Privacy Policy

1. Overview and Scope

Bluebulb Financials Limited ("Bluebulb," "we," "us," or "our") respects your privacy and is committed to protecting the personal and corporate data of users accessing Orbita ("Platform").

This Privacy Policy explains how we collect, use, disclose, store, and protect your information when you access our Platform or use our treasury management, liquidity analytics, and cross-border payment tracking services.

This Policy applies to our global operations and adheres to applicable international data protection standards, including the Nigeria Data Protection Act 2023 (NDPA), the General Data Protection Regulation (EU) 2016/679 (GDPR), the UK GDPR, and other regional privacy frameworks applicable to users in international business corridors.

2. Roles Under Data Protection Laws

Bluebulb as a Data Controller

We act as a Data Controller for personal data collected during corporate account registration, account administration, regulatory KYB/KYC verification, website navigation, and relationship management.

Bluebulb as a Data Processor

When enterprise clients input operational, transactional, or beneficiary data into Orbita for treasury analytics, payment visibility, and cash flow tracking, Bluebulb acts as a Data Processor, processing such data strictly on the instructions of the Client (Data Controller).

3. Information We Collect

We collect personal and technical information necessary to provide enterprise treasury software and comply with global regulatory requirements:

Account Registration & Corporate Identification (KYC/KYB)

Name, business email address, corporate phone number, job title, company name, jurisdiction of incorporation, proof of identification (e.g., international passport, national ID), ultimate beneficial owner (UBO) identity documents, and corporate governance filings.

Financial & Operational Data

Bank account identifiers (IBANs, account numbers, SWIFT codes), transaction metadata, counterparty details, currency transaction values, FX exposure metrics, and liquidity data processed through the Platform.

Technical & Usage Information

IP addresses, account login details (passwords are stored only as secure hashes, never in plain text), device identifiers, browser type, operating system, access timestamps, API request logs, and platform usage analytics.

Communication Data

Information provided during customer support requests, security inquiries, or legal communications.

4. Legal Bases for Processing

We process your personal data relying on the following legal bases under applicable data privacy laws:

• Contractual Necessity: To register your account, provide access to Orbita, process transaction monitoring requests, and maintain core platform functionality.
• Legal and Regulatory Obligation: To comply with anti-money laundering (AML), counter-terrorist financing (CTF), Know Your Customer (KYC), tax reporting, and financial regulatory directives.
• Legitimate Interests: To secure our infrastructure, prevent fraud, optimize platform performance, conduct analytical research, and protect against legal claims.
• Consent: Where required by law (e.g., direct marketing or non-essential cookies).

5. How We Use Your Information

We use collected information to:

• Operate, maintain, and enhance the functionality of Orbita.
• Facilitate liquidity tracking, cross-border payment visibility, and FX operational workflows.
• Verify corporate identity and perform compliance, sanctions, and anti-fraud checks.
• Monitor transaction health, detect security anomalies, and prevent operational disruptions.
• Send essential technical, administrative, operational, and billing notices.
• Comply with regulatory reporting standards and respond to lawful governmental inquiries.

6. Disclosure of Information

We do not sell your personal or financial data. We disclose data only under strict confidentiality controls to:

• Regulated Banking & Financial Partners: Partner banks, financial institutions, payment gateways, and foreign exchange counterparties required to execute or settle cross-border transactions initiated or tracked via the Platform.
• Third-Party Service Providers: Trusted vendors providing cloud hosting (e.g., AWS, Azure), identity verification (KYC/KYB), security auditing, customer support, and IT system analytics.
• Regulatory Authorities & Law Enforcement: Central banks, financial intelligence units, data protection commissions, or judicial authorities where mandated by law or court order.
• Corporate Restructuring: Entities involved in mergers, acquisitions, asset sales, or corporate reorganizations involving Bluebulb, subject to non-disclosure obligations.

7. International Data Transfers

Because Orbita operates across international financial corridors, your information may be processed, transferred, or stored in jurisdictions outside your country of residence (including Nigeria, the EU, the UK, and other global operational hubs).

Where international data transfers occur, we enforce appropriate transfer mechanisms in accordance with global data protection laws, including:

• Transferring to countries recognized as having adequate data protection standards.
• Implementing Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTAs).
• Ensuring service providers apply technical safeguards including AES-256 encryption at rest and TLS 1.3 encryption in transit.

8. Data Security and Retention

Enterprise Security Controls

We enforce enterprise-grade technical and organizational measures, including multi-factor authentication (2FA), encryption of data in transit and at rest, role-based access control (RBAC), regular vulnerability scans, and continuous system monitoring.

Data Retention

We retain personal and corporate data for as long as your account remains active or as required to fulfill the business purposes outlined in this Policy. Financial records, compliance data, and KYC/KYB documents are retained for a minimum of five (5) to seven (7) years following account closure to comply with global AML and statutory obligations.

9. Your Privacy Rights

Depending on your jurisdiction, you have the following data protection rights:

• Access: Request access to a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete personal data.
• Erasure ("Right to be Forgotten"): Request deletion of your personal data, subject to statutory retention obligations.
• Restriction & Objection: Object to or request restriction of data processing under specific circumstances.
• Data Portability: Request transfer of your data to another controller in a structured, machine-readable format.
• Withdrawal of Consent: Withdraw consent where processing was based on consent, without affecting prior lawful processing.

To exercise these rights, contact our Data Protection Officer at [email protected].

10. Third-Party Links and Integrations

The Platform may link to or integrate third-party partner portals or APIs. We are not responsible for the privacy practices, APIs, or content of third parties. We encourage you to review their privacy policies prior to interacting with external integrations.

11. Updates to This Privacy Policy

We may update this Privacy Policy to reflect changes in legal, technical, or business developments. Updated versions will be posted on our website with a revised "Last Updated" date.

12. Contact Us

If you have questions or concerns regarding this Privacy Policy or our data practices:

Data Protection Officer
Bluebulb Financials Limited
Email: [email protected] / [email protected]