Trecco Privacy Policy & Data Protection Charter

1. Statutory Scope & Lawful Bases for Processing (NDPA Section 25)

In accordance with Section 25 of the NDPA 2023, we collect and process your personal data exclusively under one or more of the following legally validated bases:

• Contractual Performance: Processing required to initiate, administer, and maintain your user account, execute wallet transfers, settle marketplace produce sales, and disburse cooperative loans.
• Compliance with Statutory & Regulatory Mandates: Strict fulfillment of legal duties imposed on financial technology platforms by the Central Bank of Nigeria (CBN), the Economic and Financial Crimes Commission (EFCC), and the Nigerian Financial Intelligence Unit (NFIU) under the Money Laundering (Prevention and Prohibition) Act 2022, the Banks and Other Financial Institutions Act 2020 (BOFIA), and the Terrorism (Prevention and Prohibition) Act 2022.
• Explicit Consent: Where you have granted affirmative, informed, and freely given consent for specific features (such as biometric authentication, optional geospatial farm mapping, and opt-in crop market alerts).
• Legitimate Interests: Safeguarding account integrity, enforcing our single-active-device security architecture, preventing financial fraud, detecting account takeover attempts, and defending legal claims.

2. Exhaustive Categories of Personal Data Collected

A. Biographical & Tiered Know-Your-Customer (KYC) Data

In full alignment with CBN Tier 1 to Tier 3 Customer Due Diligence regulations:

• Full legal name, phone number, physical residential/farm address, and email address;
• Date of birth, nationality, gender, and government-issued identity documents (Voters Card, Driver's License, International Passport);
• Bank Verification Number (BVN) & National Identification Number (NIN): Collected solely to verify identity via licensed verification gateways (NIBSS and NIMC). Raw BVNs are never stored in plaintext—they are encrypted using enterprise AES-256 encryption or held as masked tokens.
• Facial photographs for avatar representation and automated liveness verification.

B. Banking, Financial Ledgers & Cooperative Records

• Virtual wallet account numbers issued through partner banks (Providus Bank PLC and VFD Microfinance Bank);
• Complete, unalterable transaction ledgers (inflows, outflows, interbank transfers, bill payments, and timestamps);
• Cooperative thrift contributions, Ajo/Esusu cycles, share capital accounts, and internal voting records;
• Loan requests, peer guarantor endorsements, repayment schedules, and credit scoring metadata;
• Marketplace listings, commodity trade contracts, escrow receipts, and inspection sign-offs.

C. Device Telemetry & Security Metadata

• Hardware & Device Identifiers: Unique cryptographically derived device fingerprints used to bind your login to your specific authorized phone, enforcing our strict single-active-device policy;
• Internet Protocol (IP) addresses, network carrier metadata, and access logs;
• Push notification device tokens (Firebase Cloud Messaging / Apple APNs) for real-time transaction alerts.

3. Third-Party Disclosures & Regulated Partner Architecture

We do not sell, rent, monetize, or commercialize your personal information. We disclose data strictly on a confidential, need-to-know basis to licensed and contractual entities:

• Licensed Banking Partners (CBN Regulated): Providus Bank PLC and VFD Microfinance Bank Limited for the generation of dedicated virtual account numbers, payment settlement, and interbank NIP clearing.
• Payment Switches & Card Processors: Licensed payment gateways (including Xpress Wallet and Interswitch/NIBSS) to process card transactions and settlement debits.
• Telecommunications & Utility Aggregators: ConnectHub / Clubkonnect for automated utility bill settlement, data recharges, and meter validation.
• SMS & 2FA Gateways: Termii and telecommunication aggregators for automated one-time passwords (OTPs) and transaction alerts.
• Cloud Infrastructure: Amazon Web Services (AWS) under enterprise data protection agreements incorporating end-to-end encryption in transit (TLS 1.3) and at rest (AES-256).
• Law Enforcement & Regulatory Authorities: Central Bank of Nigeria (CBN), Nigerian Financial Intelligence Unit (NFIU), EFCC, or competent courts of law pursuant to lawful process or statutory reporting obligations.

4. Technical Safeguards & Anti-Capture Privacy Shield

To maintain bank-grade confidentiality, Trecco implements advanced defensive engineering:

• Anti-Screenshot & Capture Shield: The platform incorporates active operating-system obfuscation preventing unauthorized background caching, screen captures, and third-party recording of wallet balances and banking records.
• Coercion / Panic Password: To protect users under physical threat or armed duress, Trecco provides a Panic Password feature displaying decoy zero balances while securely logging the event for audit.
• Single-Active-Device Enforcement: Sessions are bound to a single device token; simultaneous logins on separate devices are blocked and require multi-factor 2FA OTP re-verification.
• Cryptographic Hashing: All account passwords and Transaction PINs are hashed using salted bcrypt algorithms with high work factors. Trecco personnel cannot view your plaintext password or PIN.

5. Data Retention Schedules & Mandatory Financial Law Carve-Outs

Fintechs and banks frequently encounter situations where individuals seek immediate deletion of their entire profile to avoid debt recovery or regulatory scrutiny. In strict adherence to Section 34 of the NDPA 2023, data retention is balanced against mandatory financial statutes:

6. Your Enforceable Data Subject Rights under NDPA 2023

As a data subject under the Nigeria Data Protection Act 2023, you hold the following statutory rights:

• Right to be Informed: You have the right to transparent, accessible information regarding how your data is processed (as set forth in this Policy).
• Right of Access: You may request confirmation of whether we hold your personal data and request a structured, machine-readable export of such records.
• Right to Rectification: You may request the immediate correction of inaccurate, outdated, or incomplete personal records via your Account Settings.
• Right to Erasure ("Right to be Forgotten" / Account Deletion): You may request the permanent deactivation of your account and erasure of non-statutory personal identifiers. Full procedures are detailed on our dedicated Account Deletion & Data Erasure Portal.
• Right to Restrict Processing: You may restrict the processing of your personal data where you contest its accuracy or lawful basis, pending formal verification.
• Right to Data Portability: You may receive your personal records and transaction history in a standard machine-readable format to transmit to another service provider.
• Right to Object: You may object at any time to the processing of your personal data for direct marketing, behavioral analytics, or commercial communications.

7. How to Initiate Account Deletion

Trecco provides three (3) distinct, verified avenues for account and data deletion:

1. In the Mobile Application (Immediate Self-Service): Open Trecco → Settings → Danger Zone → Delete Account → Enter your account password and type DELETE to confirm.
2. On the Web Portal (Authenticated Self-Service): Log in to Trecco → Settings → Account Actions → Deactivate / Close Account.
3. Public Web / Email Request (Users Without App Access): If you have uninstalled the app or lost access to your device, visit our public Account Deletion Guide or email our Data Protection Team at privacy@tremmaagrohub.com.ng with your registered name and phone number. Verified manual requests are finalized within 48 to 72 business hours.

Prerequisites: In compliance with financial risk guidelines, your wallet balance must be zero (funds withdrawn) and all active loans or open marketplace trades must be settled before deletion can proceed.

8. Children's Privacy (Strictly 18+)

Trecco is strictly intended for adult agricultural producers, cooperative officers, and corporate off-takers. We do not knowingly collect, solicit, or maintain personal records of persons under the age of eighteen (18). Accounts discovered to be registered by minors will be suspended and deleted immediately.

9. Data Protection Officer (DPO) & Inquiries

For inquiries, rights enforcement, or privacy grievances, contact our Data Protection Officer: