Data Processing Statement

The business that owns a Operix workspace is the controller of the personal data it records about its customers, staff and suppliers: it decides what to collect and why. Spacehub Technologies, which operates Operix, is the processor: we store and process that data only to provide the service to that business, and on its instructions as given through the way it uses Operix.

This statement covers that customer data. How we handle the account details of the people who use Operix themselves is covered by our Privacy Policy.

We handle personal data in line with Nigeria's data protection framework — the Nigeria Data Protection Act 2023 and the Nigeria Data Protection Regulation (NDPR). Each business remains responsible for its own obligations as a controller, including having a lawful basis for the data it collects and telling its customers how it is used.

Depending on the features a business uses, Operix may hold the following about its customers:

• name, phone number and email address, and whether that email address has been verified;
• delivery addresses — recipient name and phone, street, landmark, city, local government area, state, delivery instructions and, where given, a map location;
• orders, invoices, payments, refunds and returns, and the total the customer has spent with the business;
• loyalty points, wallet balances, vouchers, and any credit terms the business has granted;
• shopping carts and saved items on the business's storefront;
• preferences about receiving SMS messages;
• sign-in records for the customer portal, such as one-time codes and sessions;
• vehicles a customer has saved, for businesses that sell vehicle parts.

Card numbers are never among them. Card payments are taken on the payment provider's own page and we keep only the provider's reference.

Only to provide Operixto the business: recording sales and orders, taking payments, delivering orders, sending the receipts, invoices and order updates the business sends, running its storefront and customer portal, keeping it secure, backing it up, and providing support when the business asks for it. We do not sell this data, and we do not use one business's customer data for another business.

We use these service providers (sub-processors) to run Operix:

• Hostinger — the server that runs Operix and its database.
• Paystack — card and bank payments, for subscriptions and for storefront checkouts that use our payment setup.
• Resend and Amazon SES — delivery of the emails Operix sends.
• Cloudflare Turnstile — checks that a person, not a bot, is using sign-up and other public forms.
• Off-site backup storage — an object-storage provider that holds encrypted copies of the database away from the main server.

Some features use a further provider only when they are switched on:

• SMS messages, through an SMS gateway (Termii);
• push notifications to phones, through Firebase Cloud Messaging;
• AI features, through an AI model provider;
• turning a typed address into a map location, through a mapping service.

A business can also connect its own payment provider or its own email server. Those are the business's own providers, chosen by it, not ours. Ask us at partnerships@mail.spacehubtech.cloud and we will tell you which providers are in use and where they keep data.

Each business's data is kept separate from every other business's, access inside a workspace is set by role, sign-ins and exports are recorded, credentials a business gives us are encrypted, and the database is backed up every day. Our Security page sets out exactly what we do — and what we have not done yet. We hold no security certification and do not claim one.

Our staff can open a business's workspace only through a support session that is recorded in that workspace's own activity and announced to its owners by email.

If we become aware of a breach affecting a business's personal data, we will tell that business without undue delay, say what we know about what happened and what data is affected, and help it meet its own duty to report and to inform its customers.

An owner or admin can export the whole workspace as a file at any time, without asking us. This is never blocked — not by plan, and not by an unpaid invoice.

Correction and deletion are handled by our team on the business's written request. When a workspace is closed, we remove its business data; our own billing and payment records for that business are kept for audit.

If you bought from a business that uses Operix and want to see, correct or delete your data, please ask that business first — it decides what happens to your data. If you write to us instead, we will pass your request to the business and help it respond.

For any question about this statement or a data request, email partnerships@mail.spacehubtech.cloud.