LEGAL
Privacy Policy
Last updated 13 October 2026Effective 13 October 2026Version 1.0
In short
We check products, not people. To run a check we use the codes on the pack, not your name or phone number. We never sell your data or show ads, and you can ask us to see or delete what we hold at any time.
01Who we are
TESTITT (“we”, “us”) runs the TESTITT app and the website at testitt.com. TESTITT checks a medicine, food or drink pack against the sources it can reach and shows what each source confirmed.
We are the data controller for the personal data described here. We follow the Nigeria Data Protection Act 2023 (NDPA) and handle data to the standard of the EU and UK General Data Protection Regulation (GDPR), so the same protections apply wherever you are.
02What we collect
We collect only what a check, a report or a reply needs. Most checks need no personal data at all. Depending on what you do, we collect:
- Text read from a pack: registration codes, barcodes and QR codes, batch numbers, expiry dates and scratch PINs.
- Camera images. The app reads codes from the camera on your phone. We keep an image only if you attach it to a report.
- Photos you add to a report or a contact message.
- Your check history: what you checked, when, and the result, so you can find it again.
- Approximate location (city or area, never your precise location), only when you send a report, so regulators can see where a suspected fake was sold.
- Device data: phone model, operating system, app version, language and crash logs, so we can fix problems.
- Your email address, if you create an account.
- Your name, email address and message, when you contact us.
- A salted hash of your IP address, used for a short time to stop abuse. We never store the address itself.
03How we use it
We use your data only for the purposes below, each with a lawful basis under the NDPA and GDPR. We don’t use it for advertising and we don’t build profiles of you.
Running checks and showing results
We send the codes from your pack to the sources we check (for example NAFDAC, manufacturers and PIN providers) and show you what each one confirmed. We keep your history so you can see past results. Lawful basis: providing the service you asked for.
Reports of suspected fakes
When you report a product we review the report, may show other people that a product, batch or place has been flagged, and may pass it to the regulator and the manufacturer. Lawful basis: our legitimate interest, and the public interest, in protecting people from falsified products.
Replying to you and keeping TESTITT working
We use your contact details to reply to your message, and device data and hashed IPs to fix faults, prevent spam and keep the service secure. Lawful basis: our legitimate interest in running a reliable service.
05How long we keep it
We keep data only as long as it is needed, then delete it or make it anonymous.
| Data | Why we keep it | How long |
|---|---|---|
| Check history | So you can see past results | Until you delete it or your account |
| Reports and their photos | To review them and share them with regulators | 24 months, then anonymised |
| Contact messages and photos | To reply and keep a record | 12 months after the last reply |
| Hashed IP addresses | To stop abuse and spam | Up to 24 hours |
| Crash logs and device data | To fix problems | 90 days |
06Your rights
Under the NDPA, and the GDPR where it applies, you have rights over your personal data. We don’t charge for using them.
- See the data we hold about you and get a copy.
- Correct data that is wrong or incomplete.
- Delete your data or your account.
- Object to, or ask us to limit, how we use your data.
- Receive your data in a portable format.
- Withdraw consent at any time, where we rely on it.
- Complain to the Nigeria Data Protection Commission (NDPC), or to your local data protection authority.
To make a request, email business@testitt.com or use the Contact page with the topic “Privacy request”. We reply within 30 days.
07Children
TESTITT isn’t directed at children. If you are under 18, ask a parent or guardian before you create an account or send a report. If we learn we have collected a child’s data without that consent, we delete it.
08International transfers
Our service providers may store or process data outside Nigeria. When they do, we make sure the transfer is allowed under the NDPA, using the safeguards it recognises, such as the standard contractual clauses our providers offer.
09Security
We protect data in transit and at rest with encryption, limit access to the people who need it, and store IP addresses only as salted hashes. No system is perfect: if a breach puts your data at risk, we will tell you and the NDPC as the law requires.
10Changes to this policy
When we change this policy we update the version and the date at the top. If a change affects how we use your data, we tell you in the app or by email before it takes effect. Earlier versions are available on request.
11Contact us
Questions about this policy or your data? Write to us and we reply within 2 working days.