1. Roles
For each verification request, the requesting organisation is the controller and PassPorta acts as its processor, except for records we keep to meet our own legal and audit obligations.
2. Instructions
We process personal data only on the documented instructions of the client and for verification purposes.
3. Confidentiality and security
- Staff with access are bound by confidentiality obligations.
- Data is encrypted in transit and at rest, with role-based access and audit logging.
- We notify clients of a personal data breach without undue delay.
4. Sub-processors
We use vetted sub-processors for hosting, email and identity services. Clients are notified in advance of changes and may object.
5. International transfers
Transfers are made under safeguards recognised by the Nigeria Data Protection Act 2023, UK GDPR and EU GDPR, such as standard contractual clauses and adequacy decisions.
6. Assistance, deletion and audit
We help clients respond to data subject requests, delete or return data at the end of the agreed retention period, and make information available to demonstrate compliance.