Privacy Policy

Dutchman Bridge is operated by Dutchman Network Limited, a company incorporated in Nigeria (RC No. 9031385) (“we”, “us”). Dutchman Bridge is a business-only platform: businesses (“partners”) use our dashboard and Partner API to offer stablecoin and fiat services to their own customers (“end customers”).

Our role depends on whose data it is:

• Partners, their directors and their dashboard users. We are the controller of the personal data we collect when a business signs up, goes through business verification (KYB) and uses the dashboard. We decide how and why that data is used.
• End customers.When a partner sends us an end customer’s data through the Partner API, we process it on the partner’s instructions, to provide the Services the partner has asked for. For that purpose we act as the partner’s processor, and the partner is responsible for telling its customers how their data is used.
• Our own legal obligations. We also have our own legal duties that apply to end-customer data — in particular anti-money-laundering and know-your-customer record keeping, fraud prevention, and responding to lawful requests from authorities. For those purposes we decide what we must do with the data ourselves, and we are responsible for it as a controller.

This policy is written to meet the Nigeria Data Protection Act 2023 (“NDPA”). It should be read with our Partner Terms of Service.

Partner account and KYB data

• Account details of the person who registers and of other dashboard users: name, work email, phone number and password (stored only in hashed form).
• Business details: company name, registration (CAC) number and document, business address, website, company bank account, and information about your source of funds and source of crypto assets.

Directors’ identity data

• Identity documents for your directors, and their Bank Verification Number (BVN) and National Identification Number (NIN), together with the results of checks we run on them.

End-customer data received through the Partner API

• Identity and contact details the partner sends us, such as name, email, phone number, date of birth, country and address.
• KYC data collected at the verification tier the partner uses: BVN, NIN, identity documents, selfie images, proof of address, and the results of verification checks.
• Bank account details and wallet addresses used for payouts and transfers.

Transaction data

• Balances, quotes, buys and sells, deposits into virtual accounts, withdrawals, on-chain transfers, cross-border payouts, fees, and the references, timestamps and statuses attached to them.

Technical and log data

• IP addresses, browser and device information, API request logs (including which API key was used, the endpoint and the response), webhook delivery logs, and security and error logs.

Communications

• Emails and other messages you send us, and our replies, including support and compliance correspondence.

The NDPA requires a lawful basis for each use of personal data. We rely on the following:

• To provide the Services— opening and running partner accounts, issuing API keys, executing quotes and transactions, issuing virtual accounts, sending payouts and webhooks. Basis: performance of our contract with the partner, and for end-customer data, the partner’s instructions.
• To verify identity and meet AML/KYC duties — running KYB on partners and KYC on end customers, screening against sanctions and other lists, monitoring transactions, keeping records, and reporting suspicious activity where required. Basis: compliance with a legal obligation.
• To prevent fraud and keep the platform secure — detecting and investigating misuse, protecting accounts and API keys, and keeping logs. Basis: our legitimate interests in protecting partners, end customers and ourselves, and, where it applies, legal obligation.
• To communicate with you — service, security and compliance messages, and notice of changes to our terms or fees. Basis: contract and legitimate interests.
• To improve and support the Services — diagnosing problems and understanding how the Services are used. Basis: legitimate interests.
• To establish, exercise or defend legal claims, and to respond to lawful requests from courts, regulators and law enforcement. Basis: legal obligation and legitimate interests.

Where we rely on consent (for example, where a partner has collected an end customer’s consent to verification), it can be withdrawn at any time, though this does not affect processing already done or processing we must continue for legal reasons. We do not sell personal data, and we do not use it for advertising.

We share personal data only as needed for the purposes above, with:

• Licensed payment and liquidity partners who hold funds and digital assets, provide virtual accounts, process payouts and execute stablecoin trades and transfers.
• Identity-verification providers who check BVN, NIN, identity documents and selfies, and screen against sanctions and other lists.
• Cloud hosting, infrastructure and email providers who store data and run our systems on our behalf.
• The partner whose end customer the data relates to, including verification results and transaction status.
• Professional advisers, such as lawyers, auditors and accountants, under a duty of confidentiality.
• Courts, regulators, law enforcement and other authorities when we are legally required to, or where it is necessary to prevent or report crime.
• A buyer or successor if our business is reorganised, merged or sold, subject to this policy.

Service providers who process data on our behalf may use it only on our instructions and must protect it.

Some of our service providers, and some payment and liquidity partners, are located or store data outside Nigeria. Cross-border payouts also require us to send the details needed to complete the payment to the destination country.

When we transfer personal data outside Nigeria we do so in line with the NDPA — for example, where the destination provides an adequate level of protection, under contractual safeguards, or where the transfer is necessary to perform a contract or a transaction you or your end customer have requested.

We keep personal data only for as long as we need it for the purposes in this policy.

• Identity, KYB/KYC and transaction records are kept for at least the period required by applicable anti-money-laundering law, which continues after an account is closed or an end customer stops using a partner’s service. We may keep them longer if they are needed for an investigation, a legal claim, or because a regulator or court requires it.
• Account data that is not subject to those duties, such as login credentials and API keys, is deleted or anonymised within a reasonable time after the account is closed.
• Logs and communications are kept for as long as they are useful for security, support and dispute handling, and then deleted or anonymised.

We use technical and organisational measures appropriate to the sensitivity of the data, including encryption in transit, hashed passwords, and access controls that limit staff access to those who need it.

No system is perfectly secure. Partners play a part too: keep API keys and webhook secrets confidential, and limit dashboard access. If we become aware of a personal data breach that is likely to put people at risk, we will notify the Nigeria Data Protection Commission and affected partners or individuals as the NDPA requires.

Subject to the conditions and exceptions in the NDPA, you have the right to:

• access the personal data we hold about you and get a copy;
• rectification — have inaccurate or incomplete data corrected;
• erasure — have your data deleted, unless we must keep it, for example to meet anti-money-laundering record-keeping duties;
• object to or ask us to restrict processing based on our legitimate interests;
• data portability — receive data you provided in a structured, commonly used, machine-readable format;
• withdraw consent where we rely on it;
• complain to the Nigeria Data Protection Commission (NDPC) if you are unhappy with how we handle your data. We would appreciate the chance to resolve your concern first.

To exercise a right, email [email protected]. We may need to verify your identity before acting on a request, and we will respond within the time the NDPA requires.

If you use a product or app built by one of our partners, that partner is your service provider and decides how your data is used to serve you. Please contact the partner first with any request about your data — they hold your account and can act on it most quickly.

If the partner cannot help, or your request concerns data we keep to meet our own legal obligations, you can contact us at [email protected]. Tell us which partner’s service you use so we can find your records. We may pass your request to the partner where it is theirs to decide.

The Dutchman Bridge dashboard does not use cookies for tracking, and we do not use analytics or advertising tools on it.

When you sign in, the dashboard stores a sign-in token and a note of your account type in your browser’s local storage. These keep you signed in and let the dashboard show the right screens. They are strictly necessary for the dashboard to work, are not shared with third parties, and are removed when you sign out. You can also clear them at any time through your browser settings, which will sign you out.

We may update this policy from time to time. We will post the new version on this page and update the “Last updated” date. If a change is significant, we will also notify partners through the dashboard or by email.

Dutchman Network Limited (RC No. 9031385), operator of Dutchman Bridge.

For privacy questions or to exercise your rights, email [email protected].