Privacy Policy

1. Who is responsible

ODHCUS STORE LTD ("ODHCUS", "we", "us") is registered in Nigeria under RC9725015. Our office is at 14 Allen Avenue, Ikeja, Lagos, Nigeria. We are the data controller for the processing described here where we decide why and how personal information is used.

For privacy questions or requests, email contact@odhcustore.com, call +234 706 482 7648, or write to our office. Data handled on behalf of a client within a software or consultancy project is addressed in the relevant engagement and privacy arrangements.

2. Website & contact information

• Browsing: Cloudflare processes connection and request information, such as your IP address, browser information, requested pages, timestamps and security signals, to deliver and protect this website.
• Correspondence: when you contact us, we receive the contact details, business information, message content and attachments you choose to provide.
• Contact tools: email and telephone links open your device's applications. Selecting a link does not itself send a message. The copy button copies our published email address to your clipboard.

We do not install advertising trackers or analytics cookies on this website. Our fonts, images and scripts are hosted with the site. Cloudflare may use security mechanisms needed to protect its services. A future Sumsub verification flow will have its own relevant technical and privacy disclosures.

3. Purposes & lawful grounds

We use information for the following purposes, subject to the Nigeria Data Protection Act 2023 and other data protection laws where they apply:

• Responding to enquiries and managing engagements: steps you request before a contract, performance of a contract where applicable, or our legitimate interest in communicating with business contacts.
• Operating and protecting the website: our legitimate interests in reliable services, fault investigation and abuse prevention, balanced against your rights.
• Future identity checks: establishing the identity or authority of a person seeking a business relationship and preventing impersonation or fraud. We will assess and explain the lawful basis for the particular check before collecting verification information.
• Legal requirements: meeting a specific obligation that actually applies to us, or establishing, exercising or defending legal claims where permitted.

We will obtain consent where required, including an appropriate basis for sensitive information. Browsing this website or reading this policy is not consent to biometric processing. We do not use KYC information for advertising or sell it.

4. Planned KYC with Sumsub

We plan to use Sumsub, an identity verification service, when an identity check is appropriate for a business relationship. Before a check begins, we will explain its purpose, the required information, the applicable lawful basis and retention arrangements. Only checks relevant to that purpose will be requested.

Depending on the verification steps selected, information may include:

• Your name, date of birth, nationality, address and contact details.
• Identity-document images and details, and proof of address where needed.
• Selfies or video, liveness results and facial biometric data if a biometric check is enabled.
• Device and network information, verification outcomes and fraud indicators.

Information may come from you, the verification session and relevant validation sources. For checks we commission, ODHCUS will determine the purpose and receive the verification outcome and relevant supporting information; Sumsub will generally process data on our instructions. Sumsub may also act as an independent controller for purposes explained in its own notices.

Read the Sumsub Privacy Notice (Service Delivery) and Sumsub Notice of Personal Data Processing. Those notices complement this policy.

Required disclosures and any separate consent will be presented before verification data is sent. Please use only the verification channel we identify for you; do not email identity documents or selfies to our general contact addresses.

5. Biometrics & verification decisions

A biometric check, if enabled, may compare a live facial image with an identity document and assess whether a real person is present. Biometric information can be sensitive personal data. We will identify the applicable processing condition and obtain separate, explicit consent where required before such a check. Merely contacting us does not authorise it.

Verification tools may produce automated matches, risk indicators or recommendations. If we introduce these tools, you may contact us to challenge inaccurate information, explain your circumstances and request a human review of a decision affecting your access to our services. We will explain any proposed solely automated decision with a significant effect and the applicable safeguards before using it.

You may decline to provide information or withdraw consent for processing that relies on it. Where a check is necessary, this may prevent us from proceeding with the related engagement. Contact us to discuss whether an alternative verification method is available.

6. Service providers & sharing

Cloudflare hosts and protects the website and forwards company email to a Gmail mailbox used for correspondence. See the Cloudflare privacy policy and Google privacy policy.

When our planned KYC service is activated, relevant information will also be processed by Sumsub and the service providers involved in the selected checks. We may disclose information to professional advisers, regulators, courts or other authorities when necessary and lawful, including to meet a binding requirement or handle a legal claim. Disclosures are limited to information relevant to their purpose.

7. International transfers

Our service providers may process information outside Nigeria or your country of residence. Where we transfer personal information internationally, we will assess the destination and use a transfer basis permitted by applicable law, such as an adequate level of protection or appropriate contractual safeguards. We will confirm the storage and transfer arrangements for the Sumsub configuration before starting customer verification. Contact us for information about safeguards relevant to your data.

8. Retention & deletion

We keep information only for a justified period connected to its purpose. For enquiries, this includes handling the conversation and any resulting engagement. For technical records, it includes operating the website and investigating security issues. Relevant records may need to be kept for an applicable legal requirement or an unresolved claim.

Before launching KYC, we will set and disclose a retention period or clear criteria for the selected checks, taking account of the relationship, fraud risks, the sensitivity of the data and any law that applies to us. When the purpose and any lawful retention requirement end, we will delete or anonymise information under our control and instruct processors accordingly. Sumsub's independent processing and retention are explained in its own notices. You may request deletion, subject to applicable exceptions.

9. Your rights & complaints

Depending on the law and circumstances, you may ask to access or obtain a copy of your information, correct inaccuracies, delete information, restrict processing, receive or transfer information in a portable format, or object to processing based on legitimate interests. You may withdraw consent without affecting the lawfulness of processing before withdrawal. Applicable rights concerning significant automated decisions also remain available.

Send requests to contact@odhcustore.com. We may ask for proportionate information to verify your identity and will respond within the period required by applicable law. If an exception applies, we will explain it. For processing Sumsub undertakes independently, its notices explain how to contact it directly.

You may complain to the Nigeria Data Protection Commission (NDPC) or another competent data protection authority. You do not have to contact us first to exercise that right.

10. Security

This website uses HTTPS and Cloudflare security controls. Our approach is to limit personal information to what is needed and restrict its use to authorised purposes. Before enabling KYC, we will review provider arrangements, access controls and protections for sensitive information. Please avoid sending unnecessary sensitive information in ordinary email.

11. Children

Our business services and planned verification process are intended for adults. We do not knowingly seek children's identity information through this website. Contact us if you believe a child has provided personal information so we can assess and address it.

12. Policy changes

We will update this page as our services or information practices change and revise the date above. Before activating KYC or making a material change to how verification information is used, we will provide the relevant updated notice and seek any consent required by law.