Data Protection & Data Handling Policy

Document owner: Orbit360 Data Systems Ltd
Effective date: 1 November 2026
Version: 1.0
Review frequency: At least annually and whenever a material product, integration or processing change occurs.

01Purpose

This policy establishes the principles and operational requirements governing the collection, access, use, storage, sharing, retention and deletion of information processed through Orbit360.

It is intended to:

• Protect the personal information of Orbit360 users and their customers.
• Establish clear responsibilities for data handling.
• Support compliance with the Nigeria Data Protection Act 2023 and applicable data protection requirements.
• Guide the use of third-party services and integrations.
• Support secure handling of social media credentials and connected account information.
• Establish procedures for responding to data access, correction and deletion requests.
• Support platform reviews and third-party API compliance requirements, including LinkedIn.

02Scope

This policy applies to:

• Orbit360 Data Systems Ltd.
• Personnel and authorised contractors who access Orbit360 systems or customer information.
• Application infrastructure and databases.
• Social media and third-party integrations.
• AI-assisted features.
• Customer support and operational systems.
• Billing and payment infrastructure when activated.
• Information processed on behalf of Orbit360 customers.

03Data Protection Roles

Orbit360 may act in different capacities depending on the processing activity.

3.1 Data controller

Orbit360 acts as a data controller where it determines the purposes and means of processing information for its own business operations.

Examples include:

• User registration and account administration.
• Billing and subscription administration.
• Website analytics and platform security.
• Customer support and business communications.

3.2 Data processor

Orbit360 may act as a data processor when it handles personal information on behalf of a business customer.

Examples include:

• Managing social media messages for a customer.
• Processing customer-authorised social account information.
• Organising marketing content and customer campaign information.
• Processing uploaded customer files.
• Producing reports from customer-provided information.

In these circumstances, the customer may act as the data controller and Orbit360 must process information in accordance with documented customer instructions and applicable contractual obligations.

The specific roles must be assessed for each processing activity.

04Data Protection Principles

All processing must follow these principles:

1. Lawfulness, fairness and transparency: Information must be processed lawfully and users must understand how it is used.
2. Purpose limitation: Information must be collected for specific and legitimate purposes.
3. Data minimisation: Only information necessary for the relevant purpose should be collected.
4. Accuracy: Reasonable steps must be taken to keep information accurate.
5. Storage limitation: Information must not be retained longer than necessary.
6. Security and confidentiality: Information must be protected against unauthorised access, disclosure, loss or destruction.
7. Accountability: Orbit360 must be able to demonstrate its approach to data protection.

05Data Classification

Orbit360 information should be classified according to its sensitivity.

Restricted information must never be placed in public documentation, shared support responses or unsecured development environments.

06Collection and Use of Personal Information

Orbit360 must collect information only where it is reasonably necessary for a defined business or service purpose.

Every material processing activity should identify:

• The category of information.
• The individual or group the information relates to.
• The purpose of processing.
• The lawful basis.
• The systems and service providers involved.
• The authorised access roles.
• The applicable retention period.
• The deletion or disposal procedure.

New features must be reviewed before they introduce new categories of personal information or materially change existing processing.

07Access Control and Authentication

Access to Orbit360 information must be limited according to role and business need.

The following requirements apply:

• Users should only access workspaces and records they are authorised to access.
• Workspace and brand permissions must be enforced at the database and server levels, not only through the interface.
• Administrative access must be limited to authorised personnel.
• Privileged credentials must not be exposed to browser clients.
• Authentication credentials must not be shared between users.
• Access should be revoked when an individual's role or authorisation ends.
• Administrative and privileged actions should be logged where appropriate.

08Social Media Credentials and Integrations

Social media access tokens and other credentials must be treated as Restricted information.

Orbit360 must:

• Store credentials in appropriately protected server-side systems.
• Prevent ordinary users and browser clients from directly retrieving token values.
• Limit token access to the server operations that require them.
• Avoid placing tokens in logs, error messages or support records.
• Request only permissions required for enabled features.
• Provide a means of disconnecting third-party accounts.
• Revoke or invalidate credentials where supported when a connection is removed.
• Remove associated credentials when deletion is required.
• Review platform-specific terms and restrictions before enabling new integrations.

Each integration must have documented information covering the platform, permissions, data collected, purpose, storage location, retention and deletion behaviour.

8.1 LinkedIn-specific requirements

LinkedIn information must be handled in accordance with LinkedIn's applicable API Terms, developer documentation and data processing requirements.

Before accessing LinkedIn information, Orbit360 must provide the user with clear information about:

• The categories of LinkedIn information accessed.
• The purpose of accessing the information.
• Whether information is retrieved once or refreshed periodically.
• The features that use the information.
• How the user can withdraw authorisation.
• How the user can request deletion.

Users must provide valid affirmative authorisation before their LinkedIn information is accessed.

Orbit360 must:

• Use LinkedIn information only for authorised and approved use cases.
• Restrict access to the information to authorised operations.
• Avoid using LinkedIn information for unrelated advertising or independent profiling.
• Not sell or transfer LinkedIn information for unrelated purposes.
• Maintain appropriate safeguards for LinkedIn information and credentials.
• Delete LinkedIn-sourced information and relevant credentials when required by LinkedIn's terms, including upon a valid user deletion request or account closure, subject to applicable legal exceptions.
• Review changes to LinkedIn permissions and API requirements before deploying affected functionality.

Any material change in the scope of LinkedIn information collection or use must be assessed for notification and renewed consent requirements.

09AI and Automated Processing

AI features must only process information relevant to the feature being used.

Before introducing or materially changing an AI feature, Orbit360 should establish:

• The information sent to the AI provider.
• The purpose of processing.
• The identity of the provider or service.
• Whether prompts or outputs are retained.
• Whether information may be used for provider model improvement or training.
• Whether information is transferred outside Nigeria.
• Whether the feature produces decisions that materially affect individuals.

Customer information must not be submitted to an AI provider for unrelated purposes.

Where AI processing involves private messages, personal information or other potentially sensitive material, the feature should receive additional privacy and security review.

AI-generated outputs must not automatically be treated as verified facts.

10Third-Party Service Providers

Third-party providers must be assessed before they are introduced into Orbit360's production environment.

The assessment should cover:

• The service being provided.
• The categories of information shared.
• The purpose of processing.
• The provider's privacy and security arrangements.
• Data retention and deletion practices.
• International processing locations.
• Applicable contractual and data processing terms.
• Subprocessor arrangements.
• Security incident notification obligations.

Relevant providers may include hosting, authentication, file storage, email, AI, analytics, social media platforms, web research and payment services.

Where required, written data processing agreements and appropriate transfer safeguards must be established.

A current register of relevant service providers should be maintained.

11Payment and Financial Information

Payment functionality must not be activated for real transactions until a suitable payment provider and secure integration have been selected and reviewed.

The preferred implementation should use a provider-hosted checkout or secure payment fields so that full card numbers and CVV values are processed directly by the payment provider rather than stored or unnecessarily handled by Orbit360.

Orbit360 should retain only the payment information necessary for account administration, such as:

• Payment references.
• Transaction status.
• Subscription information.
• Card brand and masked details where provided.
• Billing contact and invoice information.

Full payment card numbers and CVV values must not be stored in Orbit360 application databases, logs, support records or analytics systems.

The payment provider must be assessed for security, privacy, data processing and applicable payment industry requirements before launch.

12Storage and Security

Personal information must be stored in approved systems with appropriate security controls.

Security requirements include:

• Secure authentication.
• Role-based access restrictions.
• Appropriate encryption in transit and at rest.
• Protection of sensitive credentials.
• Private storage for customer files.
• Appropriate session and access management.
• Monitoring and logging of relevant security events.
• Regular review of database permissions and application access.
• Secure management of secrets and environment variables.
• Backup and recovery arrangements.

Sensitive information must not be copied into personal devices, public repositories or unsecured documents.

13Data Retention

Orbit360 must maintain a documented retention schedule for major categories of information.

Retention periods should be based on business necessity, contractual requirements, legal obligations and platform-specific requirements.

The retention schedule should cover:

• User accounts and profiles.
• Workspace and team records.
• Social media credentials.
• Imported social content and messages.
• Posts and media.
• AI prompts and generated outputs.
• Support records.
• Billing and payment records.
• Authentication and security logs.
• Email queues and delivery records.
• Backups and archived information.

Expired records should not remain indefinitely merely because they are no longer visible in the application.

Retention jobs must be periodically reviewed to confirm that they execute successfully and cover the intended data stores.

14Data Subject Requests

Orbit360 must provide a process through which individuals can submit requests concerning their personal information.

Requests may include:

• Access to personal information.
• Correction of inaccurate information.
• Deletion of personal information.
• Withdrawal of consent.
• Restriction or objection to processing.
• Data portability where applicable.

Requests must be logged, assessed and handled within applicable legal timeframes.

Identity verification may be required before action is taken.

Where Orbit360 processes information on behalf of a customer, the request must be referred to the relevant customer where appropriate.

15Account and Workspace Deletion

Account and workspace deletion must be designed to consider all relevant data stores and relationships.

The deletion process should consider:

• User profile and contact information.
• Workspace memberships and role assignments.
• Connected social accounts and credentials.
• Google connections and imported information.
• Posts, media and assets.
• Comments, notes and historical versions.
• Inbox conversations and messages.
• AI outputs and cached information.
• Support and feedback records.
• Files held in application storage.
• Relevant third-party copies.
• Backups and retained operational records.

Deleting a user account must not unintentionally delete another customer's workspace or information belonging to other authorised users.

Where information must be retained for legal or security reasons, the reason and applicable retention period should be documented.

16Data Breach Management

Any suspected or confirmed incident involving unauthorised access, loss, alteration, disclosure or destruction of personal information must be escalated promptly.

The incident response process should include:

1. Identifying and containing the incident.
2. Assessing the information and individuals affected.
3. Preserving relevant evidence.
4. Determining the likely impact.
5. Taking corrective action.
6. Assessing notification obligations.
7. Notifying relevant authorities and affected individuals where required.
8. Recording the incident and lessons learned.

Personnel must not independently make public statements about a suspected incident without appropriate authorisation.

17International Data Transfers

Where personal information is processed or stored outside Nigeria, the relevant transfer must be assessed against applicable data protection requirements.

Orbit360 must maintain information about relevant processing locations, service providers and transfer safeguards.

18Responsibilities

Company management

Responsible for approving this policy, allocating resources and overseeing data protection responsibilities.

Product and engineering

Responsible for implementing access controls, secure integrations, data minimisation, retention mechanisms and deletion workflows.

Operations and customer support

Responsible for handling customer information appropriately, maintaining confidentiality and escalating privacy requests or incidents.

Authorised contractors

Must comply with confidentiality, access and data handling requirements applicable to their work.

19Policy Review and Updates

This policy must be reviewed:

• At least annually.
• When a new integration or data-processing feature is introduced.
• When a payment gateway is activated.
• When AI processing materially changes.
• When data storage or hosting arrangements change.
• When applicable laws or platform requirements change.
• Following a significant security or privacy incident.

Changes must be documented, approved and communicated to relevant personnel.