Privacy policy

Privacy Policy

Last updated: May 2026

1. Who We Are

Tarshix Trade Systems Limited ("Tarshix," "we," "us," "our") operates the Tarshix platform at tarshix.com and app.tarshix.com. We provide commercial trade operations infrastructure — invoicing, payment tracking, document management, and related services — for trade-dependent businesses.

Registered Office: Lagos, Nigeria Email: privacy@tarshix.com

2. Information We Collect

Account Information: When you register, we collect your name, email address, phone number, company name, job title, and company registration number (CAC RC/BN number).

Organisation Information: Company details, banking information (for payment integration), team member details, branding assets (logo), and trade partner designations.

Trade Data: Transactions, invoices, contracts, documents, approval records, payment records, and counterparty information you create or upload within the platform.

Usage Data: Login timestamps, feature usage patterns, device type, browser type, IP address, and general location (city/country level).

Communication Data: Messages you send to our support team, feedback submissions, and waitlist/early access form responses.

3. How We Use Your Information

We use your information to:

  • Provide, maintain, and improve the Tarshix platform

  • Process transactions and facilitate payments through our integrated payment processors

  • Generate invoices, documents, and reports as you direct

  • Send service notifications (invoice dispatched, payment received, approval required)

  • Provide customer support

  • Monitor platform security and prevent fraud

  • Comply with Nigerian tax, financial, and regulatory requirements

  • Analyse aggregate usage patterns to improve our product (never individual trade data)

We do not sell your personal data or trade data to any third party.

We do not use your trade data for advertising purposes.

We do not share your financial records with other users or organisations unless you explicitly designate them as counterparties or trade partners within the platform.

4. Legal Basis for Processing

We process your data on the following legal bases under the Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA):

  • Contract performance: Processing necessary to provide the Tarshix service you signed up for

  • Legitimate interest: Platform security, fraud prevention, service improvement

  • Legal obligation: Tax record retention, regulatory compliance

  • Consent: Marketing communications (you can withdraw consent at any time)

5. Data Storage and Security

Infrastructure: Your data is hosted on Google Cloud Platform (GCP) with data centres that comply with SOC 2, ISO 27001, and other international security standards.

Encryption: All data is encrypted in transit (TLS 1.2+) and at rest (AES-256).

Payments: Payment processing is handled by licensed third-party payment processors regulated by the Central Bank of Nigeria. These processors maintain PCI-DSS compliance. We do not store your counterparties' bank card details on Tarshix servers. Details of current payment processing partners are available within the Platform settings.

Access controls: Access to production data is restricted to authorised personnel only, protected by multi-factor authentication, and logged.

Audit trail: Every action within the platform — every edit, approval, payment, and access event — is recorded in an immutable audit log.

6. Data Sharing

We share your data only with:

  • Payment processors: To process payments, create virtual bank accounts, and facilitate invoice settlement. Our current payment processing partners are listed within the Platform settings.

  • Google Cloud Platform: As our infrastructure provider (data processor)

  • Cloudflare: For DNS, content delivery, and DDoS protection

  • Resend: To deliver transactional emails (invoice notifications, approval alerts, password resets)

  • Your designated counterparties: When you dispatch an invoice or share documents through the counterparty portal, the recipient can view the information you choose to share

  • Legal authorities: Only when required by Nigerian law, court order, or regulatory directive

We do not share data with data brokers, advertising networks, or analytics companies that would use it for profiling.

We will notify you if we add new categories of third-party data processors, and we maintain an up-to-date list of sub-processors within the Platform.

7. Data Retention

  • Account data: Retained for the duration of your active account

  • Trade data (transactions, invoices, contracts, documents, payment records): Retained for a minimum of 7 years from creation, in compliance with Nigerian tax and commercial law requirements

  • Usage data: Retained for 2 years, then anonymised

  • Deleted accounts: Upon account deletion, personal data is removed within 30 days. Trade data subject to legal retention requirements is anonymised and retained for the statutory period.

8. Your Rights

Under the Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA), you have the right to:

  • Access: Request a copy of all personal data we hold about you

  • Rectification: Correct inaccurate or incomplete data

  • Deletion: Request deletion of your personal data (subject to legal retention requirements for trade/financial records)

  • Restriction: Request that we limit how we process your data

  • Portability: Export your data in standard formats (CSV, PDF)

  • Objection: Object to processing based on legitimate interest

  • Withdraw consent: Withdraw consent for marketing communications at any time

To exercise any of these rights, email privacy@tarshix.com. We will respond within 30 days.

9. Cookies

We use only essential cookies required for:

  • Authentication and session management

  • Security (CSRF protection)

  • User preferences (language, timezone)

We do not use advertising cookies, tracking pixels, or third-party analytics cookies. We do not participate in cross-site tracking.

10. Children's Privacy

Tarshix is a business platform. We do not knowingly collect data from anyone under 18 years of age. If we discover we have collected data from a minor, we will delete it immediately.

11. International Data Transfers

Your data is processed and stored on Google Cloud Platform infrastructure. If data is transferred outside Nigeria, it is protected by appropriate safeguards including Google Cloud's data processing agreements and compliance with the NDPA's cross-border transfer requirements.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification at least 14 days before the changes take effect. Non-material changes (clarifications, formatting) take effect immediately upon posting.

13. Contact Us

For privacy-related questions, concerns, or requests:

Email: privacy@tarshix.com Address: Tarshix Trade Systems Limited, Lagos, Nigeria

If you are unsatisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).