Privacy and Data Protection

Our privacy posture

Clearaccess is designed around privacy-by-design principles. Our product model is aligned with the Nigeria Data Protection Act 2023 and, where it applies, GDPR principles such as data minimisation, purpose limitation, retention limits, security, and accountability.

This is not a blanket legal-compliance certification. Each organization has its own operating context, lawful basis, vendors, retention obligations, and local procedures. Customers should use appropriate legal and privacy advice for their deployment.

Data responsibilities

An organization normally controls its members, visitors, access operations, and local devices. Clearaccess normally processes that operational data on its behalf, while independently handling its own account security, abuse prevention, and billing obligations.

Clearaccess does not sell visitor data. We publish the relevant hosting and subprocessor information for supported deployments and do not make unsupported data-residency promises.

Data minimisation and access records

Clearaccess is moving to a minimum-data access model: protected account-recovery contact details, a username, an organization-scoped member reference, assignment information only where needed, and the minimum auditable access decision. Gate staff should see only the information required to make or record a safe entry decision.

Organizations set operating policies and may shorten available retention periods. Rights requests, deletion, and retained access evidence are handled through the applicable organization and service process; access evidence may need to be retained in minimized form where an approved retention rule or legal hold applies.

Biometrics and identity evidence

Clearaccess does not market a generally available biometric or identity-document feature. Any future biometric verification or identity-evidence integration will be separately enabled, narrowly purpose-bound, subject to legal/privacy review, and designed so raw templates, images, identity documents, document numbers, and match scores do not enter Clearaccess.

Where approved, a local organization-controlled system performs one-to-one verification and sends Clearaccess only a minimal, authenticated outcome for audit and reconciliation. Face search, crowd identification, health inference, and other surveillance uses are out of scope.