Privacy Policy

The data controller responsible for the personal data you provide to Clusteer is Outbuild Ltd, operating the Clusteer platform.

Certain processing necessary for the crypto-exchange leg of your transactions — including digital-asset custody, exchange execution, settlement, and elements of identity verification — is carried out by our licensed exchange and custody partner, which acts as a separate or joint data controller, or our data processor, for that processing under appropriate data-protection terms.

As a processor of identity, biometric, and financial data, Outbuild Ltd is a data controller of major importance under the NDPA/GAID.

To provide a regulated financial service, we (and, for verification and the crypto leg, our exchange and custody partner) collect:

Identity data — full name, date of birth, gender, nationality, residential address; government identification numbers (such as BVN and NIN) and identity documents (e.g. passport, driver's licence, voter's card, national ID).

Biometric data — a facial image and "liveness" data captured during identity verification.

Contact data — email address, phone number.

Financial and transaction data — your Nigerian bank account details; records of your buy/sell transactions; amounts; stablecoin wallet addresses you send to or receive from; and related transaction details.

Verification and compliance data — the results of identity, sanctions, politically-exposed-person (PEP), and screening checks; your risk rating; and, where applicable, source-of-funds information.

Technical and usage data — device information, IP address, log data, and information collected via cookies and similar technologies (see our Cookie Policy).

• Directly from you — when you register, complete verification, or transact.
• Automatically — through your use of the platform (technical/usage data, cookies).
• From third parties — our exchange and custody partner and licensed identity-verification providers and authoritative databases used to verify your identity; blockchain networks (publicly visible wallet and transaction data); and our banking, payment, custodial, and liquidity partners.

We process your personal data on the following lawful bases under the NDPA:

Your facial image and liveness data are sensitive personal data under Section 30 of the NDPA. We process them only on a lawful ground permitted for sensitive data (identity verification and fraud prevention required by AML law, and/or your explicit consent). We:

• collect them only to verify your identity and prevent impersonation and fraud;
• protect them with enhanced security measures, including encryption and strict access controls;
• do not use them for any purpose beyond verification and fraud prevention; and
• retain them only for as long as the law requires (see Section 8).

Where identity/biometric verification is performed by our exchange and custody partner or a licensed verification provider, that party processes this data under appropriate data-protection terms.

We share personal data only where necessary, with:

• Our licensed exchange and custody partner — which provides digital-asset exchange, custody, settlement, and related regulated functions, and may perform or coordinate identity verification.
• Licensed identity-verification providers — to verify your identity.
• Our custodial, liquidity, banking, and payment partners — to settle transactions and pay out to your bank account.
• Regulators and authorities — directly, or through our licensed partner where the obligation sits with them — including the Securities and Exchange Commission (SEC), the Nigeria Financial Intelligence Unit (NFIU), the Special Control Unit Against Money Laundering (SCUML), the Economic and Financial Crimes Commission (EFCC), the Central Bank of Nigeria (CBN), the Nigeria Sanctions Committee (NSC), and law enforcement, where required by law (for example, suspicious-transaction or threshold-transaction reporting). Where the law requires it, we may be prohibited from informing you of such disclosures.
• Service providers — technology, hosting, security, and support providers acting on our instructions under appropriate data-protection terms.
• Successors — in the event of a merger, acquisition, or reorganisation, subject to this Policy.

The NDPA prohibits transfers of personal data outside Nigeria by default (Sections 41–43). Where personal data is transferred or stored outside Nigeria (for example, by our exchange and custody partner, a KYC provider, or our hosting/service providers), we rely on one of the lawful bases the NDPA permits:

• transfer to a country/region the NDPC has determined provides an adequate level of protection (Section 42); or
• where no adequacy decision applies, appropriate safeguards such as Standard Contractual Clauses (SCCs) or binding corporate rules that give you enforceable rights (Sections 41 and 43); or
• a specific statutory derogation under Section 43 (e.g. necessity for performance of your contract).

We keep your personal data for as long as you are a customer and, after your relationship with us ends, for at least five (5) years from the end of the business relationship or the completion of the relevant transaction (whichever is later), as required by Nigeria's Money Laundering (Prevention and Prohibition) Act 2022 (or longer where a law or authority requires).

We apply appropriate technical and organisational measures to protect your data, including encryption, access controls on a need-to-know basis, access logging, secure backups, and staff confidentiality obligations. No system is completely secure, but we work to protect your information and to respond promptly to any incident.

Subject to legal limits (including our retention obligations), you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request erasure of your data (except where we must keep it by law);
• object to or request restriction of certain processing;
• request portability of data you provided to us;
• not be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects, except as permitted by law (Section 37);
• withdraw consent for any processing based on consent (e.g. marketing); and
• lodge a complaint with the Nigeria Data Protection Commission (NDPC).

To exercise any right, contact us at legal@clusteer.com. We will respond within the timeframe required by law. We may need to verify your identity before acting on a request. Where a right relates to data held by our exchange and custody partner or a verification provider, we will direct or assist your request to the relevant party.

We use cookies and similar technologies on our website. Please see our Cookie Policy for details and your choices.

Clusteer is not intended for, and may not be used by, anyone under 18. We do not knowingly collect data from minors.

We may update this Policy from time to time. We will post the updated version with a new "Last updated" date and, where appropriate, notify you. Continued use of Clusteer after changes take effect constitutes acceptance of the updated Policy.

Questions about this Policy or your data:

*Clusteer is a product operated by Outbuild Ltd (RC 8076384). Crypto-asset exchange and custody services are provided by a licensed third-party partner.*