MiTax
Log in Get started
Legal

NDPA Notice

This notice explains how MiTax meets the Nigeria Data Protection Act 2023 (NDPA). It complements our privacy policy; that policy tells you what we do with your data, this notice tells you the legal grounds we rely on and how to exercise your statutory rights.

Last updated: 21 May 2026

1.NDPA 2023 compliance summary#

Worllet Ltd, the operator of MiTax, is registered with the Nigeria Data Protection Commission (NDPC) and operates as a data controller. We process personal data in line with the Nigeria Data Protection Act 2023 and the regulations and guidance the NDPC issues under it.

In practice this means: we have a Data Protection Officer, a written privacy policy, a documented lawful basis for every category of processing, security controls proportionate to the risks, signed agreements with the processors we use, and a process for handling data subject requests and breach reporting.

The short version. We treat your tax data like the sensitive financial record it is: small list of people who can see it, encryption everywhere, access logs, and a legal duty to tell you (and the NDPC) if something goes wrong.

2.Your NDPA rights#

The NDPA 2023 gives every data subject (that is, every person whose data we hold) a clear set of rights. You can exercise any of these by writing to dpo@mitax.io.

  • Right to be informed. To know we are processing your data and why.
  • Right of access. To get a copy of the personal data we hold about you.
  • Right to rectification. To have inaccurate data corrected.
  • Right to erasure. To have your data deleted, subject to legal retention rules.
  • Right to restrict processing. To pause certain uses while a dispute is resolved.
  • Right to data portability. To receive your data in a structured, machine-readable format.
  • Right to object. To object to processing based on legitimate interest or for direct marketing.
  • Right to withdraw consent. Where we relied on your consent, you can take it back at any time.
  • Rights related to automated decisions. To not be subject to decisions based solely on automated processing where they significantly affect you.
  • Right to lodge a complaint. To complain to the NDPC if you are not satisfied with how we handle your data.

3.Our lawful basis for processing#

Every category of personal data we process has a documented lawful basis under the NDPA. The main ones are:

Performance of a contract. When you sign up for MiTax, you ask us to calculate, file, and pay your tax. We need your name, Tax ID, income figures, and supporting documents to deliver that service.

Legal obligation. Tax filings, payment records, KYC checks, and certain reports to the NRS, State IRS, and the NDPC itself are required by Nigerian law. We process the data we need to meet those obligations.

Legitimate interest. Keeping the platform secure, preventing fraud, debugging errors, and improving product clarity rely on legitimate interest. We balance our need against your rights and use the minimum data required.

Consent. For non-essential things like marketing emails or optional analytics, we ask first. You can withdraw consent at any time without affecting the service.

4.Data subject access requests#

To file a data subject access request (DSAR), send an email to dpo@mitax.io from the address on your MiTax account. Tell us which right you are using (access, correction, deletion, and so on) and any specific data or time period you have in mind.

We may ask you for one extra piece of verification (for example, confirming a recent filing reference) so we know it is really you. We respond inside 30 days. Where a request is complex, we may extend the deadline once and tell you why.

There is no charge for a normal request. If a request is repetitive or clearly excessive, we may charge a reasonable administrative fee or decline; we will explain why if we do.

5.Data Protection Officer#

Worllet Ltd has appointed a Data Protection Officer to oversee compliance with the NDPA, respond to data subject requests, and act as the point of contact for the NDPC.

You can reach the DPO by email at dpo@mitax.io, or by post at: Data Protection Officer, Worllet Ltd, Plot 12, JCP House, Victoria Island, Lagos.

6.Cross-border data transfers#

MiTax stores taxpayer data in Nigeria-first regions wherever our hosting partners offer them. Cross-border transfer is the exception, not the rule. When it does happen (for example, when an email or error-monitoring provider operates from a region outside Nigeria), we rely on the safeguards permitted by the NDPA: adequacy decisions where they exist, standard contractual clauses where they do not, and technical safeguards (encryption, access controls, logging) in every case.

We do not transfer personal data to jurisdictions where the level of protection would fall below the NDPA standard without explicit, informed consent or another lawful basis.

7.Complaints to the NDPC#

If you believe we have not handled your data the way the NDPA requires, please tell us first. We would rather hear about an issue from you than from the regulator, and most things can be put right quickly.

If we cannot resolve the matter, you can lodge a complaint with the Nigeria Data Protection Commission. The current point of contact is published on the NDPC website. We will cooperate with the Commission in any investigation that follows.

8.Updates to this notice#

We update this notice when the law changes, when our processing changes, or when we find clearer language for the same idea. The date at the top of the page tells you when the current version went live.

For material changes (new categories of data, new processors handling personal data, or new transfers outside Nigeria), we will tell you inside the app before the change takes effect.