Privacy Statement — Verification Service

What Phinamek retains when it verifies, and what it never takes.

Phinamek Data LTD · Version 1.0 · 3 November 2026

This statement covers the Phinamek verification service: the service that checks a declared data posture against published rule packs and issues a signed attestation of the result. The service works on declarations about data. It does not work on the data itself.

What we retain

The complete list. Nothing else is kept.

• Your organisation's name.
• The name and title of the officer who certifies your declaration, recorded in business capacity only. An attestation needs a named, accountable signer at the client organisation, so this stays on the attestation.
• A cryptographic hash of your declaration inputs.
• The verification record: your declared posture in summary form (jurisdictions, data categories, safeguard types), the verdict, the cited findings, and the rule-pack version the check ran against.
• The attestation ID, with its issue and expiry dates.

Why we retain it

Two reasons, and no other. Accountability: a signed attestation must name who certified the facts it was checked against. Verification: the hash and the record let any holder of an attestation re-run the check to the identical verdict, and let us defend a verdict if it is ever disputed. The record is never sold, never used for marketing, and never used to profile any individual.

What we do not retain, and never receive

• No underlying evidence documents. Evidence is referenced in a declaration; the documents themselves stay with you.
• No personal data of data subjects. Not your customers, citizens, users or patients. Declarations describe data by category, never by content.
• No annotator or personnel files. Handling chains are recorded by jurisdiction, not by the names of the people in them.
• No private contact details. We do not record personal email addresses, phone numbers or personal documents, for the certifying officer or anyone else. If such details reach us in error, the platform removes them automatically before anything is stored or signed.

The law that applies

All required data protection applies, and is applied. We handle the verification record under the law of each jurisdiction an engagement touches:

• Nigeria - the Nigeria Data Protection Act 2023 and the General Application and Implementation Directive 2025.
• Kenya - the Data Protection Act 2019.
• South Africa - the Protection of Personal Information Act.
• Ghana - the Data Protection Act 2012 (Act 843).
• European flows - the GDPR, as executed in Portugal by Law 58/2019 and supervised by the CNPD.

Where two regimes differ, the stricter protection governs our handling. Your organisation remains the controller of its own underlying data, which never comes to us. For the small verification record described above, Phinamek Data LTD is the controller.

Keeping period and your rights

Verification records are kept while the attestation they support is live, and afterwards as part of the verification registry, because the registry is the dispute record. Declaration inputs themselves are not stored, so there is nothing further to delete.

The certifying officer may ask what we hold under their name, and may have it corrected, through the contact below. An issued attestation is a signed record and cannot be edited: if a name or title is wrong, we revoke the attestation and reissue a corrected one.

Contact

Phinamek Data LTD - info@phinamek.ai