Privacy Policy

1 Data Controller

Agent-X Intelligence & Investigations Ltd (AGXII Ltd) is the data controller for all personal data collected through our platforms, applications, and website.

2 Applications Covered by This Policy

3 Data We Collect

Panic-X App:

• Full name, phone number, state of residence
• National Identification Number (NIN) — for identity verification
• Emergency contact names and phone numbers
• GPS location — only during active SOS alert
• Device information (for app compatibility)

School-X Academy:

• Full name, email address, phone number
• Payment information (processed securely via Paystack)
• Course progress, assessment scores, and certificate data

AGXII Website:

• Contact form submissions (name, email, organisation, message)
• IP address and browser information (security logging only)

Intelligence Platforms (Government/Enterprise clients only):

• Operator credentials and access logs
• Query data processed under lawful authority

4 Legal Basis for Processing

• Consent — you explicitly agree during registration
• Contract performance — to deliver the service you signed up for
• Legal obligation — compliance with Nigerian law (NDPA 2023, CBN, EFCC, NCC regulations)
• Legitimate interests — security monitoring and fraud prevention
• Vital interests — processing emergency GPS data to protect life (Panic-X)

5 How We Use Your Data

• Provide emergency alert and GPS location sharing (Panic-X)
• Verify identity against national databases (NIN/BVN via NIMC/HiTech)
• Notify emergency contacts during SOS activation
• Deliver online courses and issue verifiable certificates (School-X)
• Process course fee payments via Paystack
• Respond to enquiries and provide technical support
• Comply with Nigerian regulatory and legal obligations
• Improve platform performance and user experience

6 Data Sharing

We may share data only with:

• Nigerian security agencies — under lawful authority and court order only
• Identity verification providers — HiTech API and NIMC for NIN/BVN verification
• Paystack — for secure payment processing (School-X course fees)
• AWS (Amazon Web Services) — EU-West-2 London region, for secure cloud hosting
• NDPC — National Data Protection Commission, as required by law

7 Data Security

• All data encrypted in transit using TLS 1.3
• Data at rest encrypted using AES-256
• Hosted on AWS EU-West-2 (London) with enterprise security controls
• 24/7 security monitoring by AGXII analysts
• Regular vulnerability assessments and penetration testing (VAPT-X)
• Access controls — role-based, least-privilege
• Breach notification within 72 hours to NDPC as required by NDPA 2023

8 Your Rights Under NDPA 2023

As a data subject, you have the following rights:

• Right to access — request a copy of all personal data we hold about you
• Right to rectification — correct inaccurate or incomplete personal data
• Right to erasure — request deletion of your personal data
• Right to restrict processing — limit how we use your data
• Right to data portability — receive your data in a machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — at any time, without penalty
• Right not to be subject to automated decisions — with legal or significant effects

To exercise any of these rights, contact us at privacy@agxii.org.ng

9 Data Deletion Request

You have the right to request the permanent deletion of all your personal data from AGXII systems.

Note: Some data may be retained where required by Nigerian law — for example, financial transaction records (CBN: 6 years) and emergency alert logs (12 months).

10 Data Retention

• Panic-X emergency alert logs — 12 months
• School-X course records and certificates — 7 years
• Financial transaction records — 6 years (CBN requirement)
• Contact enquiries — 2 years
• Security/access logs — 90 days
• Active accounts — retained while account is active

11 Cookies

Our website and applications use only essential cookies for session management and security. We do not use advertising, tracking, or third-party analytics cookies.

You may disable cookies in your browser settings without affecting core functionality.

12 International Transfers

Your data is hosted on AWS EU-West-2 (London, United Kingdom). This transfer is protected by appropriate safeguards including AWS Data Processing Agreements that comply with international data protection standards.

13 Children's Privacy

Our platforms are designed for users aged 18 and above. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, please contact privacy@agxii.org.ng and we will delete it immediately.

14 Complaints

If you are unhappy with how we handle your personal data, you may:

• Contact our Data Protection Officer: privacy@agxii.org.ng
• Lodge a complaint with the National Data Protection Commission (NDPC): ndpc.gov.ng

15 Updates to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least 14 days before they take effect.

Continued use of our services after changes take effect constitutes acceptance of the updated policy.

Version: 1.0  |  Effective date: 9 May 2026  |  NDPC/DCP/10797