Data Protection
Last updated 14 October 2026
This notice forms part of our Terms of Service. It sets out how IGNITECORE TRADING SERVICES processes personal data on behalf of businesses that use IGNITECORE, as section 29 of the Nigeria Data Protection Act 2023 (NDPA) requires. How we handle data for which we are the controller is in our Privacy Policy.
1. Roles
The business customer is the data controller of its customers' personal data: the WhatsApp numbers, names, messages and lead details of people who contact it. IGNITECORE TRADING SERVICES is its data processor.
2. What we process, and why
- Data subjects: people who message the business on WhatsApp, and the business's own staff.
- Personal data: WhatsApp phone number and profile name, message content and status, and the property preferences, budget, timeline and lead score derived from the conversation.
- Purpose: to answer and qualify enquiries, send follow-ups and hand conversations to the business's staff, as the business configures.
- Duration: for as long as the business's account is active, then as described in section 7.
3. Our commitments as processor
We will:
- process the data only on the business's documented instructions, which include these terms and its use of IGNITECORE;
- keep it confidential, and allow access only to staff who need it and are bound by confidentiality;
- keep each business's data separate, so that no other customer can see or retrieve it;
- apply appropriate technical and organisational security measures (see our Privacy Policy, section 9);
- help the business respond to requests from people exercising their NDPA rights;
- tell the business without undue delay after we become aware of a personal data breach affecting its data, and help it meet its own notification duties;
- help the business with data protection impact assessments where reasonably required; and
- make available the information needed to show we meet these commitments.
4. Sub-processors
The business authorises us to use these sub-processors, each bound by data protection terms:
| Provider | Purpose | Location |
|---|---|---|
| Meta Platforms | WhatsApp Business Platform: receiving and sending messages | Global |
| OpenAI | Generating replies and extracting lead details | United States |
| Supabase | Database, authentication and document storage | European Union |
| Railway | Application servers and job queue | United States |
| Vercel | Website and web application hosting | Global |
We will update this list and give business customers at least 14 days' notice before adding or replacing a sub-processor, so they can object.
5. International transfers
Some sub-processors are outside Nigeria. We transfer personal data out of Nigeria only on the grounds Part VIII of the NDPA allows, including the sub-processor's contractual commitments.
6. The business's responsibilities
- having a lawful basis to process its customers' data and to message them;
- obtaining opt-in before sending business-initiated WhatsApp messages, as Meta requires;
- telling its customers how their data is used, including that an AI assistant handles enquiries; and
- not uploading personal data to IGNITECORE that the service does not need.
7. Return and deletion
When the business closes its account it can ask us for an export of its data first. We delete or anonymise its data within 90 days of closure, unless the law requires us to keep it.
8. For people who messaged a business
If you want to see, correct or delete what a business holds about you, contact that business. You can also email us at admin@support.ignitecoreai.com and we will help the business respond. You can complain to the Nigeria Data Protection Commission.