Privacy Policy

This Policy applies to personal data of Nigerian users and, to the extent the Service is accessed from elsewhere, to any other personal data we process.

What we collect depends on how you use FixQuest. We only collect what a given account type or feature genuinely needs.

2.1 Visitors (no account required)

• —Search and location filters you use, to return relevant results (not stored against your identity).
• —If you leave a review: your name and email address (used only to send a one-time email verification code), your rating, and your comment.
• —Basic technical data for every visit — IP address and timestamp — used to prevent fake reviews, cap how many times a single visitor's page-view counts toward a provider's or organisation's statistics, and to protect the Service from abuse.

2.2 Service Providers

• —Account and contact details: business name, owner name, email, phone number, password (stored as a salted hash, never in plain text).
• —Business details: bio, years of experience, service category or categories, and location (state, LGA, area/neighbourhood, city).
• —Portfolio photos you upload, and captions where your plan supports them.
• —A WhatsApp contact number, if you request one to be shown publicly (subject to admin approval before it is displayed).
• —Subscription and billing status (plan tier, expiry date) — card and bank details themselves are handled directly by Paystack; we never receive or store your card number.

2.3 NGOs / CSOs

• —Organisation details: name, email, phone, address, website, and a description of your work.
• —Compliance documents you upload for verification: your CAC certificate and up to three supporting registration documents, plus an annual report on qualifying plans.
• —Thematic areas of work you register, each with a description and supporting images, submitted individually for review.
• —Gallery images and, on qualifying plans, activity videos.

2.4 Referral Associates

• —Full name, email, phone number, and password (hashed).
• —Bank payout details: bank name, account number, and account name — collected solely to pay out commissions you earn, never shared for any other purpose.
• —Your referral activity: who you referred, whether each referral qualified, and your commission history.

2.5 Everyone with an account

• —A session cookie (ff_session) that keeps you signed in. This cookie is strictly functional — it is not used for advertising or cross-site tracking, and no third party can read it.
• —An activity log of significant actions taken by administrators on your account (e.g. an approval, rejection, or suspension), retained for accountability and dispute resolution.

• —To create, verify, and operate your account, and to display your public profile where applicable.
• —To verify reviews with a one-time email verification code before they are published, so that published reviews are genuine.
• —To process subscription payments and reflect your correct plan, entitlements, and expiry/grace status.
• —To pay Referral Associate commissions to the bank account on file.
• —To moderate content — including reviewing provider and NGO/CSO submissions, documents, and thematic areas before they go live — and to act on reports of abuse.
• —To send you service communications: OTP codes, account status updates, and plan renewal reminders when your subscription approaches its expiry date or enters its 7-day grace period.
• —To maintain the security and integrity of the Service, including preventing fraud, fake accounts, and fake reviews.
• —To comply with our legal obligations, including tax, company, and data protection law.

Under the NDPA, we rely on the following legal bases, depending on the activity:

• —Performance of a contract — creating and running your account, processing your subscription, paying referral commissions.
• —Consent — for the OTP-verified review you choose to submit, and for any optional marketing communications (which you may withdraw consent from at any time).
• —Legitimate interest — for fraud prevention, abuse prevention, and service analytics, balanced against your rights and always kept to the minimum necessary.
• —Legal obligation — for record-keeping required by tax, corporate, or data protection law.

We do not sell personal data, and we do not share it with advertisers. We share only what each of the following named service providers needs to perform its specific function for us:

We may also disclose personal data where required by law, to comply with a valid legal or regulatory request, or to protect the rights, property, or safety of FixQuest, our users, or the public.

Some of the service providers listed above may process data on servers located outside Nigeria. Where this occurs, we take reasonable steps to ensure an adequate level of protection is maintained, consistent with NDPA requirements for cross-border data transfer.

We retain personal data for as long as your account is active and as needed to provide the Service. After account closure, we retain the minimum data necessary to comply with legal, tax, and accounting obligations, to resolve disputes, and to enforce our agreements, after which it is deleted or anonymised. Visitor IP addresses collected for abuse prevention and page-view caps are anonymised after 90 days.

Under the NDPA, you have the right to:

• —Access the personal data we hold about you.
• —Correct inaccurate or incomplete data.
• —Request erasure of your data, subject to our legal retention obligations.
• —Object to or restrict certain processing.
• —Request a portable copy of data you provided to us.
• —Withdraw consent at any time, where processing is based on consent.
• —Lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your data has been mishandled.

To exercise any of these rights, contact us at support@fixquest.com.ng.

FixQuest is not directed at, and is not intended for use by, anyone under 18 years of age. Creating a Provider, NGO/CSO, or Referral Associate account requires the legal capacity to enter into a binding contract under Nigerian law. We do not knowingly collect personal data from children.

• —Passwords are stored as salted cryptographic hashes, never in plain text.
• —Authentication uses a secure, httpOnly session cookie that cannot be read by scripts running on the page.
• —Provider, NGO/CSO, and referral accounts only become publicly visible after admin review and approval.
• —Sensitive administrative actions are recorded in an internal audit log.
• —All traffic to the production Service is encrypted in transit (HTTPS).

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal data, we will notify you and the NDPC as required by law.

We use one strictly necessary cookie (ff_session) to keep you signed in. We do not use third-party advertising or cross-site tracking cookies. If this changes in the future, this Policy will be updated accordingly before any such technology is introduced.

This Policy may be updated from time to time to reflect changes in our practices or in the law. The "Effective Date" above will always reflect the version currently in force. Material changes will be communicated to registered users by email or an in-app notice.

• —Email: support@fixquest.com.ng
• —Registered company: FixQuest Limited (RC 9809074)
• —Address: Maiduguri, Borno State, Nigeria