Legal Bases for Processing

We rely on different lawful bases for processing personal data depending on the purpose, including contractual necessity, legal obligation, legitimate interest, and consent, in accordance with the NDPA 2023.

Consent

Where required, consent is obtained through a clear affirmative action at sign-up or in account settings. Users are able to withdraw consent at any time, though withdrawal may affect certain optional features.

Performance of a Contract

We process your personal data where necessary to enter into and perform a contract with you. In particular, we use your information to:

• create and manage your user account;
• provide our tax calculation, preparation and filing services;
• provide customer support and communicate with you about our services; and
• process payments, issue invoices, and manage subscriptions.

What Personal Information We May Collect About You

Information You Provided Directly

• When you create an account, we collect your full name, email address, phone number, and business information where applicable.
• For tax-related purposes, we collect your TIN, income details, invoices, receipts, expense records, financial statements, and tax returns.
• When you integrate your bank account, we collect bank account numbers, account holder names, and financial statements.

Information We Collect Automatically

• When you link your email, we collect email metadata and extract invoice attachments and financial documents.
• Our platform automatically collects technical information including IP address, device type, operating system, browser type, and usage analytics.
• We use cookies and similar tracking technologies to enhance your experience.

Information from Third Parties

We may receive information about you from financial institutions, the NRS and other tax authorities, and payment processors where applicable.

How Do We Collect Your Data

The personal information we have about you is directly made available to us when you:

• Sign up on our web app;
• Use any of our services;
• Contact our customer support team;
• Fill out our online forms;
• Contact us.

The lawful bases we rely on for processing your personal information are:

• Your consent: Where you agree to us collecting your personal information by using our Services.
• Contractual obligation: Without your personal information, we cannot provide our Services to you.

How We May Use Your Personal Information

Primary Purposes

• We use your information to calculate tax liabilities, generate tax reports, prepare and file tax returns with NRS, and maintain compliance records.
• Our AI-powered platform analyzes financial documents, extracts invoice data from emails automatically, and identifies tax deductions and credits.
• For account management, we create and maintain your account, authenticate your identity, provide customer support, send service notifications, and process payments.

Secondary Purposes

• We analyze your information to improve our services, develop new features, conduct research, and improve AI model accuracy.
• We use your data to detect security threats, protect against unauthorized access, and verify user identities.
• To ensure legal compliance, we process your information to comply with tax laws, respond to regulatory requests, and maintain records as required by law.

Data Security and Retention

The security of your personal information is important to us. We maintain administrative, technical and physical controls designed to protect the personal information you provide against loss, theft, unauthorized access, disclosure, copying, misuse or modification.

We employ AES-256 encryption for data at rest and TLS for data in transit, advanced firewall protection, role-based access controls, multi-factor authentication for sensitive operations, and regular encrypted backups.

Where it is necessary to access third-party platforms, TaxStreem does not require users to share permanent login credentials where secure alternatives are available. Access is limited to the minimum scope necessary and may be revoked at any time.

We will only retain personal information for as long as reasonably necessary to provide services to you. Where required by law, tax records may be retained for up to six (6) years, after which data is securely deleted or anonymized.

Marketing

We may process your personal information to contact you or send you marketing content about our products and services. You may exercise your right to opt out at any time. If you opt out of marketing, we may still send you messages relating to transactions and our ongoing business relationship.

Your Data Protection Rights and Choices

Based on applicable laws, you have the following rights:

• Right to be informed;
• Right to request access to the personal information we hold about you;
• Right to request erasure of your personal information where the data is no longer required or processing has no legal justification;
• Right to correct or rectify inaccurate personal information;
• Right to object to the processing of your personal information for marketing purposes;
• Right to withdraw consent at any time, though this may affect service availability;
• Right to data portability where technically feasible;
• Right to complain to the Nigeria Data Protection Commission (complaints@ndpc.gov.ng).

We aim to respond to all privacy-related requests within thirty (30) days.

Cookies

Cookies are small text files stored on your device that help us provide and improve our services. We use essential cookies for platform functionality, performance cookies to understand user interactions, functional cookies to remember preferences, and analytics cookies to provide usage insights.

You may control cookies through your browser settings. However, disabling certain cookies may affect platform functionality.

Automated Processing

The platform has integrated AI for automated processing to support operational, security, and analytical functions. TaxStreem does not make decisions based solely on automated processing that produces legal or similarly significant effects on users without appropriate human involvement.

All tax calculations and filing outputs generated by automated systems are subject to user review and human oversight before submission to tax authorities.

You have the right to request human intervention or contest the outcome of automated processing by contacting us through the details provided in this Privacy Policy.

Minors

This website and applications are not directed at persons under the age of eighteen (18), and we do not collect any personal information knowingly from minors. If you believe TaxStreem has mistakenly collected information from a minor, please contact us immediately.

International Data Transfers

Currently, your data is stored and processed within Nigeria. If we transfer data outside Nigeria in the future, we will ensure adequate data protection safeguards, obtain your explicit consent, comply with NDPA requirements for cross-border transfers, and notify you of such transfers.

Third-Party Data Sharing

We do not sell personal data to third parties. Personal data may be shared with relevant tax authorities solely for the purpose of preparing, submitting, and filing tax returns, in accordance with applicable tax laws. Such disclosure is limited to the minimum data required and is carried out securely.

Updates to Our Privacy Policy

From time to time, we may change, amend, or review this privacy policy to reflect new services or changes in our practices. All changes will be posted on this page, and where changes materially affect you, we will notify you by placing a notice online or via email. Your continued use of our services constitutes your acceptance of any amendments.

Contact Us

All access requests, questions, comments, complaints, and other requests regarding data privacy should be sent to dpo@taxstreem.com.

We may request additional details from you regarding your complaints and keep records of your requests and their resolution.