1. Who we are

Relynked Ltd (RC 9837720) is the company behind both products this policy covers.

Registered office: 7B Edegbe Street, off Giwa-Amu Street, GRA, Benin City, Edo State, Nigeria.

For the purposes of the Nigeria Data Protection Act 2023 (NDPA), Relynked Ltd is the data controller for the information described below. That means we decide what is collected and why, and we carry the responsibility for protecting it.

2. What we collect

We collect only what each product needs to do its job. Nothing on this list is collected for its own sake, and nothing is collected speculatively in case it proves useful later.

2.1 Account and staff data

2.2 Operations data (Relynked Business)

• Catalogue items, prices, and price history.
• Stock and goods movements: what came in, what went out, when, and between whom.
• Sales and transaction records.
• Reconciliation events the system generates when it compares what was sold against what actually moved.
• Which staff member carried out a given action, so a business can read its own history clearly and attribute each handover to a named person.

2.3 Messaging data (Remy)

• The phone number, in international format, of anyone who messages a business's WhatsApp number, or whom the business has messaged with that person's consent.
• The content of those conversations: text, and any image, document or voice note sent as part of them.
• Delivery status, read status and timestamps.
• Whether a message was answered by Remy or handed to a member of staff.

2.4 Assistant instructions (Ask Remy)

• The instruction a business owner types, for example a request to adjust a set of prices.
• The specific figures needed to carry that instruction out, such as the current price being changed and the resulting new figure.
• A short record of what was done in response, so every change is traceable to the instruction that caused it.

2.5 Technical data

• Device and browser type, IP address, and basic usage and error logs.

Kept to secure accounts, diagnose faults and keep the service reliable. We do not use this to track anyone across other websites or applications, and we do not operate advertising or cross-site tracking technology.

3. Why we are allowed to use it

Under the NDPA, every use of personal data needs a lawful basis. Ours are:

Where we rely on consent, it can be withdrawn at any time, and withdrawing it will not affect anything lawfully done before.

4. How we use it

• To run the dashboard a business and its staff sign into day to day.
• To power the measurement engine, which compares recorded sales against recorded movement and surfaces the gaps worth an owner's attention.
• To let Remy hold a conversation with a business's own customers and answer on that business's behalf.
• To let Ask Remy carry out a specific instruction from an authorised person, subject to the same permission checks that person would face typing the change in by hand.
• To secure accounts, detect misuse and meet our legal obligations.

We do not build advertising profiles, on a business or on its customers. We do not sell data to anyone. We do not make decisions that produce legal or similarly significant effects about an individual by automated means alone.

5. Who we share it with

We use a small number of specialist service providers to deliver the product. Each receives only the data it needs for its specific part, under a written agreement, and none may use it for their own purposes.

On every one of these: they are contractually bound to use the data solely to provide their service to us, they may not use it for advertising, and they may not use it to train general-purpose models.

We will name any individual provider on request. Write to us using the details in section 15.

We also disclose data where we are legally required to, for example in response to a valid order from a Nigerian court or regulator. We do not disclose data for any purpose unrelated to running the service.

6. Where your data is held

Your business records are stored in Nigeria. Catalogue, stock, transaction, reconciliation and staff account data is held on infrastructure located in country.

Some limited processing happens outside Nigeria. This is unavoidable for two features and we would rather state it plainly than imply otherwise:

• WhatsApp messaging. The messaging platform that carries WhatsApp traffic operates internationally. Message content and phone numbers necessarily pass through its infrastructure outside Nigeria in order to be delivered at all.
• The Ask Remy assistant. The instruction text and the specific figures needed to answer it are processed by an AI service provider whose infrastructure is outside Nigeria. Nothing beyond that instruction and those figures leaves the country for this purpose.

Where data is transferred outside Nigeria, we do so under the transfer conditions permitted by section 41 of the NDPA, on the basis of written contractual commitments requiring the recipient to protect the data to a standard comparable to that required in Nigeria, and limited to what the feature genuinely requires.

7. WhatsApp, specifically

Messages sent and received through Remy travel over the WhatsApp Business Platform, including its encryption in transit.

• Message content is used to respond within that conversation, to keep a record of the business's own customer communications, and to improve the accuracy of Remy's replies for that business.
• It is never used for advertising and never sold.
• A business only messages a customer where that customer has messaged first, or has otherwise consented to be contacted, in line with WhatsApp's Business Messaging Policy.
• This is a separate, business-owned channel. It does not touch, read or connect to any staff member's personal WhatsApp account.

8. Artificial intelligence, specifically

Remy and the Ask Remy assistant use AI to understand a message and compose a reply. We think you should know exactly what that means in practice.

What is sent. Only what is needed to answer the immediate request: the message or instruction itself, and the specific catalogue or business figures it refers to. A business's database is not uploaded, mirrored or made available to any AI provider.

What is not done with it. The data sent is excluded, by contract, from being used to train the provider's general-purpose models. It is used to produce a response and nothing further.

A person stays responsible. Where the assistant carries out an instruction that changes a business's records, such as a price adjustment, it is subject to the same authorisation the person would face making that change by hand, and the action is recorded against that person. The assistant does not act on its own initiative, and it does not make decisions about individuals.

Accuracy. AI-generated replies can be wrong. A business remains responsible for what is said to its customers on its own channel, and we recommend reviewing how Remy is configured before letting it answer unsupervised.

9. Security

• Separation by design. Every business's data is scoped to that business alone. One business cannot see another's catalogue, transactions or conversations. This is enforced in the architecture, not merely by policy.
• Encryption. Data is encrypted in transit over HTTPS and encrypted at rest.
• Access control. Access inside Relynked follows the role a person already holds in the product. A staff account sees what that role requires, an owner account sees the whole business, and an engineer resolving a specific support issue sees only what that issue requires. Access is logged.
• Credentials. Passwords are hashed using a modern algorithm designed for the purpose. They cannot be recovered, only reset.
• Devices. Where we supply hardware, it is configured to run only Relynked, so business data cannot be removed through a browser or a third-party application on that device.

No system is perfectly secure, and we will not claim otherwise. What we commit to is that the measures above are real, maintained, and reviewed.

10. How long we keep it

A business may request earlier deletion at any time, subject to any record we are legally required to retain. We will tell you which records those are and why.

11. Your rights under the NDPA

Under the Nigeria Data Protection Act 2023, anyone whose personal data we hold may:

• Access a copy of the data we hold about them.
• Correct it where it is inaccurate or out of date.
• Delete it, subject to any legal reason we must retain part of it.
• Restrict or object to a specific use of it.
• Port it, receiving a copy in a commonly used, machine readable format.
• Withdraw consent at any time, where consent is the basis we rely on.

To exercise any of these, contact us using the details in section 15 and tell us which right you are exercising, so we can act on it directly rather than asking you to clarify.

We will respond within 30 days. If a request is complex and we need longer, we will tell you why before that period expires.

We do not charge for this, unless a request is manifestly excessive or repetitive, in which case we will tell you the cost before doing any work.

You may also complain directly to the Nigeria Data Protection Commission (NDPC) at any time, whether or not you have raised the matter with us first.

12. If something goes wrong

If a breach occurs that is likely to result in a risk to the rights and freedoms of the people affected, we will:

1. Notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, as the NDPA requires.
2. Notify the affected businesses and individuals without undue delay, where the risk to them is high.
3. Tell you what happened, what data was involved, what we have done about it, and what you should do.

We will not minimise, delay, or wait to be asked.

13. Children

Relynked Business and Remy are built for business owners and their staff. We do not knowingly collect data from anyone under 18 in a personal capacity, and our products are not directed at children.

A business's own customers may be of any age where that business legitimately serves the public. We do not knowingly collect data about a child through Remy beyond what that business's own customer messaging naturally involves. If you believe a child's data has been collected in a way it should not have been, contact us and we will delete it.

14. Changes to this policy

If this policy changes in a way that meaningfully affects how data is used, the update will appear on this page with a new effective date at the top, and we will make a reasonable effort to notify account owners directly.

Minor clarifications that do not change how data is used may be made without direct notice, but the effective date will always reflect the most recent version.

15. Contact us

For any question about this policy, to exercise a right, or to report a concern:

Relynked Ltd
7B Edegbe Street, off Giwa-Amu Street
GRA, Benin City, Edo State, Nigeria

Data protection enquiries: privacy@relynked.com
General enquiries: hello@relynked.com
Phone: 0916 221 6711

Regulator
Nigeria Data Protection Commission
ndpc.gov.ng

Relynked Ltd is registered in Nigeria, company number RC 9837720.