Dandali

Privacy Policy

Last updated: July 2026

1. Introduction

BrowsePoint Nigeria Ltd. ("BrowsePoint", "we", "us") is committed to protecting your personal information in compliance with the Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act (NDPA) 2023. This Privacy Policy explains how we collect, use, store, and protect your data when you use the Dandali service.

2. Data We Collect

We collect the following categories of personal data:

  • Account Information: Full name, email address, phone number, password (hashed)
  • Identity Verification (KYC): National Identification Number (NIN) hash, Bank Verification Number (BVN) hash, government-issued ID images, liveness selfie verification result
  • Usage Data: Session start/end times, data consumed, access point location, IP address assigned, device MAC address
  • Payment Data: Transaction history, wallet balance (card data is processed by Paystack/Flutterwave and never stored by BrowsePoint)
  • Communication Data: VoIP call records, SMS messages, notification preferences
  • Device Information: Device type, operating system, app version

3. How We Use Your Data

Your personal data is used for:

  • Providing and improving the Dandali service
  • Account creation, authentication, and security
  • KYC verification as mandated by the Nigerian Communications Commission (NCC)
  • Processing payments and managing your wallet
  • Generating Call Detail Records (CDRs) as required by NCC regulations
  • Customer support and communication
  • Network monitoring, optimization, and fraud prevention
  • Compliance with applicable laws and regulations

4. Data Storage and Security

All personal data is stored on servers located within Nigeria, in compliance with NDPR data residency requirements. We implement industry-standard security measures including:

  • TLS 1.3 encryption for all data in transit
  • AES-256 encryption for data at rest
  • NIN and BVN stored as irreversible SHA-256 hashes only — raw values are never retained
  • Payment card data handled exclusively by PCI-DSS compliant processors (Paystack, Flutterwave)
  • KYC documents encrypted in isolated storage with strict access controls
  • Role-based access control for all administrative systems
  • Regular security audits and penetration testing

5. Data Retention

We retain your data for the following periods:

  • Account data: For the duration of your account plus 2 years after deletion
  • Session/CDR records: 12 months as mandated by NCC
  • Payment records: 7 years as required by Nigerian tax law (FIRS)
  • KYC documents: Duration of account plus 5 years as mandated by NCC
  • Communication records: 12 months as mandated by NCC

6. Data Sharing

We do not sell your personal data. We may share limited data with:

  • Payment Processors: Paystack and Flutterwave for transaction processing
  • KYC Verification Partners: NIMC (for NIN verification), NIBSS (for BVN verification), Smile Identity (for liveness checks)
  • Regulatory Authorities: NCC, FIRS, and law enforcement agencies pursuant to valid legal orders
  • Hotspot Partners: Anonymised, aggregated usage statistics only — partners never receive personally identifiable information

7. Your Rights (NDPR)

Under the Nigeria Data Protection Regulation, you have the right to:

  • Access: Request a copy of your personal data
  • Rectification: Correct inaccurate or incomplete data
  • Erasure: Request deletion of your data (subject to legal retention requirements)
  • Restriction: Limit the processing of your data
  • Portability: Receive your data in a machine-readable format
  • Objection: Object to processing of your data for marketing purposes
  • Withdraw Consent: Withdraw previously given consent at any time

To exercise any of these rights, contact our Data Protection Officer at dpo@browsepoint.ng.

8. Cookies and Tracking

The Dandali captive portal uses minimal, essential cookies for session management. We do not use advertising trackers or third-party analytics on the captive portal. The Dandali mobile app and web portal use analytics to improve service quality, with user consent.

9. Children's Privacy

The Dandali service is not intended for children under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided personal data to us, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy periodically. Significant changes will be notified via email and in-app notifications at least 30 days before taking effect.

11. Data Protection Officer

Our Data Protection Officer can be contacted at:

BrowsePoint Nigeria Ltd.
Data Protection Officer
Email: dpo@browsepoint.ng
Phone: +234 800 DANDALI
Address: Victoria Island, Lagos, Nigeria

12. Supervisory Authority

If you are unsatisfied with our handling of your data, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

Back to portal