Privacy Policy of Xtan

This Privacy Policy regulates how Xtan Ltd (“Xtan”, “we”, “us”, or “our”) processes the personal information of our data subjects, including students, workers, trainees, and institutional members.

In line with the provisions of the Nigeria Data Protection Act (NDP Act), 2023, and other applicable laws, Xtan Ltd maintains strict privacy principles governing the collection, storage, and management of your personal data.

In processing your personal data, we adhere to the principles of fairness, lawfulness, and transparency.

Data is collected for specified, explicit, and legitimate purposes and is not further processed in a way incompatible with those purposes.

We ensure data is adequate, relevant, and limited to the minimum necessary for attendance verification.

We collect personal data to provide our services based on your level of engagement. The major types of personal data and purposes include:

S/N | PURPOSE OF COLLECTION | TYPE OF DATA | LAWFUL BASIS

1. Regulatory Actions | Name, Phone, Email, Contact Address, Sex, DOB, Photograph | Legal obligation / public interest

2. Notifications | Name, Phone, Email, Contact Address, Sex, DOB | Legal obligation / consent

3. Data Analytics | Name, Phone, Email, Contact Address, Sex, DOB | Consent / legitimate interest / legal obligation

4. Security | Name, Phone, Email, Contact Address, Sex, DOB, Photograph | Legal obligation / legitimate interest / public interest

5. Employment | Name, Phone, Email, Contact Address, Sex, DOB, Photograph, Medical Record, Educational Record | Contract / consent / vital interest / legal obligation

6. Contract | Name, Phone, Email, Contact Address, Sex | Contract

The location feature is used to collect data to verify your physical presence during attendance windows.

By using Xtan, you provide explicit consent for the collection and processing of this location data.

We respect the confidentiality of your information and only share it with:

• The specific institution with which you have a verified relationship.

• The relevant Federal or State Ministry of Education for statutory reporting.

We do not sell your data to third-party advertisers or disclose it to external entities without lawful justification.

Your rights include:

• Right to be informed

• Right of access

• Right to rectification

• Right to object to processing

• Right to data portability

• Right to be forgotten

• Right in relation to automated decision making

• Right to lodge a complaint with the Commission

Third parties may provide essential services through our platforms. Data shared is limited to contact details unless consent is provided.

Third-party services may include:

• Internet connectivity

• Marketing team

• Cloud storage

• Data analytics

• Data security

• Software development

All transfers comply with the NDP Act (Nigeria).

Xtan Ltd has established a DPSU and appointed a Data Protection Officer (DPO) responsible for compliance and responding to privacy requests.

Internal mechanisms include:

• Data protection audits and impact assessments

• Breach remediation planning

• Data privacy advisory services

Concerns can be reported to fdoyebadeesq@gmail.com; redress will be within 7 working days.

Xtan Ltd reserves the right to alter this policy to advance data privacy rights, protect public interest, or comply with lawful government directives under the NDP Act and Nigerian Constitution.

Confidential Information includes business and technical information, whether received, accessed, or viewed in any form.

Exclusions include:

• Publicly available information

• Legitimately obtained from third parties

• Required by court order or law

All parties must protect confidential information and prevent unauthorized use or distribution.

Xtan Ltd and all logos, products, services, or content are intellectual property of Xtan Ltd or its licensors.

No copying, imitation, or use is allowed without prior written permission.

Use of Xtan does not transfer ownership or rights to users.

We use cookies for:

• Authentication and security

• Preference settings

• Session management

• Data integrity and fraud prevention

Types of cookies:

• Essential: necessary for platform function

• Functional: enhance user preferences and experience

Third-party cookies are only used for integrated institutional services or payment verification.

Disabling essential cookies may prevent logging in or using attendance features.

You must comply with Nigerian laws when using our Services.

Notices can be provided electronically and are effective 30 days after posting.

We may amend this Agreement; amendments are effective 30 days after posting on https://Xtan.com/

Disputes shall first attempt amicable resolution within 15 days.

Unresolved disputes are referred to arbitration per Arbitration and Mediation Act, 2023, under Lagos State Multi-Door Courthouse law.

Mediation decisions are binding; court action may be sought for enforcement or injunctive relief.

Non-use of the platform does not terminate the agreement. Any dues remain payable upon reactivation.

Invalid or unenforceable provisions are severed; remaining provisions remain valid.

Rights and obligations may be assigned by Xtan Ltd.

Failure to enforce does not waive Xtan's rights.

Parties act as independent contractors responsible for their own obligations.

Xtan Ltd is not responsible for delays caused by events beyond reasonable control, including acts of God, technical failures, strikes, natural disasters, pandemics, or government actions.

XTAN LTD respects your privacy. This section explains how we collect, use, store, and protect biometric data collected through face verification.

Face verification is used solely to confirm that you are who you say you are. It is not used for identification in a database of other people, nor for surveillance or marketing.

Face verification compares a selfie or live video of you to an ID document or to a previously enrolled image to confirm it’s the same person. It answers: "Is this the same person?"

This is different from face recognition, which searches a database to identify "who is this person".

When you use face verification, we may collect:

• Biometric Data: Facial geometry, facial landmarks, and a mathematical template/faceprint derived from your image. The original selfie/video may be processed and then deleted.

• Liveness Data: Information to detect if a real person is present vs a photo/video, such as eye movement or head pose.

• Device Data: Device type, OS, IP address, timestamp, for fraud prevention and audit logs.

• Reference Data: The ID document image or account photo you are verifying against, if applicable.

We use face verification data only for these purposes:

1. Identity Verification: To confirm you match your ID or account.

2. Fraud Prevention & Security: To prevent account takeover, duplicate accounts, and identity theft.

3. Legal Compliance: To meet KYC/AML, age verification, or other legal obligations.

4. Service Improvement: To improve accuracy and anti-spoofing. This uses de-identified data only.

We do NOT use face data for advertising, profiling, or selling to third parties.

We process your biometric data based on:

• Your explicit consent, which you can withdraw at any time

• Contractual necessity: to provide the service you requested

• Legal obligation where required by law

• Face Template: Stored in encrypted form. We cannot reconstruct your face from the template.

• Original Images/Videos: Deleted within 24 hours after verification unless you consent to storage for re-verification.

• Retention Period: Face templates are kept until account deletion + 30 days or 1 year after last verification, whichever comes first. You can request deletion sooner.

All data is stored in Nigeria and encrypted at rest and in transit using AES-256.

We only share biometric data with:

• Verification Vendors: all third party agent processes verification on our behalf under a Data Processing Agreement. They cannot use your data for any other purpose.

• Legal Authorities: If required by law, subpoena, or to prevent fraud.

We do not sell biometric data.

Depending on your location, you have the right to:

1. Access: Request a copy of your biometric data

2. Deletion: Request we delete your face template and images

3. Correction: Request correction of inaccurate data

4. Withdraw Consent: Stop face verification and use alternative verification

5. Portability: Receive your data in a machine-readable format

6. Opt-out: Refuse biometric processing. Note: some features may not be available

To exercise rights, contact: privacy@xtan.com [XTAN LTD]

We use: encryption, access controls, audit logs, and regular security testing. Biometric templates are stored separately from other account data. In case of a data breach, we will notify you as required by law.

Face verification is not intended for users under 16 years. We do not knowingly collect biometric data from children. If you believe a child provided data, contact us to delete it.

We will notify you of material changes via email or in-app notice. Continued use after changes means you accept the new policy.

XTAN LTD

Address: 5 Rd 2, Oluwatedo Estate, Akobo Ojurin, Ibadan.

Email: privacy@xtanltd.com

DPO: Festus Dolapo Oyebade