ePoynt Privacy Policy

Last updated: 19 Jul 2026 Controller: ePoynt Technologies Ltd (RC 9009902), Abuja, Nigeria Scope: All ePoynt products — TaxPoynt, PoyntBooks, FleetPoynt, JurisPoynt and labPoynt.

This policy explains how ePoynt Technologies Ltd handles personal data across every product we operate. Where a product processes a materially different category of personal data, it carries its own notice that adds to this one — see section 10.

1. Our role

For most of what we hold, you are the data controller and we are your processor: the records you or your organisation put into an ePoynt product are yours, and we process them to deliver the service you have contracted for. We act as a controller in a narrow set of cases where the law requires it — account administration, billing, security and fraud prevention.

2. What we collect

Account data. Name, email address, organisation details, role, and authentication data. Passwords are stored only as one-way hashes. Where multi-factor authentication is enabled, the secret is encrypted at rest and backup codes are stored hashed.

Operational data. The business records you create in the product. What this contains differs by product — invoices and tax fields in TaxPoynt, ledger and banking records in PoyntBooks, vehicle and driver records in FleetPoynt, case records in JurisPoynt — and the product notices describe each.

Technical data. Server and application logs, request and trace identifiers, and limited device metadata, kept for security, debugging and abuse prevention. Logs are redacted: secrets, credentials and cryptographic keys are never written to them.

Billing data. Where you pay by card, payment is handled by our payment provider. We receive a transaction reference and status. We do not receive or store your card number.

3. Why we process it

To deliver the service you have contracted for.
To keep it working and secure — monitoring, alerting, incident response and support.
To meet legal and regulatory obligations, including tax-authority requirements where a product carries them.
To bill you, and to prevent fraud and abuse.

We do not sell personal data. We do not use your operational records to build advertising profiles, and we do not use one customer's data to serve another.

4. Legal basis (NDPR)

We process personal data on the basis of contract performance (delivering the service), legal obligation (regulatory and tax duties), and legitimate interest (security, fraud prevention and keeping the service reliable), as those bases are set out in the Nigeria Data Protection Regulation. Where we rely on consent, you may withdraw it at any time.

5. Sharing and subprocessors

We share personal data only with subprocessors needed to run the service — cloud infrastructure, object storage, email delivery, payment processing and observability — each engaged under terms requiring appropriate security and confidentiality. A current subprocessor list is available on request and forms part of your agreement.

We disclose data to a public authority only where legally compelled, and we will tell you unless we are prohibited from doing so.

6. Where your data is held

ePoynt runs on managed cloud infrastructure outside Nigeria. Application servers and our databases — including your register and its audit trail — run in Singapore. Stored documents, such as scanned receipts, certificates and statutory papers, are held in object storage under an EU jurisdiction restriction that keeps those objects in EU data centres. Encrypted backups of our databases are held in separate object storage under the same EU jurisdiction restriction, so a complete copy of your register and its audit trail is kept in EU data centres as well as in Singapore. A small number of legacy organisation logos remain in a United States bucket from an earlier deployment. We do not currently offer hosting inside Nigeria.

Because we are a Nigerian company processing data outside Nigeria, this is a cross-border transfer under the NDPR. It is governed by our data-processing terms, which impose contractual safeguards on every subprocessor. Exact regions are available on request for your due-diligence file.

7. Security

Data is encrypted in transit with TLS, and at rest by our storage providers. Access is scoped to your organisation, role-based within it, and least-privilege for our own staff. Critical actions are written to audit trails that are appended to and never rewritten. Sensitive credentials are encrypted with a dedicated key, held separately from authentication secrets.

8. Retention

We retain personal data for as long as needed to provide the service, and afterwards only as required by law, regulation or your contract.

Several ePoynt products keep append-only registers — records corrected by cancellation rather than deletion, so that an audit trail remains intact. Where that applies it is described in the product notice, and it affects how erasure requests can be satisfied (see section 9).

On termination, data is returned or deleted in line with your agreement, subject to any legal hold or statutory retention we are bound by.

9. Your rights

Under the NDPR you may request access to your personal data, correction of it, erasure, restriction of processing, or portability, and you may object to processing. Contact us at info@epoynt.com and we will respond within the period the regulation allows.

Two practical notes, so the answer is not a surprise:

Where you are our customer's employee, driver or client, we are usually the processor, not the controller. Send your request to the organisation that holds the record — we will help them fulfil it.
Where a record sits in an append-only register or is subject to a statutory retention duty, we may be unable to delete it outright. We will tell you which applies and what we can do instead, such as restricting processing.

10. Product notices

Products whose data differs materially from the above carry their own notice, to be read together with this one:

FleetPoynt — vehicle, driver and movement records: /legal/privacy/fleetpoynt
TaxPoynt — e-invoicing (SI, AP and Hybrid services): section 11 below

Other products are covered by this policy alone.

11. TaxPoynt (SI, AP and Hybrid services)

TaxPoynt transmits fiscal documents between your systems and the Nigerian Revenue Service. In addition to the above:

What it holds: invoices and the business, financial and party fields required to generate an IRN and QR stamp, validate a document and route it — including counterparty identifiers such as a TIN, and buyer contact details where the document carries them.
Why: to deliver contracted e-invoicing services and to meet the tax authority's requirements. Regulatory obligation is the operative basis for much of this processing — a field the authority requires is not one you can opt out of.
Who it goes to: the Nigerian Revenue Service, as the service is designed to do, plus subprocessors under section 5.
Retention: invoices and their transmission evidence are retained for the period the tax authority requires, which may exceed the life of your account.
Credentials: tax-authority API credentials and connector configuration are encrypted at rest with AES-256-GCM under a dedicated key.

TaxPoynt-specific privacy questions may also be sent to support@taxpoynt.com.

12. Children

Our services are business tools and are not directed to children. We do not knowingly process children's data.

13. Changes

We will update this policy when our processing changes, and the "last updated" date above will move. Material changes will be notified to account administrators.

14. Contact

Privacy questions, or to exercise a right: info@epoynt.com ePoynt Technologies Ltd (RC 9009902), Abuja, Nigeria.