1. Purpose

This Policy ensures that WakaMi retains personal data in a lawful, fair, and transparent manner as required under Section 24 of the NDPA 2023, which establishes the storage limitation principle. Data must not be kept in a form that identifies individuals for longer than is necessary for the purpose for which it was collected.

2. Scope

This Policy applies to all personal data collected and processed by WakaMi through the Platform, including data relating to:

• Users who request Tasks
• Task Runners who perform Tasks
• Visitors and newsletter subscribers
• WakaMi employees and contractors (covered separately in our HR policy)

3. Legal Framework

Our retention practices are governed by the following legal instruments:

• Nigeria Data Protection Act 2023 (NDPA) — storage limitation and data minimisation principles (ss. 24–26)
• CBN AML/CFT Regulations 2022 — minimum 5-year retention of KYC and transaction records
• Companies Income Tax Act (CITA) / FIRS Guidelines — 6-year retention of financial and accounting records
• Evidence Act 2011 — preservation of records that may be relevant to legal proceedings

4. Retention Schedule

The table below sets out the categories of personal data we hold, how long we retain them, and the legal basis for doing so.

5. Extended Retention — Legal Holds

We may retain personal data beyond the standard retention periods above where:

• there is an ongoing dispute, complaint, or legal proceeding involving the data
• we are required to do so by a court order, regulatory directive, or law enforcement request
• the data is required for an active audit or investigation by the Nigeria Data Protection Commission (NDPC) or any other competent authority

In such cases, the data will be flagged as subject to a legal hold and will not be deleted until the hold is lifted.

6. Data Deletion and Anonymisation

When personal data reaches the end of its retention period, WakaMi will, as appropriate:

• Securely delete — data is permanently erased from all active systems and backups within 90 days of the retention period expiring
• Anonymise — where deletion is not technically feasible, data is irreversibly anonymised so it can no longer identify an individual, and retained for aggregate analytics

Deletion and anonymisation processes are logged and auditable in accordance with NDPA requirements.

7. Your Rights

Under the NDPA 2023, you have the right to:

• request access to personal data we hold about you
• request deletion of your data where it is no longer necessary for the purpose it was collected
• object to the continued processing or retention of your data
• withdraw consent at any time (where consent is the basis for processing)

Note that some data cannot be deleted before its legal retention period expires, for example KYC records required under CBN regulations. We will inform you of any such limitation when you make a request.

8. Data Security During Retention

All personal data retained by WakaMi is stored securely using appropriate administrative, technical, and organisational safeguards. Access is restricted to authorised personnel only, and all storage systems are protected in accordance with our Information Security Policy.

9. Review of this Policy

This Policy is reviewed at least annually, or sooner if there are material changes to applicable law or our data processing activities. Any significant updates will be communicated through the Platform.

10. Contact

For questions, data deletion requests, or complaints about how we retain your personal data, please contact us:

Email: privacy@wakamiapp.com

You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.