Aster Business Intelligence Limited (Aster BI, we, us or our) provides bookkeeping, financial management, reporting and business intelligence software for businesses in Nigeria. This Privacy Policy explains how we handle personal data through asterbi.com, app.asterbi.com and associated services and APIs. Personal data means information about an identified or identifiable individual.
We handle account administration, support, security and service improvement data as a data controller. Where a business uploads personal data about its customers, staff or suppliers and determines why it is used, that business may be the controller and Aster BI may process it on the business's instructions. The applicable role depends on the processing activity and any separate agreement.
Payment and wallet features connect users with third-party financial institutions or payment service providers. Customer funds are held by the relevant provider rather than Aster BI. Aster BI is not a bank and does not hold a CBN licence. This does not remove our responsibilities for personal data handled by our software. A provider's privacy notice also applies to its own processing.
Reading or acknowledging this Policy is not consent to every use of personal data. Where we rely on consent, it must relate to the particular purpose and you may withdraw it. Other processing may be necessary for a contract, a legal obligation or a legitimate interest as explained below.
Account and contact data include your name, email address, telephone number, address, account identifiers, credentials and communication preferences. Business records you provide may contain information about customers, staff or suppliers, including contact details, invoices, receipts, expenses and other bookkeeping records.
Payment and identity data may include bank account details, virtual account or wallet identifiers, payment amounts, dates, references, status and related records. Where required for a payment feature or provider verification, we may collect or receive your Bank Verification Number (BVN), National Identification Number (NIN), date of birth and verification results. These identifiers should only be supplied through the relevant account or verification process.
We retain and process bookkeeping and payment records in Aster BI's systems even when a provider holds the funds and executes the underlying transaction. Identity information submitted through an integrated feature may also be stored in the payment account record. Gateway processing does not mean that Aster BI stores no transaction or identity data.
Technical data may include your IP address, device and browser information, page visits, service activity, errors, diagnostic logs and cookies or similar identifiers. Support data include correspondence, complaints, feedback and information you provide when seeking help. Where an optional report or chat feature is available, we may process the questions and business information you submit to it.
We obtain data from you when you register, use a feature, upload records or contact us; from a business that gives you access or provides records about you; and from integrated providers that return account, verification or transaction information. Technical data may be generated as you use the service. If you provide another person's data, you must have a lawful basis to do so and provide them with the relevant information about its use.
Account administration and service delivery. We use registration details, business records and relevant payment information to create accounts, provide bookkeeping and reporting tools, manage access and carry out your service requests. The basis is performance of a contract with you, or steps you request before entering one. Where you act for a business and are not personally a party to that contract, our basis may be our legitimate interest in providing and administering the business's service, subject to your rights.
Payment feature integration and verification. We use the information needed to send your authorised instructions to a provider, receive the provider's results and record or reconcile transactions. Our basis is contractual necessity where applicable, or our legitimate interest in providing the requested business feature and preventing misuse. A specific legal obligation may also apply to Aster BI; a provider's own KYC duty does not automatically become our legal obligation. Where a provider or applicable law requires consent for a verification activity, that consent must be obtained through the relevant process.
Support and communications. We use contact details and correspondence to answer questions, handle complaints and send account, security or service notices. The basis is contractual necessity where applicable and our legitimate interest in resolving issues and keeping users informed. Promotional messages are separate from essential service notices; you can use an available unsubscribe link or contact [email protected] to object to direct marketing.
Security and service improvement. We use relevant activity and diagnostic data to identify misuse, investigate faults and improve reliability. Our basis is our legitimate interest in protecting users and operating the service, subject to a necessity and balancing assessment. Consent is required where the particular tracking or other processing requires it under applicable law. We do not treat acceptance of these terms as consent to optional tracking or advertising.
Legal obligations and claims. We may use or disclose necessary records to comply with a law that applies to us, a binding legal request or a court order. The basis is the relevant legal obligation. Establishing, exercising or defending legal claims may rely on our legitimate interests or another applicable legal basis.
You may ask us about the basis for a particular use. If we seek to use personal data for an additional purpose, we must assess the applicable legal basis and provide any required notice or consent request before doing so.
Relevant recipients may include the payment, banking and identity verification providers needed for a feature you choose; infrastructure and database providers; monitoring and support providers; and communication service providers. We provide information needed for the relevant purpose, rather than permission to use it for unrelated purposes.
Aster BI uses Kamatera for production hosting, Amazon Web Services RDS for databases and snapshots, and New Relic for monitoring. The providers used for a payment feature may change. Ask [email protected] for information about the providers relevant to your account or feature.
Optional analytics, messaging or AI features may involve additional providers when enabled. Before such processing, the feature information and applicable notice must identify the relevant use and any required choice. We do not grant third parties a general right to receive your personal data merely because their products might interest you.
We may share necessary information with professional advisers, competent authorities or parties to a legal claim where there is an applicable lawful basis. A merger, acquisition or other business transfer may involve records needed for the transaction, subject to applicable confidentiality and data protection requirements. Aster BI is responsible for its own handling of data; links to another site do not extend this Policy to that site's independent processing.
The service may use cookies or similar technologies to maintain sessions, support authentication, remember preferences and collect technical information. Google Tag Manager can load tags whose effects depend on their configuration; the presence of that tool does not itself describe every cookie or recipient.
Essential service functions and optional analytics or advertising must be distinguished. Where consent is required, optional processing must be subject to a valid choice before it starts and a means to withdraw that choice. You can also use browser controls to restrict cookies, although doing so may affect sign-in or other features. Contact us for information about the technologies used on the service.
A service provider may process or permit access to personal data outside Nigeria. The destination depends on the provider, selected region and support arrangements. Where a transfer occurs, Aster BI must establish a lawful transfer mechanism under the Nigeria Data Protection Act 2023 and applicable guidance, such as adequate protection or another permitted safeguard or exception.
Using the service or acknowledging this Policy does not constitute blanket consent to transfers to any country. Contact [email protected] to request information about the destinations and safeguards relevant to your data. A transfer relying on a specific consent exception requires the information and choice applicable to that transfer.
Personal data must be retained only for as long as necessary for its lawful purpose. Relevant considerations include whether your account and requested service remain active, whether records are needed for reconciliation or unresolved complaints, any specific statutory or contractual record requirement, and an existing legal claim or hold.
Account and business records, payment and verification records, support correspondence, security logs and backup copies can have different retention requirements. Closing an account does not automatically erase records that must lawfully be retained. When retention is no longer justified, data must be deleted or irreversibly anonymised. Backup expiry must be addressed separately from deletion of active records.
You may contact [email protected] for the retention information applicable to a particular category or to request deletion. Any lawful restriction on deletion and the reasons for retaining the relevant data must be explained in response to your request.
Aster BI uses account access controls, password hashing and operational monitoring to help protect the service. Security responsibilities include restricting access to personal data and assessing risks associated with the information and features involved. No internet service can guarantee absolute security.
Keep your credentials confidential and notify us promptly if you suspect unauthorised access. Do not send raw BVN, NIN or other sensitive identity information in an ordinary support email unless we have arranged an appropriate channel. A security incident involving personal data must be assessed for notification to affected individuals, the Nigeria Data Protection Commission and relevant partners where the applicable legal or contractual criteria are met.
Subject to the conditions and exceptions in applicable law, you may request information about processing and access to your data; correction of inaccurate or incomplete data; erasure or restriction; and data portability where applicable. You may object to processing based on legitimate interests and to direct marketing, and withdraw consent where consent is the basis. Withdrawal does not affect the lawfulness of processing before it was withdrawn.
You also have rights concerning qualifying decisions based solely on automated processing. If such a decision applies to you, contact us to request the information and safeguards provided by law. These rights do not imply that every report or automated calculation is a legally significant automated decision.
Send requests or privacy questions to [email protected], identifying the account and request. We may need proportionate information to verify identity and prevent disclosure to an unauthorised person. We must respond within the period required by applicable law and explain any lawful restriction or refusal. If the relevant business or provider is responsible for the processing, we will explain the appropriate route and assist where required.
Aster BI account holders must be at least 18. If you believe a child has opened an account or supplied data contrary to the service requirements, contact us. Records uploaded by a business may involve other individuals; the business must ensure a lawful basis and any additional protection required for children's data. We must assess and address children's information that reaches the service rather than assume it can never occur.
We may update this Policy to reflect changes to the service or applicable requirements. The published version will show its effective date, and we will provide notice of material changes through the website, the service or email as appropriate. An update cannot retrospectively supply consent or remove rights required by law.
Contact Aster Business Intelligence Limited at [email protected] about a privacy complaint. You may also complain directly to the Nigeria Data Protection Commission at ndpc.gov.ng or pursue another remedy available under law. You do not have to complete our internal complaint process before exercising a statutory right.