Privacy Policy — SortAm

1. Data Controller & Contact

Company	MediSeen Health Systems Limited (trading as SortAm)
RC Number	9352905
TIN	2620199413538
Data Protection Officer	Kalu Ifeanyi Mba
Email	[email protected] 3, Inyima Lane, Ebem, Abia State, Nigeria
Phone	+234 816 516 0797

2. Scope

This Privacy Policy explains how we collect, process, store, and protect personal data through the SortAm platform at sortam.com ("the Platform"). It applies to all users including homeowners/customers, artisans/service providers, and administrators.

3. Personal Data We Collect

3.1 Customer Data

Category	Examples	Lawful Basis
Identity Data	Full name, email address, phone number, profile photo	Performance of contract
Location Data	Service address, GPS coordinates (for matching nearby artisans)	Performance of contract; Consent
Booking Data	Service requests, booking history, reviews, ratings	Performance of contract
Payment Data	Transaction history, payment method references (we do not store full card details)	Performance of contract

3.2 Artisan / Service Provider Data

Category	Examples	Lawful Basis
Identity & KYC Data	Full name, National Identification Number (NIN), photograph, date of birth	Legal obligation (KYC/AML); Performance of contract
Financial Data	Bank account details, BVN, payout history	Performance of contract; Legal obligation
Professional Data	Skills, certifications, work portfolio, service area	Performance of contract
Location Data	Real-time location during active jobs (with consent)	Consent; Legitimate interest (safety)
Performance Data	Ratings, reviews, response times, job completion rates	Legitimate interest

3.3 Technical Data

Browser type, device information, IP address, cookies, and usage analytics collected automatically.

4. How We Use Your Data

• Matching customers with qualified artisans based on service type and location
• Facilitating bookings, communications, and escrow payments
• Verifying artisan identity and qualifications (KYC)
• Processing payments and managing payouts
• Ensuring platform safety, preventing fraud
• Resolving disputes between customers and artisans
• Improving services through anonymised analytics
• Sending service-related notifications and updates

5. Third-Party Processors & Cross-Border Transfers

Processor	Purpose	Location
DigitalOcean, LLC	Cloud hosting & infrastructure	London, United Kingdom
Paystack Payments Limited	Escrow payment processing	Nigeria / International

Cross-border transfer: Data is stored on DigitalOcean servers in the UK. We ensure adequate protection pursuant to Section 43 of the NDP Act 2023, through contractual safeguards (Data Processing Agreements), the UK's adequate data protection framework, and encryption in transit and at rest.

6. Data Retention

Data Type	Retention Period	Basis
User account data	Duration of account + 2 years	Contract; Legitimate interest
Artisan KYC data	Duration of account + 5 years	AML/KYC regulations
Transaction & financial records	7 years	Tax & financial regulations (FIRS)
Booking & review data	Duration of account + 2 years	Legitimate interest; Dispute resolution
Technical logs	12 months	Security & operational necessity

After the retention period, data is securely deleted or irreversibly anonymised.

7. Your Rights as a Data Subject

Under the NDP Act 2023 and GDPR (where applicable), you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion (subject to legal retention obligations)
• Restriction — limit how we process your data
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interest
• Withdraw consent — at any time (e.g., location tracking), without affecting prior lawful processing

To exercise any right, contact our DPO at [email protected]
3, Inyima Lane, Ebem, Abia State, Nigeria. We will respond within 30 days.

8. Security Measures

• TLS/SSL encryption for all data in transit
• AES-256 encryption for data at rest
• Secure storage of KYC documents with restricted access
• Role-based access controls with audit logging
• Regular security assessments and penetration testing
• PCI DSS-compliant payment processing via Paystack
• Staff training on data protection obligations

9. Cookies

Type	Purpose	Duration
Essential	Authentication, session management, security	Session / 24 hours
Functional	User preferences, language, location settings	Up to 12 months
Analytics	Anonymised usage statistics	Up to 12 months

We do not use advertising or third-party tracking cookies. Manage preferences via your browser settings.

10. Data Breach Notification

In the event of a personal data breach posing risk to your rights:

• We will notify the NDPC within 72 hours;
• We will inform affected users without undue delay where there is high risk;
• We will document the breach and remedial actions.

11. Complaints

1. Contact us first: Email [email protected]
   3, Inyima Lane, Ebem, Abia State, Nigeria or call +234 816 516 0797.
2. Nigeria Data Protection Commission:
   Website: https://ndpc.gov.ng · Email: [email protected]
3. EU/UK residents: You may also contact your local supervisory authority.

12. Changes to This Policy

We may update this policy periodically. Material changes will be communicated via the Platform and/or email. The "Effective" date at the top indicates the latest revision.

13. Governing Law

This Privacy Policy is governed by the laws of the Federal Republic of Nigeria, including the Nigeria Data Protection Act 2023 and the NDPA 2019 Implementation Framework. For international users, the EU GDPR and UK GDPR apply where relevant.