Privacy policy

This notice explains how Baobyte Consulting Limited (“Baobyte”, “we”, “us”) handles personal data in connection with the Baobyte AML Suite, this website, and our dealings with the institutions we work with.

The registered entity details, registered office address and company registration number required in a notice of this kind have not yet been inserted. They must be added before this notice is adopted.

It covers three distinct groups of people: visitors to this website; individuals at institutions that evaluate, buy or use the platform; and the individuals whose personal data our customers process within the platform in the course of their anti-money laundering and counter-terrorist financing obligations. The third group is the largest, and our role in relation to it is different — see section 2.

The Nigeria Data Protection Act 2023 distinguishes between a data controller, which decides why and how personal data is processed, and a data processor, which processes it on the controller’s instructions. Baobyte occupies both roles, in different contexts, and the rights you can exercise against us depend on which applies.

• As a processor. Customer, transaction, screening, case and reporting data held inside an institution’s tenant is processed on that institution’s documented instructions. The institution is the controller: it decides what is collected, why, and for how long. If you are a customer of a bank, fintech or other regulated business that uses the platform, that business — not Baobyte — is the controller of your data, and a request about it should go to them. Our obligations in that role are set out in the data processing agreement.
• As a controller. We are the controller of personal data about website visitors, enquiries and demonstration requests, our customers’ staff who administer or use the platform, our own personnel, suppliers and applicants, and support interactions.

In an institution-operated deployment — on-premise, on the institution’s own infrastructure, or air-gapped — Baobyte does not hold a copy of the tenant data at all. Our processor role in that configuration is limited to what we are given during support, which is itself time-bound, tenant-scoped and audited.

Where we act as controller, we process: name, job title, employer, business email address and telephone number; the content of enquiries, support tickets and correspondence; account and authentication identifiers for people who administer the platform; and technical records of access to our systems.

Where we act as processor, the platform is designed to hold the categories an AML/CFT programme requires. These are set by the controller and typically include:

• Identity and contact data: names, dates of birth, nationality, gender, addresses, telephone numbers and email addresses.
• Government and financial identifiers: bank verification numbers, national identity numbers, tax identification numbers, corporate registration numbers and passport numbers. These are encrypted at field level and searched through a blind index.
• Identity evidence: uploaded identity documents, proof of address and ownership evidence, held as encrypted objects.
• Relationship and ownership data: beneficial ownership structures, control relationships, and the declarations and verification evidence behind them.
• Transactional data: account references, counterparties, amounts, currencies, event and booking times, channels and source references.
• Risk and screening data: customer risk ratings and their inputs; sanctions, politically exposed person and adverse media match candidates, together with the source and version of the list that produced them.
• Investigation and suspicion data: alerts, case notes, analyst reasoning, decisions, approvals, and the content of suspicious transaction and currency transaction reports.
• Audit data: who did what, when, under which permission, and against which record.

Directly from you — enquiries, demonstration requests, support tickets, and account administration.

From our customers — where an institution provisions its staff on the platform, or transmits customer records into its tenant from its core banking system, payment switch or onboarding channel.

From third parties, on the controller’s instruction — identity verification providers, and sanctions, politically-exposed-person and adverse-media data providers. The platform records the source and version of the data that produced any match, so that a decision can be re-examined against the list as it stood at the time.

Automatically — technical logs of access to our systems. This website sets no analytics or advertising cookies and makes no request to any third-party domain; see the cookie policy.

This mapping has not been confirmed by counsel and must be reviewed before adoption.

• Providing and supporting the platform — performance of the contract with the institution, and our legitimate interest in operating and securing the service.
• Processing within a customer tenant for AML/CFT purposes — the controller’s basis, which is ordinarily compliance with a legal obligation under Nigerian anti-money laundering law and the regulations made under it. Baobyte processes on instruction and does not select this basis.
• Responding to enquiries and demonstration requests — steps taken at your request prior to entering a contract, and our legitimate interest in responding to business enquiries.
• Security, audit and abuse prevention — our legitimate interest in protecting the service and the data it holds, and compliance with legal obligations.
• Marketing communications — consent, which you may withdraw at any time without affecting the lawfulness of anything done before withdrawal.
• Meeting our own legal and regulatory obligations — compliance with a legal obligation.

Data indicating that a person has been screened against a sanctions or politically-exposed-person list, has been the subject of an alert or an investigation, or appears in a suspicious transaction report, is among the most sensitive personal data an institution holds. Its disclosure can cause serious and irreversible harm to the individual, and its improper disclosure to the individual is itself a criminal offence in many circumstances — the prohibition commonly described as tipping-off.

The platform is built around that reality:

• Access to suspicion, screening and case data is separated from access to customer capture data, by role.
• Reads of sensitive identifiers are recorded as audit events describing who accessed what and under which permission, without placing the identifier itself into the audit record.
• Executive and board analytics are aggregate counts only, with small-cell suppression applied inside the query, so that no figure resolves to an individual.
• Support access is time-bound, tenant-scoped, reason-coded and audited, and cannot be used to extract secrets or bypass an approval.

The consequence for a data subject is that certain rights are restricted in this context. Section 11 explains how.

Personal data may be disclosed to:

• Our customers, where the data relates to their tenant and they are the controller.
• Subprocessors engaged to provide part of the service. The register of these, and its current state, is published at trust centre → subprocessors. That register is not yet populated, and no engagement should be inferred from this section.
• Regulators, supervisors and law enforcement, where disclosure is required or permitted by law. In the AML context this ordinarily means the institution — as controller — filing with the Nigerian Financial Intelligence Unit or responding to its supervisor, rather than Baobyte disclosing anything.
• Professional advisers, and a purchaser or successor in a corporate transaction, subject to appropriate confidentiality.

We do not sell personal data, and we do not disclose it for third-party advertising.

Whether any personal data is transferred outside Nigeria has not been determined, because the hosting arrangements and the subprocessor register have not been settled.

Where the platform is deployed on the institution’s own infrastructure, the institution controls where the data sits and no transfer by Baobyte arises. Where a transfer does occur, the Nigeria Data Protection Act permits it only where the destination provides an adequate level of protection or an appropriate safeguard or derogation applies; the mechanism relied upon must be identified here, per recipient category, before this notice is adopted.

No retention period is stated in this draft. AML record-keeping obligations set a statutory minimum that overrides a general preference to delete, and the applicable instrument and period must be confirmed by counsel rather than assumed.

The mechanisms that will enforce whatever period is set already exist in the product:

• Retention policies are held per resource type, are versioned, and are changed through a proposal and approval flow rather than by direct edit.
• A legal hold prevents reduction or purge of the records it covers. A purge that would breach a hold is refused rather than partially applied.
• Where erasure is appropriate and lawful, cryptographic erasure — destroying the subject’s key so that the ciphertext becomes unrecoverable — is available. Note the honest limitation: an erasure record does not by itself decide the retention boundary, and the platform deliberately does not let an erasure request override an AML retention obligation or a legal hold.
• Audit events are append-only. They record that something happened and by whom; they are not editable, and the integrity of the chain depends on that.

The technical and organisational measures are described in detail, with their limits, at trust centre → security. In summary: tenant isolation enforced in the database as well as the application; authentication delegated to the institution’s identity provider with authorisation declared per API operation; field-level encryption of sensitive identifiers under a per-subject key with blind-index search; encryption of documents and their filenames before storage; write-once evidence storage with no delete operation; an append-only per-tenant audit hash chain; four-eyes approval on sensitive decisions; and telemetry that excludes identifiers, raw URLs and decrypted data by design.

No independent security certification or penetration test has been obtained. That is recorded, without qualification, at trust centre → certifications.

Subject to the conditions and exemptions in the Nigeria Data Protection Act, you have the right to be informed about processing; to access your personal data; to have inaccurate data corrected; to have data erased in defined circumstances; to restrict processing; to object to processing carried out on the basis of legitimate interests; to portability of data you provided; and to withdraw consent where consent is the basis.

Where Baobyte is a processor, direct your request to the institution. If you send it to us, we will pass it to the relevant controller where we can identify them, and we will assist them in responding. We cannot decide the request ourselves without the controller’s instruction.

Some rights are restricted in an AML context, and this is not a formality. Confirming or denying whether a person has been screened, alerted on, investigated or reported can amount to tipping-off, can prejudice the prevention or detection of crime, and can conflict with a statutory record-keeping obligation. In those circumstances a controller may lawfully refuse or restrict access, erasure or objection, and may be obliged to. The platform is built so that a controller can apply that restriction and still evidence what was decided and why.

The platform scores customer risk and raises alerts by applying configured rules to transaction and customer data. Two design properties are relevant to your rights.

• It is explainable rather than opaque. Each alert retains the rule, the rule version and the evaluation evidence that produced it, and the decision can be replayed deterministically. There is no model whose reasoning cannot be reconstructed.
• Consequential decisions are not automated end to end. Risk approvals, screening hit clearance, case closure and report submission all require a human decision, and the sensitive ones require a second human through maker-checker. A rule raises an alert; it does not close a relationship or file a report.

Decisions about a banking relationship are taken by the institution, not by Baobyte. Ask them about a specific decision.

This website sets no analytics, advertising or third-party cookies and loads no resource from any external domain. The authenticated workspace sets a small number of strictly necessary cookies for authentication and tenant context. Both are described in the cookie policy.

If you are unhappy with how your personal data has been handled, please raise it with us first so that we can investigate. Where Baobyte is a processor, the complaint will usually need to be resolved with the controller.

You also have the right to complain to the Nigeria Data Protection Commission. Its current contact details and complaint route must be inserted here before this notice is adopted.

General enquiries about this notice can be sent to hello@baobyteconsulting.com or raised through the contact page.

A Data Protection Officer has not been named in this draft. Either an officer must be appointed and their contact details inserted here, or a reasoned record that one is not required must be held.

This notice will be updated as the service, the subprocessor register and the applicable guidance develop. The version and date at the top of the page record the current revision. Material changes will be communicated to customers through the contractual notice route rather than by a silent edit to this page.