Phase One
Lagos, Nigeria
