Privacy Policy

Version 7.1  ·  Last updated: April 14, 2026  ·  Effective: April 14, 2026

1. Who We Are

QwikPass is a property technology platform operated by Coretrix Technologies Limited ("we", "our", "us") in Nigeria. We provide digital gate-access management, service-charge collection, event access control, and estate administration tools to residential estates, corporate offices, and event organisers.

Data Controller: Coretrix Technologies Limited
Data Protection Officer: privacy@qwikpass.ng
Compliance Portal: qwikpass.ng/compliance

2. Data We Collect

We collect the following categories of personal data:

• Identity data: Full name, profile photo (optional)
• Contact data: Phone number (+234 format), email address
• Property data: Estate name, unit/house number, residential address
• Visitor data: Names and phone numbers of guests you invite
• Financial data: Service charge payment history, transaction references. Payment card details are processed by Paystack and never stored on our servers.
• Utility Identifiers: Meter numbers, Smartcard/Customer numbers, and phone numbers specifically for utility fulfillment via VTPass.
• Device data: Device type, OS version, Firebase Cloud Messaging token (for push notifications)
• Location data: Approximate location, collected only when you trigger an SOS emergency alert and only shared with your estate's security team
• Usage data: App usage patterns, feature interactions (aggregated and anonymised)

3. How We Use Your Data

We use your personal data for the following purposes:

• Authenticating your identity and providing role-based access to the app
• Generating and validating QR gate-access passes
• Processing service charge payments and issuing receipts
• Sending transactional SMS messages (passcodes, payment confirmations)
• Delivering push notifications relevant to your estate
• Responding to SOS emergency alerts
• Maintaining visitor entry logs required by your estate management
• Improving the platform through aggregated, anonymised analytics
• Complying with legal obligations

4. Legal Basis for Processing

• Contract: Processing necessary to provide the service you have agreed to use
• Legitimate interest: Security logging, fraud prevention, platform improvement
• Consent: Marketing communications (you may withdraw at any time)
• Legal obligation: Financial records retention (7 years, FIRS requirement)

5. Data Sharing

We share data only as follows:

• Your estate management company: Access logs, visitor records, and service charge records relevant to your estate. Your estate manager is a co-data-controller for estate-specific data.
• Paystack: Payment processing. Governed by Paystack's Privacy Policy.
• VTPass: Utility fulfillment (Electricity/Cable/Data/Airtime). Only necessary identifiers are shared.
• Termii: SMS delivery for OTP and passcode messages.
• Google Firebase: Cloud infrastructure, authentication, crash reporting. Data is stored in Google's data centers. We have a Data Processing Agreement with Google.
• Law enforcement: When required by Nigerian law or court order.

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

6. Data Retention

• Visitor / entry logs: 12 months from date of entry
• Financial records: 7 years (FIRS compliance)
• SOS / emergency records: Retained indefinitely for safety investigations
• Account data: Retained while your account is active; deleted within 30 days of a verified deletion request

7. Your Rights (NDPR / NDPA 2023 / GDPR)

Under Nigerian data protection law and GDPR, you have the right to:

• Access: Request a copy of the personal data we hold about you
• Correction: Request that inaccurate data be corrected
• Erasure: Request deletion of your data (subject to legal retention requirements)
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interest
• Withdraw consent: For consent-based processing, withdraw at any time

To exercise any right, email privacy@qwikpass.ng. We will respond within 72 hours.

8. Security

• All data in transit is encrypted with TLS 1.3
• Data at rest is encrypted with AES-256
• Payment data is processed in a PCI-DSS compliant environment (Paystack)
• Access to production data is restricted to authorised personnel on a need-to-know basis
• Security incidents are reported to NITDA within 72 hours as required by the NDPA

9. Cookies and Tracking

The QwikPass mobile app does not use browser cookies. The QwikPass web landing page uses only essential first-party session storage. We do not use third-party advertising trackers or cross-site tracking technologies.

10. Children's Privacy

QwikPass is not directed at children under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, contact us at privacy@qwikpass.ng and we will delete it promptly.

11. International Transfers

Your data may be processed on Google Cloud infrastructure located outside Nigeria. Such transfers are governed by Google's Standard Contractual Clauses and our Data Processing Agreement, ensuring an adequate level of protection consistent with NDPR requirements.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via in-app notification at least 14 days before they take effect. The "Last updated" date at the top of this page will always reflect the current version.

13. Contact and Complaints

For privacy questions, data subject rights requests, or to reach our Data Protection Officer:

This policy is available in English. Translated versions may be provided upon request.