AdresX privacy notice

Last updated 3 October 2026

Who we are

AdresX is run by AGXII Intelligence & Investigations Ltd (RC9202669), registered with the Nigeria Data Protection Commission (NDPC/DCP/10797). Contact us about your data at privacy@agxii.org.ng.

What this covers

The address check link you received from a bank or another organisation, and the AdresX USSD and SMS service.

What we collect

• Your phone's location at the moment you tap Capture my location, how accurate it is, and the time on your phone's clock.
• If you agree, the location and time of each later I am at this address now check-in.
• The reference and address text the organisation gave us about you, if any.
• Your phone number, only if the organisation used it to text you the link, or you used USSD. We keep it only as a one-way scrambled value (a hash), not as readable digits.
• If you send us a data request, the contact details and message you give us, so that we can reply.
• When a field agent confirms an address on site, the agent's app may take a photo of the outside of the building. We store the photo, a fingerprint of it (a hash), the time it was taken and which agent took it. Agents are told to photograph the building only, not people or vehicle number plates.

We do not collect photos from the people whose addresses are checked, and we do not collect contacts, messages or advertising identifiers or track your location in the background. The only photos we hold are the building photos taken by field agents, described above. They are kept for the same period as the other evidence records, deleted when an address is erased, not shown on certificate pages and not sent to the organisation that asked for the check.

National postcode

An organisation may give us your national postcode (the 11-character digital postcode issued by NIPOST) together with your check. We keep it with that check, and you can ask us to delete it like the rest of your data.

When the national postcode check is switched on, we may send the postcode, and nothing else about you, to the national postcode service run by NIPOST, to ask whether it exists. We do not send your name, your phone number or the organisation's reference.

Separately, if you have tapped Capture my location and that check is switched on, we may send the location you captured to the same service, to ask which registered building is nearest, and compare its postcode with the one the organisation gave us. This can only help your result, never lower it. We do not send your name or phone number. NIPOST has its own privacy policy for what it does with requests.

These checks are being tested against NIPOST's test environment and are not live yet.

Identity checks (partner organisations only)

Some organisations ask us to check an identity number (a BVN, a NIN or a phone number) against the national records. The check confirms that a record exists and whether the details the organisation holds about you (name, date of birth, phone number) are consistent with it. It is separate from the address check, and it only involves you if an organisation you deal with uses it.

• For a BVN, the national consent service sends a one-time code to a phone number or email already registered on your BVN. Nothing is released until that code is entered. If you receive a code you did not ask for, do not share it, and tell your bank.
• For a NIN or a phone number, the organisation confirms to us that you agreed to the check.
• We send the number to our identity data providers (Mono, and HITECH for phone numbers). They return the record to us. We use it only to compare the details in memory, then discard it, and we pass back to the organisation only the outcome: whether a record was found and whether each detail matched. Your photo, your address and the record itself are never passed on.
• We do not store the identity number, your name or your date of birth, and we do not write them to our logs. We keep the outcome, the type of check, the time, the organisation's own reference for you and a coded form of the organisation's access key, for audit and billing. We will publish a fixed retention period before AdresX is offered to the public.
• An identity match shows that a record exists. It does not show where you live, and it never changes an address result.
• Each provider has its own privacy policy for what it does with a request.

Why we use it

To check whether an address is real and where it is, to issue an address certificate, and to prevent fraud. We rely on your consent: you share your location by tapping the button, and you can stop at any time. We do not sell your data or use it for advertising.

Who sees it

• The organisation that sent you the link sees the result: the verification level, an evidence score, its own reference for you and, where its agreement allows, the location code.
• A certificate page shows its location code to anyone who has the certificate link. Share that link only on purpose.
• Our hosting provider stores the data, and our SMS provider delivers text messages for us.

Where it is kept

On servers in London, United Kingdom.

How long we keep it

• Links that were never used are deleted 30 days after they expire.
• Check-ins and the evidence history are deleted after 400 days.
• Data requests are kept for 730 days after we close them.
• Address records and certificates are kept until deletion is requested. We will publish a fixed period before AdresX is offered to the public.

Your rights

You can ask to see, correct or delete your data, to object to how we use it, and to withdraw your consent. Use the data request page or write to privacy@agxii.org.ng. You can also complain to the Nigeria Data Protection Commission.

Security

Data travels over HTTPS. Phone numbers are stored as hashes. Each organisation uses its own access key, and certificates are digitally signed. No system is perfectly secure, and we will tell you and the regulator if your data is affected by a breach.

Changes

If we change this notice we will update the date above.