Privacy Notice

Vordia is a service of Vorbtech Innovative Solutions Ltd (“VIS”, “we”, “us”), a company registered in Nigeria. VIS is the data controller for the personal data described in this notice, except where we say otherwise.

This notice explains what we collect, why, the legal basis we rely on, who receives it, how long we keep it and how to exercise your rights. We wrote it to meet the transparency requirements of section 27 of the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Commission’s General Application and Implementation Directive 2025 (GAID).

Vordia is a business service. Our customers are organisations, and the people who use Vordia do so for work. This notice covers:

• visitors to the Vordia website;
• people who create a Vordia account, including sponsors and organisation administrators who set up and pay for an assessment;
• contributors invited to answer a focused part of an assessment;
• people who contact us about payments, support or further work.

Account details

Your email address and password. Passwords are stored by our identity provider in hashed form; we cannot read them. We also record email verification and sign-in events.

Organisation and role

Your organisation’s name, the department or team in scope, your role, and the authority you describe for the assessment.

Assessment content

Your question, scope, answers, corrections and the things you mark as unknown, together with answers from invited contributors. When you invite a contributor, we collect their email address and the task you ask them to cover.

Answering-time estimates

Approximate time spent answering, reading, waiting and idle, so we can keep the assessment proportionate. We do not record keystrokes.

Reports and review

Initial findings, consultant-reviewed reports and PDFs, consultant notes, change summaries, and your correction and follow-up requests.

Purchases and payments

Quotes, prices, VAT, payment references and status, receipts and refunds. Paystack collects your card or bank details on its own secure payment page; we do not receive your full card number.

Messages and requests

Payment help and support requests, enquiries about further work (such as your objective, location and availability), and delivery events for the emails we send you, such as delivered or bounced.

Security and technical records

Records of important actions in your account, and the security logs kept by our hosting and identity systems, which can include IP address, browser type and time of access.

Please do not include sensitive personal data, such as health, religious, political or financial account information, or personal records about customers or colleagues in your answers. Vordia does not need it to assess your question.

We only process personal data where section 25(1) of the NDPA gives us a lawful basis. For each purpose, the basis we rely on is:

Creating and securing your account

Performance of a contract with you, or steps you ask us to take before entering one (NDPA s.25(1)(b)(i)).

Delivering the assessment, initial findings, consultant review, reports and follow-up

Performance of our contract (s.25(1)(b)(i)). For invited contributors, our legitimate interest and the customer organisation’s legitimate interest in completing the assessment it requested (s.25(1)(b)(v)). Contributors can decline an invitation.

Taking payment, issuing receipts, handling refunds and keeping tax records

Performance of our contract (s.25(1)(b)(i)) and compliance with legal obligations, including VAT and tax record-keeping (s.25(1)(b)(ii)).

Sending service emails

Performance of our contract (s.25(1)(b)(i)). These include verification, invitation, payment and report messages.

Keeping Vordia secure and preventing misuse or fraud

Our legitimate interests (s.25(1)(b)(v)) and legal obligations (s.25(1)(b)(ii)).

Managing service quality, capacity and costs

Our legitimate interests (s.25(1)(b)(v)). Internal cost and capacity reporting does not include your answers or reports.

Establishing or defending legal claims

Our legitimate interests (s.25(1)(b)(v)).

We will only send you marketing messages if you have opted in, and you can withdraw that consent at any time as easily as you gave it. We do not sell personal data, and we do not use your assessment content to train AI models.

Vordia uses an AI model, GPT-6 Luna provided by OpenAI, to guide the assessment conversation, extract key facts, check coverage and prepare initial findings. We send requests with storage disabled. OpenAI states that data sent through its API is not used to train its models unless the customer opts in, which we have not done, and that it may keep abuse-monitoring logs for up to 30 days.

Initial findings are clearly labelled as the result of automated checks. A consultant reviews the assessment before we publish the final report. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (NDPA s.37). You can always ask a person to review a result, give your point of view and challenge a finding.

People in your organisation see assessment information according to their role. A sponsor and organisation administrators can see the assessment and its reports; a contributor sees the task they were invited to answer. Consultants assigned to your assessment see what they need to review it.

We use the following service providers, who process personal data for us under their data processing terms:

Paystack

Payment processing, verification and refunds.

OpenAI

AI model processing for the assessment and initial findings.

Resend

Sending service emails and reporting their delivery.

Hosting

Servers operated by VIS and rented from Contabo GmbH in Germany, which run the Vordia application, its database, account sign-in and private file storage.

We may also disclose information to professional advisers under a duty of confidentiality, or where the law, a court or a regulator requires it.

Your account, assessment and report data are stored on our servers in Germany, in the European Union. Some of our providers also process data outside Nigeria. For example, OpenAI and Resend process data mainly in the United States, and Paystack may use facilities or sub-processors in other countries.

We transfer personal data out of Nigeria only on a basis permitted by sections 41 to 43 of the NDPA and Part VIII of the GAID. We rely on our providers’ data processing terms, including contractual clauses that protect the data, and, where those do not apply, on the transfer being necessary to perform our contract with you or your organisation (s.43(1)(b)). We record the basis for each transfer.

Assessments and reports

12 months after we deliver the consultant-reviewed report, so you can return to it and use the follow-up window.

Raw answers and supporting evidence

90 days after final delivery. The report keeps the evidence references it needs.

Purchase, payment, VAT and accounting records

As long as Nigerian tax law requires, currently at least six years after the year of assessment the records relate to (Nigeria Tax Administration Act 2025, s.31).

Account details

While your account is open. When you ask us to close it, we delete or anonymise account details we no longer need, subject to the records above.

Security and audit records

As long as the records they protect, or longer if needed for a security investigation or legal claim.

We handle deletion through an audited request process, so we can confirm what was deleted and when. Deleted data can remain in secure backups for a short period until those backups are overwritten. We keep information longer only where the law requires it or it is needed for an ongoing dispute or legal claim.

We use measures appropriate to the risk, as section 39 of the NDPA requires. These include encrypted connections, separation of each organisation’s data, role-based access, private report storage that is only reachable through your signed-in account, server-side payment verification and audit records of sensitive actions. Staff and consultants only access what their role needs. No system is completely secure, so please keep your password private and tell us straight away if you suspect misuse.

If a personal data breach is likely to put people’s rights and freedoms at risk, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it (NDPA s.40(2)). If the risk to you is high, we will tell you immediately in plain language, explain what happened, and advise you on steps you can take to protect yourself (s.40(3)).

Under Part VI of the NDPA you have the right to:

• be told whether we process your personal data and receive a copy of it (s.34(1)(a)–(b));
• have inaccurate, out-of-date, incomplete or misleading data corrected (s.34(1)(c));
• have your data erased when we no longer need it or have no lawful basis to keep it (s.34(1)(d) and s.34(2));
• restrict processing while a request or objection is resolved (s.34(1)(e));
• receive your data in a structured, commonly used, machine-readable format and have it sent to another controller (s.38);
• object to processing based on legitimate interests, and to direct marketing at any time (s.36);
• withdraw consent at any time where we rely on consent, without affecting earlier processing (s.35);
• not be subject to a decision based solely on automated processing with legal or similarly significant effects, and to obtain human review (s.37).

To use a right, email admin@vorbtech.com.ng or write to Vorbtech Innovative Solutions Ltd, Festrut Estate Opp. Aso Radio Katampe, Abuja, Nigeria. Please write from the email address on your Vordia account where you can, so we can verify your identity. We respond without undue delay and within 30 days. If we need longer or cannot fully meet a request, for example because the law requires us to keep tax records, we will explain why. Requests are free unless they are clearly excessive.

Assessment content is shared with the customer organisation that requested the assessment. If your request affects information your organisation relies on, we may need to consult its sponsor before acting, but we will still respect your rights.

Please contact us first so we can try to put things right. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPA s.46) at ndpc.gov.ng.

Vordia uses only what it needs to work. Strictly necessary cookies keep you securely signed in and protect account recovery. Your browser stores your colour theme choice on your device. We do not use advertising or analytics cookies. If that changes, we will ask for your consent before setting them, as the GAID requires.

Vordia is for organisations and their staff. It is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

We will update this notice when our processing changes. Each version has its own version identifier and effective date, shown at the top of this page. If we make a material change, we will tell account holders by email or in Vordia before it takes effect.

For privacy questions or requests, contact us using the details below.