Privacy Policy & Global Data Protection Charter

1. Scope & Commitment to Data Privacy

Onesign Concept Enterprises Limited ("Onesign Concept", "we", "us", "our") is committed to protecting the privacy, confidentiality, and security of personal and corporate data entrusted to us. This Privacy Policy details how we collect, process, store, and safeguard information across our website at onesignconcept.com, our client portal console, our software catalog, and our client engineering engagements.

This policy aligns with international data protection frameworks, including the General Data Protection Regulation (GDPR) and the Nigeria Data Protection Regulation (NDPR / NDPA).

---

2. Information We Collect

We collect only data necessary to deliver enterprise technology services and support our clients:

1. Client Contact & Profile Information: Full name, corporate email address, phone number, company name, job title, and geographic billing jurisdiction. 2. Project & Architectural Specifications: System requirements, API schemas, software license keys, and integration credentials shared to facilitate software development. 3. Financial & Transactional Metadata: Payment amounts, transaction reference IDs, VAT/tax identifiers, and billing history. We do not store raw credit card numbers or banking passwords on our servers; all payment transactions are tokenized via PCI-DSS Level 1 certified gateways (Stripe and PayPal). 4. Technical & Telemetry Data: IP addresses, browser types, session timestamps, and device identifiers collected to secure our client portal, monitor security events, and prevent unauthorized account access.

---

3. Lawful Bases for Data Processing

We process your information under the following lawful bases:

• Contractual Performance: To execute statements of work, deliver software licenses, process invoices, and provide technical support.
• Legitimate Business Interests: To safeguard our infrastructure against cyber attacks, conduct internal audits, and optimize software performance.
• Legal & Regulatory Obligations: To comply with statutory financial, corporate tax, and auditing regulations.
• Consent: Where you have explicitly opted in to receive technical whitepapers, architectural case studies, or newsletter updates.

---

4. Zero Data Retention & Artificial Intelligence Governance

When building custom AI agents, document processing pipelines, or RAG architectures for our clients:

• Zero Public Training: We enforce strict enterprise Zero-Data-Retention (ZDR) agreements with foundation model providers (OpenAI, Anthropic Claude, Google Cloud Vertex). Client proprietary documents and internal codebases are never utilized to train or fine-tune public models.
• Data Isolation: Enterprise vector embeddings and semantic search indexes are partitioned inside dedicated, encrypted PostgreSQL clusters with Zero-Trust Row Level Security (RLS).

---

5. Cookies, Session Tokens & Analytics

• Essential Cookies: We utilize strictly necessary session cookies and CSRF security tokens required to authenticate client portal users and protect form submissions.
• No Third-Party Behavioral Tracking: We do not sell personal data to data brokers, nor do we run cross-site behavioral advertising pixels or invasive marketing trackers.
• Analytics: Any web performance analytics gathered are anonymized and aggregated to monitor server response times and Core Web Vitals.

---

6. Data Security & Storage Standards

We employ enterprise-grade security controls to prevent unauthorized access, alteration, or disclosure:

• Encryption: All data in transit is encrypted using TLS 1.3; data at rest is encrypted using AES-256.
• Zero-Trust Database Security: Database access is governed by Supabase Row Level Security (RLS) policies ensuring complete multi-tenant tenant isolation.
• Access Controls: Production infrastructure access is restricted to authorized senior engineering personnel using hardware multi-factor authentication (MFA) and least-privilege IAM roles.

---

7. Data Retention & Deletion

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, or to satisfy legal, accounting, and reporting obligations. Upon contract termination or verified client request, client source code, project databases, and uploaded assets are securely decommissioned and purged from staging environments within thirty (30) days.

---

8. Your Data Protection Rights

Under GDPR, NDPR, and applicable data privacy regulations, you have the right to:

• Access: Request copies of personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete information.
• Erasure: Request deletion of your personal data ("Right to be Forgotten"), subject to statutory record-keeping requirements.
• Portability: Request transfer of your data in a structured, machine-readable format.
• Objection & Restriction: Object to or restrict processing of your data under specific conditions.

To exercise any of these rights, contact our Data Protection Officer at privacy@onesignconcept.com. We respond to all verified requests within thirty (30) calendar days.