At RENT CHECK REFERENCING COMPMAY LIMITED,a limited liability company. Registered under the laws of the federal republic of Nigeria (whose website and brand name is Iverify.ng), we understand the importance of data protection and privacy.
We are committed to ensuring that the personal information of our clients, vendors and customers is collected, used, and disclosed in accordance with all applicable laws and regulations of the Federal Republic of Nigeria, the Nigerian Data protection Regulation 2019, including the global best practices referenced on Data Protection and privacy Regulations.
This policy sets out our approach to data protection and privacy, and explains how we collect, use, and disclose personal information
RentCheck Referencing Company Limited is committed to treating information of employees, customers, and other stakeholders with the utmost care and confidentiality.
In line with the company’s commitment and compliance with the NDPR 2019, this Data Protection Policy has been developed to ensure that Rentcheck Referencing company limited through all channels of services, including their platforms Iverify.ng, manages data ethically, protect data subject, ensure compliance to regulatory authorities, maintains confidentiality, integrity of data.
Additionally, ensures that data protection and privacy procedures, systems, controls and measures appropriate to the company’s risk profile have been implemented.
Purpose of the Policy:
The purpose of this policy is:
To bring to the attention of all staff the need to improve and maintain security of information systems, and to advise managers of the approach being adopted to achieve the appropriate level of security.
To bring to the attention of all managers and staff, their responsibilities under the requirements of relevant legislation, including Data Protection and Human Rights legislation and guidance, and the importance of ensuring the confidentiality of personal and sensitive data.
To ensure that the there is compliance with current legislation and FG Directives, meets its statutory obligations and observes standards of good practice. To minimise the risk of security breach and prosecution.
This policy is compiled with the aim to accomplish the following:
Roles and Responsibility
Rentcheck referencing Company Limited Iverify.ng have designated key stakeholders identified to drive the adherence and implementation of the Policy and necessary data protection controls or protocols.
Head of compliance and legal services
Board
Management:
Employees
Data Protection and Governing Principles
Rentcheck Referncing Company Limited(iverify.ng) shall ensure that such data are obtained from data subjects are used in accordance with the data protection regulation in Nigeria. Personal data shall be handled with the greatest care and used only for legitimate and specified business purposes.
Rentcheck Referencing Company Limited(iverify.ng) shall be guided by the following principles when handling personal data:
Obtaining Consent
The NDPR mandates that consent provided by Data Subjects must be:
To effectively manage consent, Rentcheck Referencing Company Limited(Iverify.ng) shall:
Lawful Data Processing:
Network Access Control
To prevent unauthorized access that may lead to data breach through the company’s network, only devices on iverify.ng access control lists have the permission to utilize our networks. We make use of authentication and authorization mechanisms that ensures unauthorized users are not granted access to our platform or cloud resources.
Passwords and Access Control
Each individual is responsible for keeping their own password secure, and must ensure it is neither disclosed to nor used by anyone else, under any circumstances. Staff must only access systems using their own login and password. All staff are accountable for any activity carried out under their login and password, and this is audited.
Access is controlled on the basis of service requirements. Procedures are in place for allocating and controlling access, and passwords.
Hierarchy Access:
Access is categorized into super admins, admins and No access to classified network. Authorized personnels are allowed access with assign username and passwords.
The Office has designated the following authorized personnel:
They are responsible for implementing, monitoring, documenting and communicating information security policies in the Office.
Information security must addressed at recruitment stage for all staff, and a confidentiality clause included in contracts of employment.
There is a formal procedure for reporting, investigating and recording Information security incidents. Any incidents should be reported to the ICT Services Helpdesk immediately
Risk Analysis
In order to make the best use of resources, it is important to ensure that each Information system is secured to a level appropriate to the measure of risk associated with it. A risk assessment should be carried out for each of the Office information systems and measures put in place to ensure each system is secured to an appropriate level.
Intrusion Prevention System
In order to protect personal data and sensitive information, iverify.ng has implemented an Intrusion Prevention System in the form of a firewall solution. The firewall solution protects the company’s network and connected systems from malicious attacks and hacking from cybercriminals by filtering and blocking unwanted data packets from accessing its computer network. We make use of Google Cloud’s Web Security Scanner to discover vulnerabilities within our applications.
The google cloud web security scanner has a pre-emptive approach to network security as it is able to identify potential threats and respond to them swiftly
When a threat is detected, the it deploys a lateral movement protection defence response, which isolates the threat from spreading, system from communicating with other systems or back to the host.
Endpoint Security System
Our applications are deployed on Google Cloud infrastructure and we leverage Google Cloud Endpoints as our API Gateway. This comes with out-of-the box configurations for API protection and monitoring. The platform comes with an endpoint protection system that combines antimalware, data loss prevention (DLP), a client firewall, application and device control as well as a host-based intrusion prevention system. This also offers website browsing protection and filtering, email protection (such as anti-spam) and patch assessment.
All network management controls and procedures will conform to the NIMC Security Policy code of connection and associated guidance.
Network Management is the responsibility of the ICT Services Directorate; all devices connected to iverify.ng’s Network must meet the required standards. Failure to do so will result in immediate disconnection. No direct connection is permitted between the our LAN, other LAN’s or Internet services accessed via public service providers.
The endpoint protection system offers protection from zero-day attacks and drive-by downloads to minimize damage from breaches.
Data Backup
We have automated backup configured on our database (hosted on Google Cloud SQL) every 24hours with a 7-days retention period. Backups at Iverify.ng are done daily. Backups are encrypted with industry standard solution and backed up data can only be accessed by authorized personnel for control purposes.
Third Party Disclosure
Requesting Party:
The above disclosures to a requesting party shall be made only to the extent necessary for the specific purpose for which the data is furnished provided that a requesting party has obtained consent of the data subject and the data subject has furnished them with the data and consent to verify alongside.
Employees:
Employees shall only have access to, and process personal data based on a “need
to verify” basis in order to perform their job.
All employees are enjoined to ensure that they do not indulge in activities that can result in the compromise or breach of data. In addition, it is the responsibility of everyone to adhere to the dictates of this policy.
Failure to comply with this policy, whether intentional, will lead to disciplinary action (up to and including dismissal).
Employees of iverify.ng are the most important element of its adherence to the protection of Data Subjects’ personal data as they are involved in every step of the data lifecycle, including collecting personal data, processing it in compliance with laws and regulations, employing safeguards, and establishing the means and schedules of retention and deletion. It is therefore imperative that employees understand their role and be committed to safeguarding personal data.
Iverify.ng will ensure that a data protection training program focused on emerging trends is developed annually. More importantly, data protection trainings will be conducted for employees and directors at least annually; and regular data protection and information security awareness campaigns will be run. Additionally, other knowledge resources on data protection and privacy, including guidance on ways the company can better process and safeguard personal data will be constantly shared.
It is important that employees understand the significance of protecting personal data and respecting privacy rights, with the ability to relate this back to the risks and consequences from an individual perspective.
Iverify.ng remains committed to its goal of ensuring employees and other stakeholders understand their respective roles and responsibilities for compliance with the NDPR.
In line with the provisions of the NDPR, the company shall conduct a detailed annual internal audit of its data protection and privacy practices with at least each audit stating:
Similarly, where the company processes the personal of more than 2,000 data subjects annually, it shall conduct a Data Protection Audit through a licensed DPCO and submit the report to NITDA not later than 15th of March of every year.
Legal Requirements and Regulations
The office and all its staff are governed by laws & regulations. Unauthorised or unlicensed software is not permitted on iverify.ng equipment. It is expressly forbidden for any user to load or operate software gained from the Internet, magazine gifts or other sources unless authorised by ICT Services.
Our company is known and incorporated as Rentcheck Referencing Company Limited
Our website www. Iverify. ng is our registered trademark exclusive to Iverify Nigeria by Rentcheck Limited. You can contact us by sending an email to info@iverify.ng