Privacy Policy

Last updated: May 2026

1. Introduction

Central Business Management System ("CBMS", "we", "us", or "our") is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose and safeguard your information when you use our platform at cbms.com.ng and related services.

By using CBMS you agree to the collection and use of information described in this policy. If you do not agree, please do not use our services.

2. Information We Collect

Account information: name, business name, email address, phone number, and billing address when you register.

Business data: the information you enter into your ERP, POS, or clinic system is your data. We store it securely to operate the service on your behalf.

Payment information: we do not store raw card numbers. Payments are processed by Paystack and Flutterwave; their privacy policies apply to card data.

Usage data: IP addresses, browser type, pages visited, time and date of access, and diagnostic logs to operate and improve the platform.

Communications: emails, SMS, and WhatsApp messages sent through CBMS are logged for delivery confirmation and support purposes.

3. How We Use Your Information

To create and manage your account and provision your systems.
To process payments and send invoices and receipts.
To send service announcements, security alerts, and support messages.
To detect and prevent fraud, abuse, and security incidents.
To improve our platform and develop new features.
To comply with legal obligations under Nigerian law (including NDPR).

We do not sell your personal data to third parties.

4. Data Sharing

We share your data only with:

Payment processors (Paystack, Flutterwave) — to process transactions.
Communication providers (Mailgun, Termii, Meta WhatsApp) — to deliver notifications you request.
Infrastructure providers — cloud hosting required to operate the service.
Law enforcement or regulators — only where required by applicable Nigerian law or a valid court order.

5. Data Isolation

Every business on CBMS runs in a dedicated, isolated environment. Your data is logically and technically separated from all other tenants. We enforce this at the database, application, and network layers.

6. Data Retention

We retain your data for as long as your account is active and for seven (7) years after account closure to comply with Nigerian tax and financial record requirements. You may request deletion of non-statutory data by contacting support.

7. Your Rights (NDPR)

Under the Nigeria Data Protection Regulation (NDPR) you have the right to:

Access the personal data we hold about you.
Request correction of inaccurate data.
Request deletion of your data (subject to legal retention obligations).
Object to processing in certain circumstances.
Lodge a complaint with the Nigeria Data Protection Bureau (NDPB).

To exercise these rights email us at privacy@cbms.com.ng.

8. Security

We use AES-256 encryption at rest, TLS 1.3 in transit, and strict access controls. See our Security page for full technical details.

9. Cookies

We use strictly necessary session cookies to authenticate you and maintain your dashboard session. We do not use advertising or tracking cookies.

10. Changes to This Policy

We may update this policy from time to time. We will notify you by email or via in-app notification at least 14 days before material changes take effect.

11. Contact

Questions about this policy? Contact our Data Protection Officer:
Email: privacy@cbms.com.ng
Address: CBMS, Nigeria