Privacy Policy

1. Who controls your information

DSG Security Ltd is the data controller for personal information collected for recruitment, employment administration, security operations, client service, subscriber administration and website communications. Where an authorised client or subscriber determines the purpose of a particular investigation or verification, that party may also have independent data-protection responsibilities.

2. Information we process

Depending on your relationship with DSG, we may process names, contact and residential details, date of birth, gender, state of origin, next-of-kin and guarantor information, employment and deployment records, photographs, supporting documents, attendance, reports, incidents, payment evidence, case references, authority declarations, portal sign-in events and administrative audit logs. For an authorised identity check, the submitted NIN, BVN or telephone number and the response returned by the verification provider may include biodata, a photograph, verification status and a provider reference.

3. Intelligence and verification services

DSG does not maintain Nigeria's national NIN or BVN databases and does not represent itself as NIMC or the Central Bank of Nigeria. Identity-verification requests are transmitted to SwiftVerify through its secured API. Subscribers must provide a documented lawful purpose and applicable authority or consent for every request. GPS tracking is limited to properly enrolled devices or operations supported by appropriate lawful authority; the portal does not locate an arbitrary device merely from its telephone number.

4. Why we use information

• Recruiting, verifying and managing personnel.
• Issuing and verifying staff identification cards.
• Managing security assignments, attendance, reports and incidents.
• Screening subscribers and reviewing subscription-payment evidence.
• Supporting authorised cases, identity checks and enrolled-device tracking.
• Preventing misuse, investigating suspicious activity and maintaining audit records.
• Meeting contractual, legal, regulatory and security obligations.

5. Lawful bases and authority

Processing may be based on a contract, steps requested before a contract, legal obligation, protection of vital interests, legitimate interests that do not override individual rights, valid consent, or another lawful basis available under applicable law. Consent is used only where appropriate and may be withdrawn without affecting earlier lawful processing. A portal declaration does not replace any warrant, mandate, consent or other authority legally required for a particular activity.

6. Service providers and transfers

Information may be processed by vetted providers supporting website hosting, database and file storage, security, Google Workspace email and identity verification, including SwiftVerify for authorised verification requests. Some infrastructure may operate outside Nigeria. DSG will apply appropriate contractual, organisational and legal safeguards for provider access and international transfers. DSG does not sell personal information and does not submit portal records to a generative-AI model for automated decision-making.

7. Security and subscriber separation

DSG applies role-based permissions, private subscriber workspaces, encrypted communications, hashed verification codes, secure session cookies, controlled file access and audit logging. Subscribers may access only records authorised for their own workspace. Access may be restricted or suspended where misuse, credential sharing or unlawful processing is suspected. No electronic system is completely risk-free, and suspected misuse should be reported immediately.

8. Retention

Information is retained only for as long as reasonably necessary for its stated purpose, operational accountability, provider reconciliation, dispute handling and applicable legal or regulatory requirements. Identity results, photographs, payment evidence and case records are governed by DSG's internal retention schedule and are deleted or securely archived when no longer required. Expired authentication codes and sessions are not retained as permanent identity records.

9. Your rights and complaints

Subject to applicable law, you may request information about processing, access to your data, correction, deletion, restriction, objection or portability. You may complain to DSG or the Nigeria Data Protection Commission. Some information may be retained where required by law, an authorised investigation, fraud prevention or a valid legal claim.

10. Cookies and portal sessions

The public pages do not use advertising cookies. DSG's protected portals use strictly necessary secure session cookies to authenticate authorised users, protect workspaces and maintain security logs. Disabling them will prevent portal access.

11. Updates

We may update this notice when our services, providers or legal obligations change. The effective date and version displayed above identify the notice currently in force.

Paddy phone-contact discovery

Contact discovery is optional. When you choose it and grant device permission, Paddy reads up to 500 phone numbers and sends them to the server to match verified Paddy accounts. Address-book names, SMS and messages from other apps are not read. The submitted address-book number list is not saved by the matching service. Matches stay in the current page until you leave it; starting a conversation creates the usual chat record.

You can enter a number manually instead, or revoke Contacts permission in your device settings. To link your own number, Paddy sends an SMS verification code through its SMS provider. Your verified phone number is saved on your Paddy account and lets people who know that number find you, subject to blocking and profile visibility rules. Verification challenges and rate-limit records help prevent misuse. Linking a number does not automatically merge accounts.