Privacy Policy

This Policy applies to all individuals whose personal data we process in connection with Staxis , including:

• Clients — organisations and businesses that subscribe to the Service.
• Authorised Users — employees, agents, or contractors of a Client who access Staxis on the Client's behalf.
• Visitors — individuals who visit our website (staxis.zionstand.com) without subscribing.

By using the Service or our website, you acknowledge that you have read and understood this Policy.

Data Controller:

Zionstand Digital Technologies Limited
RC Number: 7676055
Nigeria

For all data-protection enquiries, contact our Data Protection Officer (DPO) at: staxis@zionstand.com

Where we act as a Processor, a separate DPA governs our obligations and is incorporated into the Staxis subscription agreement.

We do not intentionally collect special categories of personal data (e.g. health, biometric, political, or religious data). If you inadvertently submit such data, please notify us immediately.

As part of delivering Staxis managed services (e.g. website maintenance, IT support, data intelligence), our technical staff may access systems, databases, or files that contain personal data belonging to a Client's own end-users ("Client System Data").

• We access Client System Data only to the extent necessary to provide the contracted service.
• We act solely as a Data Processor; the Client remains the Data Controller.
• We do not use Client System Data for our own purposes, share it with third parties (except sub-processors listed in Section 8), or retain it beyond the service engagement.
• All access is logged and subject to our security controls (Section 9).

We will not use your personal data in a manner that is incompatible with the purposes set out above.

Under the NDPA, we rely on the following legal bases:

• Contract: Processing is necessary to perform the Staxis subscription agreement.
• Legal Obligation: Processing is required to comply with Nigerian law (e.g. FIRS tax records, CAMA obligations).
• Legitimate Interests: We process data for fraud prevention, platform security, and service improvement, provided our interests are not overridden by your rights.
• Consent: Where we rely on consent (e.g. optional marketing emails), you may withdraw it at any time without affecting the lawfulness of prior processing.

We share personal data only where necessary. Current sub-processors and recipients:

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256 where applicable)
• HTTP-only, secure JWT cookies with short expiry (access tokens: 15 minutes)
• Bcrypt hashing for all stored passwords (no plaintext passwords stored)
• Role-based access control (RBAC) limiting staff access
• Regular dependency and vulnerability scanning
• All third-party sub-processors vetted for their own security certifications

Despite these measures, no internet transmission is 100% secure. If you suspect a data breach, contact us immediately at staxis@zionstand.com.

Where we are required by law to retain data beyond these periods, we will do so and inform you accordingly.

Some of our sub-processors (e.g. Neon, AWS, Mailjet, Jotform) are located outside Nigeria. Where personal data is transferred internationally, we ensure adequate protection through:

• Standard Contractual Clauses (SCCs) or equivalent contractual safeguards
• Transfers only to jurisdictions recognised as adequate by the Nigerian Data Protection Commission ("NDPC"), or
• Explicit consent where the above mechanisms are unavailable

Details of the safeguards applied to each transfer are available on request.

Under the NDPA, you have the following rights regarding your personal data:

To exercise any of these rights, email staxis@zionstand.com with the subject line "Data Subject Request". We will respond within 30 days. We may ask you to verify your identity before processing the request.

If you are an individual whose personal data has been processed by ZDT on behalf of a Client (i.e. you are a customer or employee of one of our subscribers), please contact that Client directly as they are the Data Controller for your data.

We will cooperate with Clients to fulfil data subject requests under the terms of our DPA.

Strictly necessary cookies are set without consent as they are essential to the Service. You can manage optional cookies through your browser settings; however, disabling certain cookies may affect platform functionality.

We may update this Policy periodically to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:

• Update the "Last Reviewed" date at the top of this page
• Notify subscribed users via email at least 14 days before changes take effect (for material changes)
• Display a notice on the Staxis dashboard

Continued use of the Service after the effective date constitutes acceptance of the updated Policy.

For all privacy-related queries, requests, or complaints, please contact:

If you are unsatisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpb.gov.ng.