Owena (“we”, “us”) is a product of OWENA HQ LTD, a company registered in Nigeria (RC 9695072). This policy explains what personal data we collect, why, and the rights you have over it. It covers our websites (owenahq.com and subdomains) and the Owena application. We are the data controller for the data described here, except where we process your business’s records on your instructions — there, your business is the controller and we are its data processor.
Questions or requests: admin@owenahq.com.
1. What we collect
- Account data — your name, email address, and phone number when you create an account, join a workspace, or sign up for early access.
- Business data you bring — information about your business (including registration details you submit for verification), your team members, contractors, and clients, and the working records your business keeps in Owena: projects, documents, invoices, quotes, and messages.
- Financial records — invoices, recorded payments and payouts, and — only if you connect it or upload it yourself — bank-statement data used for reconciliation. Bank connections run through licensed, regulated data providers with your explicit consent; we never see or store your bank login credentials.
- Identity-verification data — where you choose to verify your business or enable payment-connected features, verification identifiers (such as BVN, NIN, or corporate registration numbers) are checked against official registries through licensed verification providers. We store the verification result; we do not build databases of identity numbers beyond what verification and the law require.
- Technical data — device and log information (IP address, browser, pages viewed) and cookies needed to keep you signed in and the product working. We do not run third-party advertising trackers.
2. Why we process it (lawful bases)
- To provide the service (contract): accounts, workspaces, documents, reconciliation, notifications.
- To meet legal obligations: identity verification, anti-money-laundering compliance, statutory record-keeping, tax.
- Legitimate interests: securing the platform, preventing fraud and abuse, understanding aggregate product usage, and communicating service matters.
- Consent: marketing emails (every one carries an unsubscribe link that works), bank-data connections, and any optional feature that asks first. Consent can be withdrawn at any time.
We do not sell personal data. We do not use your business’s records to advertise to your clients or contractors.
3. Who we share it with
- Service providers that run our infrastructure — cloud hosting, database, email delivery, payment and banking partners, and identity-verification providers — each a regulated or contractually bound processor, engaged only to provide their function.
- Licensed financial institutions, where you use payment-connected features: the institution holds its own regulatory relationship with you, including its own KYC obligations.
- Regulators and law enforcement, where the law requires it — including the Nigeria Data Protection Commission, the Nigerian Financial Intelligence Unit, and other competent authorities acting on lawful requests.
- Within your workspace: what your teammates see is governed by your workspace’s roles. Payment amounts and statuses are visible only to the workspace owner and the payment’s recipient — money details never appear on team-wide surfaces.
4. Where it lives
Our infrastructure is provided by international cloud providers, and some data is stored outside Nigeria (currently within the European Union) under contractual safeguards consistent with the Nigeria Data Protection Act 2023.
5. How long we keep it
- While your account or workspace is active — for as long as you use Owena.
- After deletion — you can delete your account or your entire workspace yourself, in the product, at any time, and deletion is never conditional on payment. Deletion permanently removes your data from the product. One exception, stated plainly: a sealed copy of a deleted workspace’s financial records is retained for five years, because Nigerian anti-money-laundering law requires it. That copy is never visible in the product, is never used for any business purpose, and is opened only on a lawful request from a competent authority — and every access to it is itself permanently logged.
- Operational logs are kept for short, rolling windows.
6. Your rights
Under the Nigeria Data Protection Act 2023 you can:
- Access and export your data — the workspace export (Settings → Export & deletion) gives you everything in one portable file, self-serve.
- Correct inaccurate data — most of it directly in the product.
- Delete your account or workspace — self-serve, as described in Section 5, subject only to the statutory retention described there.
- Withdraw consent — unsubscribe links, disconnecting bank feeds, or writing to us.
- Object or restrict certain processing, and complain to the NDPC (ndpc.gov.ng) if you believe we’ve fallen short — though we’d ask for the chance to fix it first: admin@owenahq.com.
We respond to rights requests within the timelines the NDPA sets.
7. Security
Access to production data is restricted and role-based; every business’s data is isolated by row-level security; financial records are append-only by design (they cannot be silently edited); administrative and compliance access is logged in a tamper-evident audit trail; and connections are encrypted in transit.
8. Who Owena is for
Owena is a business tool for people aged 18 and over. We do not knowingly collect data from children.
9. Changes
We’ll post changes here with a new “last updated” date, and notify account holders of material changes by email before they take effect.
OWENA HQ LTD · RC 9695072 · admin@owenahq.com