Draft — pending sign-off by the Data Protection Officer. This notice is not yet final.

Privacy notice (draft)

How CSCS MarketSphere processes personal data. This is a plain summary of the platform's Record of Processing Activities (document CSCS-MS-GOV-ROPA-001, last reviewed 27 September 2026), prepared under the Nigeria Data Protection Act 2023. Where that record marks a lawful basis, role, transfer or retention period as not yet confirmed, this notice says so.

Who is responsible

Central Securities Clearing System Plc (CSCS) is the controller. The roles below are proposals, to be confirmed in data processing agreements; those agreements are a precondition for production use.

Central Securities Clearing System Plc (CSCS): Controller: decides the purposes and means of processing.
DAALITech: Processor: application support and deployment on CSCS's instructions.
AutoAI Labs: Processor (or sub-processor to DAALITech; to be confirmed): builds and maintains the application.
Microsoft (Azure, Azure OpenAI, Microsoft Clarity if enabled): Sub-processor: hosting, database, storage, AI model inference, product analytics.
Brevo: Sub-processor: account and newsletter email.
Stripe: Sub-processor or independent controller for card data (to be confirmed): USD payments.
Paystack (a Stripe company): Sub-processor or independent controller for card data (to be confirmed): NGN payments; possible onward transfer to the United States (to be confirmed).
GitHub (Microsoft): Sub-processor: source code hosting. It must never hold personal data.

What we process and why

Each activity below lists its purpose, the proposed lawful basis (to be confirmed by the Data Protection Officer where marked), whose data it is, what data, who receives it, transfers outside Nigeria, and how long it is kept.

PA-01Market data ingestion and display

Purpose: Provide capital-market information (prices, securities, trading activity, analytics) to CSCS and market participants.
Lawful basis: Legitimate interest / public-interest function of the depository (to be confirmed). The market data itself is largely not personal.
Whose data: Investors whose trades appear in CSCS Trade Activity.
Data: Public market data; sensitive personal financial data in Trade Activity (CHN, account number, account name).
Recipients: Signed-in users according to their role. Investor identity is shown only to surveillance roles, as tokens in production.
Outside Nigeria: The hosting region of the Azure environment (to be confirmed for CSCS environments).
Kept for: The latest complete data pull only.

PA-02Market surveillance and ownership analytics

Purpose: Detect market-integrity patterns, ownership concentration and flows; open and manage integrity cases.
Lawful basis: Legal obligation or public task of CSCS as a market infrastructure (to be confirmed).
Whose data: Investors and account holders in Trade Activity.
Data: Sensitive personal financial data (as tokens); confidential commercial data about dealing members.
Recipients: Super Admin, Senior Analyst and Auditor/Regulator roles (tokens). Other paid users see masked aggregates.
Outside Nigeria: As for market data. AI narratives are built from identity-free evidence (see the AI assistant below).
Kept for: Alerts are computed on request; cases follow the CSCS surveillance policy (to be confirmed).

PA-03Investor identity lookupsFind Investor enrichment: off

Purpose: Look up an investor's trades and holdings by CHN for surveillance. Optional enrichment with the investor profile ("Find Investor") is switched off.
Lawful basis: To be confirmed by the Data Protection Officer. Available to surveillance roles only; the Find Investor enrichment stays off until CSCS confirms entitlement and lawful basis.
Whose data: Investors.
Data: Sensitive personal financial data (tokens in production).
Recipients: Super Admin, Senior Analyst and Auditor/Regulator roles.
Outside Nigeria: As for market data.
Kept for: Not stored: computed on request and never saved.

PA-04User accounts and sign-in

Purpose: Create and secure user accounts, sign-in, sessions and organisation seats.
Lawful basis: Contract.
Whose data: Users: staff of CSCS, market participants and individual subscribers.
Data: Name, email, organisation, password hash, IP address at sign-in; session tokens and one-time codes.
Recipients: You; administrators; Brevo (verification and invitation emails).
Outside Nigeria: Azure region (to be confirmed); Brevo (EU, to be confirmed).
Kept for: Life of the account plus 12 months (proposed).

PA-05KYC and KYB onboarding

Purpose: Verify individual users (KYC) and organisations (KYB) before granting access to regulated data.
Lawful basis: Legal obligation (AML/CFT) or contract (to be confirmed).
Whose data: Individual users; directors and stakeholders of organisations.
Data: Legal name, date of birth, address, ID number (stored as its last 4 digits plus a keyed hash), identity documents.
Recipients: CSCS administrators who decide the case; the CSCS company-search service for KYB checks (planned).
Outside Nigeria: Azure region (to be confirmed).
Kept for: 5 years after the relationship ends (proposed; to be confirmed).

PA-06Subscriptions and payments

Purpose: Sell plans, take payment, issue receipts, manage renewals and cancellations.
Lawful basis: Contract; legal obligation for financial records.
Whose data: Paying users.
Data: Name, email, plan, amounts and payment-provider references. Card details are typed into the payment provider's own form (Stripe's embedded Payment Element, or Paystack's Inline popup), which sends them to the provider; the application's code does not receive or store card numbers (pending DPO review).
Recipients: Stripe (USD payments), Paystack (NGN payments), Brevo (receipts).
Outside Nigeria: Stripe (United States / EU, to be confirmed); Paystack (to be confirmed); Brevo (EU, to be confirmed).
Kept for: 6 years (proposed; tax and company law, to be confirmed).

PA-07Email: account messages and the Daily Brief

Purpose: Send account, KYC, payment and security emails, and the Daily Intelligence Brief to subscribers.
Lawful basis: Contract for account emails; consent with double opt-in for the Daily Brief.
Whose data: Users; Daily Brief subscribers.
Data: Email address and name.
Recipients: Brevo.
Outside Nigeria: Brevo (EU, to be confirmed).
Kept for: Subscribers until they unsubscribe plus 30 days; send log 12 months (proposed). Every brief carries an unsubscribe link.

PA-08AI assistant (SIMBA) and AI narratives

Purpose: Answer your questions about the market and the platform, and write narratives on computed facts.
Lawful basis: Contract (paid features) / legitimate interest (to be confirmed).
Whose data: Users who type questions. Your free text may contain personal data.
Data: Your question text and the history of chats you save; market facts. The design sends no investor identity to an AI model (per the Record; pending DPO review).
Recipients: Azure OpenAI deployments in the CSCS or DAALITech Azure tenant.
Outside Nigeria: Question text leaves Nigeria: the Azure OpenAI resource used today is in Sweden Central, and a global deployment may process in other regions. The transfer basis is to be confirmed before go-live.
Kept for: Saved chats 12 months after last activity (proposed). Question audit records: target 90 days.

PA-09Secure Trade Chat

Purpose: Messaging and expressions of interest between market participants. No trades are executed.
Lawful basis: Contract.
Whose data: Staff of participating firms.
Data: Sender identity and message content.
Recipients: Members of the thread only.
Outside Nigeria: Azure region (to be confirmed).
Kept for: To be set by CSCS compliance.

PA-10Developer API and MCP access

Purpose: Let subscribing organisations use MarketSphere data in their own systems and AI agents.
Lawful basis: Contract.
Whose data: Investors (masked tokens only); API users.
Data: Public market data; masked commercial data; tokens for identity-derived analytics.
Recipients: The customer's own systems, including AI agents the customer chooses.
Outside Nigeria: Wherever the customer runs its systems, governed by the API terms.
Kept for: Outside MarketSphere's control once delivered; the API terms must require deletion and forbid re-identification.

PA-11Security monitoring and audit

Purpose: Protect accounts and data: lockouts, anomaly detection (for example impossible travel) and an audit trail.
Lawful basis: Legitimate interest / legal obligation for security of processing (to be confirmed).
Whose data: Users.
Data: Username, organisation, IP address, approximate location and the action taken.
Recipients: Administrators with the audit permission; Azure OpenAI for a security review narrative (to be pseudonymised). Sign-in location is resolved on the platform, to country level only; your IP address is not sent to any geolocation service.
Outside Nigeria: Azure OpenAI region (to be confirmed).
Kept for: IP address and location 90 days; audit events 13 months; security archive 5 years (proposed).

PA-12Product analytics (Microsoft Clarity)Not active

Purpose: Understand how screens are used, to improve them.
Lawful basis: Consent: opt-in, withdrawable. The banner wording is to be approved by the Data Protection Officer.
Whose data: Visitors and users who opt in.
Data: Interaction data (the Record proposes all text masked). Clarity does not run on the screens listed under Analytics cookies below.
Recipients: Microsoft (Clarity).
Outside Nigeria: Outside Nigeria (Microsoft; to be confirmed).
Kept for: Per the Clarity project settings, shortest available (to be confirmed).

PA-13Operational telemetry

Purpose: Run the service: logs, metrics, traces and alerts.
Lawful basis: Legitimate interest (to be confirmed).
Whose data: Users (user ids appear in logs).
Data: Technical data and user ids. By design no email addresses, identity values or secrets.
Recipients: Azure Monitor / Application Insights in the CSCS tenant; the on-call team.
Outside Nigeria: Azure region (to be confirmed).
Kept for: 30 days today; target 90 days.

Analytics cookies

MarketSphere can use Microsoft Clarity to see how pages are used. It is off unless two things are true: the platform has been configured with a Clarity project, and you have pressed “Accept analytics” on the cookie banner. Until then the Clarity script is not loaded at all. Rejecting does not change any feature.

When you accept, we tell Clarity that analytics storage is granted and ad storage is denied. Your choice is remembered in your browser (local storage and a first-party cookie named cscs_consent) for 180 days from when you chose; after that it is treated as no choice and you are asked again. You are also asked again if what we ask consent for changes.

Clarity is never loaded on these pages, whatever you chose, and if it is already running it is stopped when you open one of them: /kyc, /admin, /ops, /billing, /profile, /developer, /securechat, /sentinel, /simba, /actions, /analytics (every page under each of these). It is also stopped while the sign-in or sign-up window, the checkout or card-update window, a security's detail drawer, or a signed-in persona dashboard on the home page is open, and started again only when you are back on another page with consent still given.

On the pages where it can run, form fields, persona dashboards and screens that show investor, holder, CHN or broker details are marked to be masked, so their content is not recorded. Clarity also masks form input by default.

You can withdraw at any time from “Cookie settings”. Withdrawing stops Clarity, tells it consent is denied, erases its cookies and reloads the page so the script is gone. A withdrawal made in one browser tab takes effect in your other open tabs of MarketSphere as well.

Your rights

Requests are received by CSCS as controller and passed to the application support team. The application has no self-service export or deletion yet, so requests are handled manually by an administrator and recorded in the audit log. Requests are accepted from the signed-in account or after CSCS verifies your identity. The proposed handling below, and the response deadlines, are to be confirmed by the Data Protection Officer.

Access: An export of your account, KYC, payment, chat and audit records.
Rectification: Correct your profile or resubmit KYC; an administrator corrects verified records.
Erasure: Deletion or anonymisation, except records that must be kept for a legal retention period.
Portability: A machine-readable export (JSON/CSV) of data you provided (whether this right applies is to be confirmed).
Objection / restriction: Analytics and marketing stop. Surveillance processing continues where its basis is a legal obligation or public task.
Automated decisions: None producing legal effects identified in this draft, pending DPO review: Sentinel flags and KYC outcomes are reviewed by people.

Investors whose trades appear in CSCS data are not MarketSphere users: their requests go to CSCS through its existing channels.

Contact

Contact CSCS as controller. Data Protection Officer contact details: [to be published by CSCS]

Source: Record of Processing Activities CSCS-MS-GOV-ROPA-001, last reviewed 27 September 2026. See also the system status page.