Privacy Policy

Last updated: October 2026

1. Data Controller

Bamistech Limited ("we", "us", "our") is the data controller for personal data processed through our websites and services. Registered address: Plot 9, KM 22 Lekki–Epe Expressway, Lagos, Nigeria. Contact: [email protected]

2. Data We Collect

2.1 Account Data

When you register for BamChat, bamisOS Business, or bamisOS Hotels, we collect: name, email, phone number, and hashed password.

2.2 Usage Data

We collect analytics on feature usage, session duration, device type, and error logs to improve service reliability.

2.3 Wallet Data (BamChat)

Wallet balance, transaction history (transfers, gifts, top-ups), and MFA preferences.

2.4 Communication Data

Messages, contacts, group memberships, and call metadata (not call content) for BamChat.

3. Lawful Basis

We process data on the basis of: (a) contract performance (providing the service), (b) legitimate interest (security, fraud prevention, analytics), (c) legal obligation (tax, anti-money-laundering), and (d) consent (marketing emails, optional analytics).

4. Data Sharing

We do not sell personal data. We share data only with:

Sub-processors (cloud hosting, SMS/WhatsApp gateway) under DPAs
Legal authorities when required by law
Affiliates within the Bamistech group for service delivery

5. Data Retention

Account data: retained while account is active, deleted 30 days after closure
Transaction records: 7 years (regulatory requirement)
Analytics logs: 13 months
Message content: deleted on user request or 30 days after account closure

6. Your Rights (NDPR / GDPR)

You have the right to: access, rectification, erasure, restriction, portability, and objection. To exercise these rights, email [email protected]. We respond within 30 days.

7. Security

We implement: TLS 1.2+ in transit, AES-256 at rest, bcrypt/Argon2 password hashing, MFA for wallet operations, rate limiting, and regular penetration testing.

8. International Transfers

Data is hosted in Nigeria (Lagos). Any cross-border transfer uses Standard Contractual Clauses or adequacy decisions.

9. Cookies & Tracking

Essential cookies only (session, CSRF, MFA). No third-party advertising cookies. Analytics are first-party and anonymised.

10. Changes to This Policy

Material changes will be notified via email and in-app banner 30 days before taking effect.

11. Contact

Data Protection Officer: [email protected]
Plot 9, KM 22 Lekki–Epe Expressway, Lagos, Nigeria