Privacy Policy

1 Who We Are

Resman Technologies Ltd ("Resman", "we", "us"), a Nigerian private company limited by shares and a wholly-owned subsidiary of Wonderwise Productions Ltd, operates the Resman platform at app.resman.ng, the marketing site at resman.ng, and the customer storefront network at shop.resman.ng.

For personal data we collect about our own account holders, site visitors, and prospects, Resman is the Data Controller. For personal data uploaded by business customers into their Resman workspaces (e.g., data about their staff, guests, or end customers), those business customers are the Data Controllers and Resman is the Data Processor.

Our Data Protection Officer (DPO) can be reached at [email protected].

2 Scope of This Policy

This policy covers personal data processed through:

• The Resman marketing website (resman.ng);
• The Resman application (app.resman.ng);
• The Resman online storefronts (shop.resman.ng);
• Any of our APIs, integrations, emails, and support channels.

It does not cover the independent privacy practices of third-party services linked from the platform (e.g., Paystack, Google, Resend) — those have their own policies.

3 Data We Collect

3.1 Identity & account

• Full name, email address, phone number, profile photo (optional);
• Business name, business type, address, currency, timezone;
• Role, permissions, and unit (branch) assignments;
• Google OAuth profile (name, email, Google ID) where you sign in via Google;
• Hashed passwords, OTPs, verification and reset tokens.

3.2 Business & operational

• Sales, bills, orders, transactions, payments, discounts, and charges;
• Products, menu items, stock, variants, categories, suppliers;
• Purchase orders, expenses, taxes, and accounting transactions;
• Rooms, bookings, guests, and hotel service records;
• Staff records you choose to manage through the platform;
• Customer / guest names and contact details you enter for delivery, bookings, or loyalty.

3.3 Payment & billing

• Subscription plan, renewal dates, invoices, and billing history;
• Paystack transaction references, statuses, and basic metadata;
• We do not store full card numbers, CVVs, or sensitive authentication data. Card data is tokenised and handled by Paystack under PCI DSS.

3.4 Technical & usage

• IP addresses, device type, browser, OS, locale;
• Pages viewed, features used, timestamps, error logs, API logs;
• Activity / audit logs capturing who did what, when, and from which IP;
• Notification preferences.

3.5 Communications & support

• Emails, support tickets, replies, and any attachments you send;
• Feedback, survey answers, and testimonials.

3.6 Referral programme

• Your referral code, the code you used on sign-up, and the referral relationships needed to track rewards.

3.7 Marketing

• Records of marketing consents and opt-outs;
• Limited analytics about email delivery/open/click where we use tracked campaigns.

3.8 Categories of data we do NOT want

Do not upload special-category data (e.g., health, biometric, religious belief, political opinion, trade-union membership, sexual orientation) unless it is strictly necessary for your business (e.g., hotel passport-page scans where local law requires) and you have a lawful basis. If you do, you accept responsibility for that processing and must warn End Customers accordingly.

4 How We Use Your Data

We do not sell identifiable personal data. We may, however, (a) use aggregated or anonymised data derived from your use of the Service to improve the Service, train our own machine-learning models, and publish aggregated market insights; and (b) in future, sell aggregated, anonymised market reports. "Aggregated or anonymised" means processed so that the data no longer identifies, and cannot reasonably be used to identify, you, your staff, your End Customers, or your specific business records. We never sell your customer lists or your sales records as such. See Section 11 for the full Resman-model-training position and your opt-out.

5 Legal Basis for Processing (NDPA)

• Performance of a contract — providing the Service you subscribed to.
• Legitimate interests — security monitoring, fraud prevention, service improvement, and modest direct marketing to existing customers (balanced against your rights).
• Legal obligation — keeping records for Nigerian tax, AML, and corporate law (e.g., FIRS record-keeping).
• Consent — newsletters, optional features, non-essential cookies, and any processing for which consent is the correct basis. You can withdraw consent at any time, without affecting prior processing.
• Vital interests / public interest — only where applicable and narrowly, such as responding to a lawful order.

6 Sharing & Sub-Processors

We never sell personal data. We share it only as follows:

6.1 Sub-processors

Vetted vendors that help us run the Service under written data-processing terms and confidentiality obligations. Our current sub-processors include:

We may update this list. Material changes are notified by email to the Owner at least 14 days in advance, giving you an opportunity to object on reasonable grounds.

6.2 Legal / regulatory

We may disclose data where required by Nigerian law, a binding order, or a lawful request from NDPC, FIRS, EFCC, or another competent authority. We will notify affected customers where legally permitted.

6.3 Business transfers

If Resman is involved in a merger, acquisition, reorganisation, insolvency, or asset sale, personal data may be transferred to the successor entity under the same protections as this policy, and we will give you 30 days' notice before a different policy governs your data.

6.4 With consent

Any other sharing only with your prior consent.

7 International Transfers

Some sub-processors operate servers outside Nigeria. Where we transfer personal data abroad, we rely on an NDPC-recognised lawful mechanism — a relevant adequacy decision, standard contractual clauses, binding corporate rules, explicit consent where appropriate, or derogations permitted by the NDPA. You may request a copy of the transfer safeguard used for your data by emailing [email protected].

8 Data Retention

• Active accounts: retained for the life of the account;
• Closed accounts: Customer Data kept for up to 90 days after closure for reactivation or export, then deleted or anonymised;
• Financial records: retained for up to 7 years to meet Nigerian tax and corporate-law obligations;
• Security & audit logs: up to 12 months, then deleted;
• Backups: aged out on the normal backup rotation (typically within 90 days);
• Marketing preferences & opt-outs: retained while they remain relevant so we can honour them.

9 Security

We use industry-standard technical and organisational measures including:

• HTTPS/TLS for all traffic in transit;
• Passwords hashed with modern algorithms (e.g., bcrypt) — never stored in plaintext;
• JWTs with server-side revocation (token versioning) and short lifetimes;
• Role-based access control enforced at every API endpoint;
• Multi-tenant isolation at the query layer (all queries scoped by company);
• Activity / audit logs that track every significant action;
• Restricted database access and least-privilege operational accounts;
• Malware monitoring on production infrastructure;
• Secrets stored outside version control and rotated as needed.

No system is perfectly secure. You must help by using strong passwords, protecting PINs and tokens, enabling 2FA where offered, and notifying us immediately of suspected compromise.

10 Cookies & Tracking

See our Cookie Policy for the full list. In short: the marketing site uses only privacy-preserving analytics; the application uses strictly necessary cookies and local storage for authentication and UI preferences. We do not use advertising or cross-site tracking cookies.

11 Automated Processing, AI & Model Training

Some features use automated processing or AI models, including:

• AI Review Assistant — summarises your business performance and answers questions about your data;
• AI-assisted menu import — parses uploaded menu images / PDFs into structured products.

These features do not carry out automated decisions that produce legal effects concerning you or similarly significantly affect you within the meaning of the NDPA.

11.1 Third-party AI providers

When you invoke an AI feature, the minimum necessary data is sent to the relevant third-party AI sub-processor (see Section 6.1) solely to generate your response. These providers are contractually prohibited from using your data to train their own models.

11.2 Resman's own model training (anonymised only)

We may use aggregated or anonymised data derived from your use of the Service to:

• improve the Service (bug fixing, performance, product direction);
• train and fine-tune our own machine-learning models;
• produce aggregated market insights (e.g., category trends, occupancy benchmarks).

"Aggregated or anonymised" means the data has been processed so it no longer identifies, and cannot reasonably be used to identify, you, your staff, your End Customers, or your specific business records. We do not train our own models on identifiable personal data.

11.3 Your opt-out

You can disable AI features entirely from your settings. You can additionally opt out of having your anonymised data contribute to Resman's own model training by emailing [email protected]. Opting out of training does not disable the AI features — it only removes your anonymised data from our training set.

11.4 No sale of identifiable data

We do not sell identifiable Customer Data, your customer lists, your sales records, or any personal data of your staff or End Customers. We may, in future, publish or sell aggregated, anonymised market reports that contain no personal data.

12 Your Rights

Under the NDPA you have the following rights regarding your personal data:

• Access — a copy of the personal data we hold about you;
• Rectification — correct inaccurate or incomplete data;
• Erasure — deletion, subject to legal retention exceptions;
• Restriction — pause processing during a dispute;
• Portability — receive your data in a structured, commonly used, machine-readable format;
• Object — to processing based on legitimate interests, including direct marketing;
• Withdraw consent — at any time without affecting processing done before withdrawal;
• Complain — to the Nigeria Data Protection Commission at ndpc.gov.ng.

Many rights can be exercised self-service from the app (export, profile update, marketing preferences, account deletion request). For anything else, email [email protected]. We aim to acknowledge within 48 hours and resolve within 30 days. If you are acting on behalf of an End Customer whose data lives in a business customer's workspace, please contact that business first — they are the Controller.

13 Children

The Service is intended for business use by adults aged 18+. We do not knowingly collect personal data from children. If you believe a child's data has reached us, email [email protected] and we will delete it promptly.

14 Data Breach Notification

In the event of a personal-data breach likely to result in a risk to the rights and freedoms of individuals, we will notify the NDPC and affected users without undue delay and in any case within 72 hours of becoming aware, as required by the NDPA. Notifications will describe the nature of the breach, likely consequences, and the measures we have taken or propose to take.

15 Changes to This Policy

We may update this policy from time to time. When we do we will update the version number and date at the top. For any material change we will give at least 14 days' advance notice to Owners by email or in-app notice. Where a change requires your renewed consent, we will ask for it in-app before continued processing.

16 Contact & Data Protection Officer

• Controller: Resman Technologies Ltd (a subsidiary of Wonderwise Productions Ltd)
• DPO: [email protected]
• General: [email protected]
• Address: Abuja, Federal Capital Territory, Nigeria
• Regulator: Nigeria Data Protection Commission — ndpc.gov.ng