Privacy Policy

Effective date: 22 October 2026 · Version 1.0 · Issued by Bevars Technologies Limited (RC 9456753)

1. Who we are

"Bevars", "we", "us" and "our" means Bevars Technologies Limited, a technology company incorporated in Nigeria and headquartered at:

For all matters relating to personal data and data protection - including requests to exercise your rights under the Nigeria Data Protection Act (NDPA) 2023 - you can reach our data protection contact at adams@bevars.com.

2. Our products and branches

Bevars Technologies Limited operates through the following products, which together make up all of our brands, branches and trading names:

• Verifow (verifow.com) - AML compliance, transaction monitoring, KYC/KYB and sanctions screening platform;
• Finhaq (finhaq.com) - financial crime intelligence, customer screening, transaction risk scoring and funds-tracing platform;
• TrustLayerTrade (trustlayertrade.com) - exporter cluster and trade coordination platform;
• IntelFlow (intelfow.com) - threat intelligence and vulnerability assessment platform.

This policy applies to the collection and processing of personal data across all of the above, this website, our APIs, mobile applications, and any other service operated by Bevars Technologies Limited. There are no other brands, branches or trading names through which the company processes personal data.

Where a product offers its own more specific privacy information, that information supplements - and is read together with - this policy. In all cases, Bevars Technologies Limited remains the data controller of record.

3. One company, one data controller - what this means for you

All four products are owned and operated by a single legal entity. In practice this means:

• One accountable controller. Bevars Technologies Limited is the data controller for every Bevars product. You do not need to work out which of our companies is responsible - there is only one.
• One compliance framework. Our data protection obligations under the NDPA 2023 are governed centrally at company level and cover all products, platforms and domains we operate.
• One place to exercise your rights. A request made to Bevars Technologies Limited applies to your personal data across all our products.
• Consistent standards. The same security, retention and vendor-management standards apply whether your data is processed on Verifow, Finhaq, TrustLayerTrade or IntelFlow.

4. Personal data we collect

The data we collect depends on the product and how you interact with it. Broadly:

• Identity and verification data - name, date of birth, nationality, identification numbers (e.g. NIN, BVN, passport), photographs, and business registration details collected for KYC/KYB purposes on Verifow and Finhaq.
• Transaction and financial crime data - transaction records, risk scores, screening results (sanctions, PEP, adverse media), alerts, and funds-tracing evidence processed on Verifow and Finhaq.
• Trade and business data - exporter profiles, product categories, transaction counterparties and deal documentation on TrustLayerTrade.
• Security and technical data - IP addresses, device and browser information, log data, and monitoring telemetry processed on IntelFlow and across our platforms.
• Contact and communications data - your email address, phone number and message content when you contact us or subscribe to updates.
• Data you give us directly - anything you submit through forms, APIs, or account registration on any Bevars product.

Some data we process may be sensitive or special-category personal data (for example, data revealed in criminal investigations or sanctions screening). We process such data only where the NDPA 2023 and other applicable laws permit, and with appropriate safeguards.

5. How and why we use your personal data

6. Legal bases for processing

Consistent with the NDPA 2023, we process personal data only where we have a lawful basis, including:

• Consent - where you have given clear, informed consent (which you may withdraw at any time);
• Performance of a contract - to provide the services you or your organisation have signed up for;
• Legal obligation - to comply with Nigerian laws and regulatory obligations, including AML/CFT reporting duties;
• Legitimate interests - such as product security, crime prevention, and improvement of our services, balanced against your rights and interests;
• Vital interests - to protect life, safety or security in an emergency.

7. Who we share personal data with

We do not sell your personal data. We share it only as necessary with:

• Regulators and authorities - including the Nigeria Data Protection Commission (NDPC), Central Bank of Nigeria (CBN), Nigerian Financial Intelligence Unit (NFIU), Economic and Financial Crimes Commission (EFCC), and other bodies where we are legally required or permitted to do so;
• Service providers and processors - cloud hosting (including our in-Nigeria Huawei Cloud hosting for Finhaq), communications providers, and infrastructure vendors, bound by contractual data protection obligations and processing only on our instructions;
• Clients and financial institutions - where a bank, fintech or institutional client uses our products to screen and monitor their own customers, that institution may act as a separate controller for its customer data;
• Professional advisers - auditors, lawyers and consultants, under confidentiality obligations;
• Business transfers - if we reorganise or transfer any part of the business, subject to this policy and applicable law.

8. International data transfers

Wherever possible, personal data of Nigerian data subjects is stored and processed in Nigeria. Where a transfer outside Nigeria is necessary, we apply the safeguards required by the NDPA 2023 - such as adequacy determinations, contractual protections approved by the NDPC, or your consent - and we remain accountable for the data wherever it is processed.

9. Data retention

We keep personal data only as long as necessary for the purposes described in this policy and to meet legal, regulatory and audit obligations. Financial-crime and AML records are retained for the periods required by Nigerian law (commonly at least five years). Other data is retained according to its purpose, after which it is securely deleted or anonymised.

10. Your rights under the NDPA 2023

Wherever the NDPA 2023 applies, you have the right to:

• Access - request confirmation of whether we process your personal data and receive a copy of it;
• Rectification - have inaccurate or incomplete data corrected;
• Erasure - request deletion of your data where there is no overriding legal reason to keep it;
• Restriction and objection - ask us to limit processing, or object to processing based on legitimate interests;
• Data portability - receive your data in a structured, commonly used format where technically feasible;
• Withdraw consent - where processing is based on consent, withdraw it at any time;
• Complain - lodge a complaint with the Nigeria Data Protection Commission (NDPC).

To exercise any of these rights, email adams@bevars.com. We will verify your identity and respond within the timeframes required by law. A request made to Bevars Technologies Limited covers your personal data across all Bevars products.

11. How we protect personal data

We apply technical and organisational measures appropriate to the sensitivity of the data we process, including encryption in transit and at rest, access controls and least-privilege permissions, audit logging, security monitoring, staff training, and vendor due diligence. No system is perfectly secure, but we work continuously to protect the data entrusted to us.

12. Children's data

Our products are intended for businesses and adults. We do not knowingly collect personal data from children. If you believe a child's data has been provided to us, contact adams@bevars.com and we will delete it promptly.

13. Changes to this policy

We may update this policy from time to time. The version at the top of this page always governs, and material changes will be highlighted on this page. Continued use of our products after a change means you accept the updated policy.

14. Contact us

Questions, requests or complaints about this policy or your personal data:

If you are unsatisfied with our response, you may complain to the Nigeria Data Protection Commission (NDPC), the supervisory authority under the NDPA 2023.