GoalWin Data Security

1. 1.Purpose and standard

   Section 39 NDPA requires a data controller to implement appropriate technical and organisational measures, taking into account the state of the art, cost of implementation, and the nature, scope, context and purposes of processing.

   This Statement sets out how GoalWin meets that duty on both channels. It is written as evidence that an MNO partner's security team, a licensed DPCO, or a regulator can test against.

   The VAS channel and the direct channel run on the same platform, identity and access model, encryption, monitoring and incident process. What differs is the data they hold and therefore the blast radius.

   • VAS: mobile number, subscription and charging events, gameplay. Main risks are unauthorised charging, consent-record integrity, MSISDN exposure and interconnect compromise.
   • Direct: identity documents, biometrics, bank and card metadata, wallet balances. Main risks are account takeover, payout fraud, KYC data exposure and AML control failure.
   • Sections 3-13 are common to both. Sections 15 and 16 set out channel-specific controls.

2. 2.Governance and accountability

   Role	Accountability
   Board / Management Committee	Owns data protection and security risk, approves this Statement and the security budget, and receives quarterly risk reporting.
   Data Protection Officer	Maintains the RoPA, runs DPIAs, handles data subject requests and SNAGs, acts as NDPC contact point, and reports to the highest management level.
   Chief Technology Officer	Owns technical controls, architecture, the SDLC and this Statement.
   Head of Security / Security Lead	Owns monitoring, vulnerability management, incident response and third-party technical assurance.
   Head of Compliance / MLRO	Owns KYC/AML controls, suspicious transaction reporting and gaming licence conditions on the direct channel.
   Every employee and contractor	Bound by Acceptable Use, Access Control and Incident Reporting policies. Reporting a suspected incident is a duty.

   Swipe sideways to see the full table →

   Governance artefacts we maintain

   • Record of Processing Activities covering both channels, reviewed quarterly and on every material change.
   • Data Protection Impact Assessments for the VAS service, biometric verification, fraud profiling and any new high-risk processing.
   • Legitimate Interest Assessments on the GAID template for every legitimate-interest basis we rely on.
   • Data classification standard, retention schedule and disposal register.
   • Asset and data-flow inventory, including every interconnect and every processor.
   • Risk register with named owners, treatment plans and dates.
   • Breach register, DSR register, NDPC registration and annual Compliance Audit Return where required.
   • Information Security, Access Control, Cryptography, Secure Development, Change Management, Vendor Risk, Incident Response, Business Continuity, Acceptable Use, Data Retention, Remote Working and Clear Desk/Clear Screen policies.

3. 3.Data classification and minimisation

   Class	Examples	Handling rule
   Restricted	NIN, BVN, identity document images, biometric captures, bank account numbers, MSISDN, payment tokens, credentials, encryption keys, draw seeds	Field-level encryption; named, ticketed, time-bound access; every access logged and reviewed; never in logs, tickets, screenshots, chats or non-production.
   Confidential	Wallet balances, transactions, gameplay tied to an identity, support transcripts, consent records, fraud case files	Encrypted at rest; role-based access; pseudonymised in analytics; masked in support tooling by default.
   Internal	Aggregate metrics, de-identified analytics, architecture documentation, runbooks	Access limited to staff and contractors under NDA.
   Public	This Statement, privacy notices, terms, leaderboard display names, published winner announcements	No restriction.

   Swipe sideways to see the full table →

   Minimisation in practice

   • Collect late: KYC is requested at payout or when a threshold makes it necessary, not at registration.
   • Store the decision, not the evidence: biometric captures and document images are deleted within 30 days of a verification decision.
   • Pseudonymise by default for analytics, product tooling, dashboards, BI and MNO reporting.
   • Mask at the glass: support agents see masked mobile numbers and account details by default.
   • Never in test: production personal data is prohibited in development, staging, QA and demo environments.
   • Tokenise money: card PAN, CVV and PIN never enter GoalWin systems.

4. 4.Identity and access management

   • Single sign-on with mandatory phishing-resistant multi-factor authentication for every internal system.
   • Role-based access on least privilege and need-to-know; access is denied by default.
   • Privileged and production data access is just-in-time, ticketed, approved by a second person, time-boxed, auto-revoked and session-recorded.
   • Break-glass accounts are held in escrow, alarm on use, and require post-use justification within 24 hours.
   • Named accounts only. Shared or generic credentials are prohibited.
   • Joiner-mover-leaver access is automated from HR and revoked within one hour of termination.
   • Quarterly access recertification by system owners.
   • Segregation of duties across deployment, draw administration, logging and payouts.
   • Secrets are held in a managed vault with automatic rotation and continuous repository scanning.

5. 5.Cryptography

   Control	Standard
   In transit - public	TLS 1.2 minimum, TLS 1.3 preferred; modern cipher suites only; HSTS with preload; certificate transparency monitoring; automated renewal.
   In transit - internal and interconnect	Mutual TLS between services; IPSec site-to-site tunnels to MNO and aggregator interconnects; no unencrypted internal hop carries personal data.
   At rest	AES-256 for databases, object storage, backups and snapshots; encrypted volumes on every node.
   Field level	Application-layer encryption for MSISDN, NIN, BVN, bank account numbers and payment tokens.
   Key management	Managed KMS/HSM; envelope encryption; annual rotation and rotation on suspicion of compromise.
   Passwords	Salted, memory-hard hashing such as Argon2id or bcrypt. Never reversible, logged or transmitted to support.
   Tokens and sessions	Short-lived, rotating, bound to device and audience; secure, HttpOnly, SameSite cookies; server-side revocation.
   OTPs	Single-use, short-lived, rate-limited, attempt-capped and never reusable across channels.
   Draw randomness	Certified RNG; seeds under dual control; seed and outcome written to append-only, tamper-evident logs.

   Swipe sideways to see the full table →

6. 6.Infrastructure and network security

   • Cloud hosting in [HOSTING REGION] with an independently certified provider.
   • Segmented VPC architecture with public ingress, application, data and management tiers separated.
   • Default-deny security groups and network ACLs, including egress filtering.
   • WAF, managed DDoS protection, bot management, rate limiting and anti-automation.
   • Telco interconnects terminate on dedicated, IP-allow-listed endpoints over IPSec tunnels.
   • Administrative access is brokered through an identity-aware proxy with session recording.
   • Infrastructure as code is peer-reviewed and version-controlled.
   • Container images are immutable, minimal, scanned at build and continuously in the registry.
   • Continuous cloud security posture management alarms on drift and misconfiguration.

7. 7.Secure development

   • Security requirements and privacy-by-design review are entered at design.
   • Mandatory peer code review; no self-merge to a protected branch; signed commits.
   • SAST, SCA, dependency, container, IaC, secret and licence checks run in the pipeline.
   • Critical or High findings fail the build.
   • DAST runs against staging on every release candidate.
   • Software Bill of Materials is produced per release; dependencies are pinned.
   • Changes are ticketed, tested, peer-approved, deployed through the pipeline and reversible.
   • OWASP ASVS Level 2 is the application baseline.
   • Server-side authorisation is checked on every object reference.

8. 8.Logging, monitoring and detection

   • Centralised, structured logs are shipped to a write-once store.
   • Personal data is scrubbed and identifiers tokenised at the logging layer.
   • SIEM alerting covers privileged access, mass export, out-of-hours admin activity, authentication anomalies, impossible travel, draw-system access, payout anomalies and Restricted data access.
   • Anomaly detection monitors money flows and charging flows.
   • Logs are retained 12 months online and searchable, longer only for live investigation or regulatory hold.
   • Authoritative NTP is used across the estate.
   • Alert runbooks have named owners and response times.

9. 9.Vulnerability and patch management

   Severity	Internet-facing SLA	Internal SLA
   Critical (9.0-10.0)	24 hours or same-day compensating control	72 hours
   High (7.0-8.9)	7 days	14 days
   Medium (4.0-6.9)	30 days	60 days
   Low (0.1-3.9)	90 days or accepted with a dated, owned risk decision	90 days
   Actively exploited in the wild	Immediate; emergency change path	Immediate

   Swipe sideways to see the full table →

   • Authenticated vulnerability scanning runs at least monthly.
   • Independent penetration testing covers the platform, API, PWA and telco interconnect at least annually and before major architectural change.
   • Findings are tracked to closure with retest.
   • Responsible disclosure reports go to [SECURITY EMAIL] and are acknowledged in 3 working days.
   • Threat intelligence is monitored for our stack, sector and region.

10. 10.Resilience, backup and continuity

    Control	Standard
    Architecture	Multi-availability-zone by default; stateless application tier; managed database with automated failover.
    Backups	Automated, encrypted, separate account/region, immutable and object-locked against ransomware.
    RPO	[15 minutes] for transactional data with point-in-time recovery enabled.
    RTO	[4 hours] for the core service; [24 hours] for full functional restoration.
    Restore testing	Quarterly restore from backup to a clean environment, timed and evidenced.
    Disaster recovery	Documented plan with triggers, roles and communications; exercised at least annually.
    Business continuity	BCP covers region loss, key vendor loss, interconnect loss and key personnel loss.
    Vendor concentration	Exit and portability plans for each critical vendor.

    Swipe sideways to see the full table →

11. 11.Third parties, processors and the supply chain

    • Due diligence before engagement covers security questionnaires, certifications, penetration test summaries, data location, sub-processor chain, breach history and financial standing.
    • Contracts include a written data processing agreement meeting section 29 NDPA.
    • Aggregator and sub-processors are bound to no lesser standard.
    • Critical vendors are reviewed annually and whenever risk materially changes.
    • A current sub-processor list is published at [SUB-PROCESSOR LIST URL].
    • Exit requires certified deletion or return of personal data plus revocation of every credential, key and network path.

12. 12.Incident response and breach notification

    Severity and response

    Severity	Definition	Response
    SEV-1	Compromise of Restricted data, unauthorised charging at scale, draw integrity compromise or total service loss.	Immediate escalation to CTO, DPO and CEO. War room within 30 minutes.
    SEV-2	Exposure of Confidential data, targeted attack, partial service loss or material subscriber impact.	Escalation within 1 hour. Incident commander appointed. DPO assesses notifiability.
    SEV-3	Contained security event with no confirmed data impact.	Handled in-hours, logged and reviewed weekly.
    SEV-4	Near miss, policy breach or control weakness found before exploitation.	Logged and tracked.

    Swipe sideways to see the full table →

    Notification clocks

    Recipient	Trigger	Deadline
    Nigeria Data Protection Commission	Personal data breach likely to risk rights and freedoms.	Within 72 hours of becoming aware.
    Data subjects	Breach likely to result in high risk.	Without undue delay, directly and in plain language.
    MNO partner	Incident affecting the VAS channel, subscriber data or interconnect.	Within 24 hours of awareness.
    Payment processors, banks, sector regulators	Per contract and licence condition.	Typically 24-72 hours.
    Law enforcement	Criminal conduct.	Where appropriate and lawful.
    Cyber insurer	Per policy.	Per policy.

    Swipe sideways to see the full table →

    The process

    • Detect through automated alerting, staff reporting, researcher disclosure, partner or regulator notification.
    • Triage and classify within 30 minutes of a credible signal.
    • Contain by isolating, revoking, rotating and blocking.
    • Preserve evidence and chain of custody.
    • Assess notifiability against section 40 and document the reasoning.
    • Notify under the clocks above.
    • Eradicate and recover with validation that the entry route is closed.
    • Review within 10 working days with tracked corrective actions.

13. 13.People

    • Pre-employment screening proportionate to role.
    • Confidentiality and data protection obligations in every employment and contractor agreement.
    • Security and data protection training at onboarding and at least annually.
    • Quarterly phishing simulation with coaching.
    • Documented disciplinary process for wilful or reckless breach.
    • Termination checklist revokes access within one hour, returns assets, rotates keys and reconfirms confidentiality obligations.

14. 14.Endpoints and physical

    • Company-managed devices only for Confidential or Restricted data.
    • Full-disk encryption, EDR, automatic screen lock, patching and remote wipe on every endpoint.
    • No bulk export to local storage; removable media blocked by default.
    • DLP for Restricted patterns in outbound email and file-sharing.
    • Remote work uses the identity-aware proxy only.
    • Offices at [LAGOS OFFICE] and [PORT HARCOURT OFFICE] have controlled entry, visitor logging and secure paper destruction.
    • No production personal data is held on premises.

15. 15.Channel-specific controls - VAS

    These controls exist because carrier-billed channels have specific failure modes: a subscriber who never agreed, a charge they cannot explain, and a number that leaks into somebody's marketing list.

    Consent integrity

    • Double opt-in is enforced in the platform, not campaign configuration.
    • Consent records are written to append-only, hash-chained logs at capture.
    • Charge attempts without a complete consent record are rejected by the billing service.
    • Daily automated reconciliation compares consent records, charge attempts and MNO settlement.
    • DND suppression is applied at send time against the current list.
    • STOP terminates billing at receipt and re-subscription requires fresh double opt-in.

    Interconnect and data handling

    • IPSec site-to-site tunnels with mutual authentication and IP allow-listing.
    • Interconnect terminates in a segregated network tier.
    • MSISDNs are field-encrypted at rest and pseudonymised on ingest.
    • The aggregator is a processor and barred from independent use of MSISDNs.
    • Interconnect health, latency and anomalous volume are monitored continuously.

    Assurances to MNO partners

    • Full consent audit trail producible per MSISDN within 24 hours.
    • Incident notification to the MNO within 24 hours.
    • Right to audit against this Statement.
    • Compliance with NCC Consumer Code of Practice Regulations 2024, DND directive and *305# VAS framework.
    • No sharing, resale or enrichment of MNO subscriber identifiers.

16. 16.Channel-specific controls - Direct

    Account security

    • Argon2id password hashing and breached-password checking.
    • Two-factor authentication available to every user and mandatory above payout thresholds.
    • Rate limiting, progressive delays, CAPTCHA escalation and credential-stuffing detection.
    • Notifications on password, email, payout-destination, 2FA and new-device changes.
    • Cooling-off hold on withdrawals after payout destination or SIM/device change signals.
    • Session binding, server-side revocation and forced re-authentication for sensitive actions.

    Money and payments

    • No PAN, CVV or PIN on GoalWin systems.
    • Hosted fields and tokenisation at PCI DSS v4.0 certified processors.
    • Double-entry, append-only wallet ledger.
    • Payout initiation and approval are separated.
    • Idempotency keys on every money-moving operation.
    • Velocity, threshold and pattern monitoring on deposits and withdrawals.

    KYC and biometric data

    • Verification is performed by a licensed provider acting as processor.
    • Document images and biometric captures are encrypted, segregated and deleted within 30 days of decision.
    • Explicit, separate consent for biometric processing with a manual alternative.
    • KYC records are retained for the statutory AML minimum and locked to that purpose.

    Game and draw integrity

    • Certified RNG and dual-control seed custody.
    • Seed and outcome are hash-chained to a tamper-evident log before publication.
    • No role can view, alter, re-run or delay a draw.
    • Entry pools are frozen and hashed at close.
    • Independent periodic audit of RNG and draw execution.
    • Bot, collusion and multi-account detection with human review where prizes are affected.

17. 17.Compliance calendar and assurance

    Activity	Frequency	Owner
    NDPC registration maintained; significant changes notified	Within 60 days of any change	DPO
    Compliance Audit Return filed with NDPC	Annually, by 31 March	DPO
    NDPA compliance audit	Initial audit within 15 months of registration; annually thereafter	DPO + DPCO
    DPO semi-annual data protection report to management	Twice yearly	DPO
    RoPA review	Quarterly and on material change	DPO
    DPIA review for high-risk processing	Annually and before material change	DPO + CTO
    Independent penetration test	Annually and before major architectural change	Security Lead
    Access recertification	Quarterly	System owners
    Backup restore test	Quarterly	CTO
    DR and incident-response exercise	Annually, at least one unannounced	CTO + Security Lead
    Critical vendor re-assessment	Annually	Security Lead
    Policy set review	Annually	CTO + DPO
    Security awareness training; phishing simulation	Annually; quarterly	People + Security
    MNO partner security review	Annually or on request	CTO
    Risk register review at management level	Quarterly	Management Committee

    Swipe sideways to see the full table →

18. 18.Annex A - Obligation-to-control mapping

    Obligation	Source	Where met
    Lawful basis for every processing activity	NDPA s.25	Privacy notices and this Statement
    Data protection principles	NDPA s.24	This Statement ss.3, 5, 8, 12; both privacy notices
    Transparency and privacy notice content	NDPA s.27; GAID Art. 25	Both privacy notices
    Record of Processing Activities	NDPA s.28	This Statement s.2.1
    Data Protection Impact Assessment	NDPA s.28; GAID Art. 28	This Statement s.2.1
    Processor contracts	NDPA s.29	This Statement s.11
    Registration and CAR filing	NDPA s.44; GAID Arts. 9-10	This Statement s.2.1 and s.17
    DPO designation and reporting	NDPA s.32; GAID Art. 13	This Statement s.2
    Appropriate technical and organisational measures	NDPA s.39	This Statement, entire
    Breach notification	NDPA s.40	This Statement s.12.2
    Cross-border transfer safeguards	NDPA ss.41-43	Privacy notices
    Cardholder data security	PCI DSS v4.0	This Statement s.16.2

    Swipe sideways to see the full table →

19. 19.Annex B - Consolidated retention schedule

    Deletion is scheduled, automated where possible, logged and verified by sampling. Where deletion is not technically possible within immutable backup rotation, the data is isolated and destroyed on the next cycle.

    Record	Channel	Retention	Trigger
    Consent / opt-in / opt-out audit trail	VAS	7 years	End of subscription
    Subscription and charging events	VAS	7 years	Event date
    Gameplay, predictions, scores	Both	24 months, then aggregated	Last activity
    Service messages and delivery receipts	VAS	12 months	Send date
    Account profile and credentials	Direct	Life of account + 30 days	Account closure
    Wallet ledger and transactions	Direct	7 years	Transaction date
    KYC records, identity data, AML documentation	Direct	5 years minimum	End of relationship
    Identity document images; biometric captures	Direct	30 days	Verification decision
    Verification decision, score, provider reference	Direct	5 years	Decision date
    Draw entries, outcomes, winner and payout records	Both	7 years	Draw date
    Marketing consent state and suppression entries	Both	While the Service operates	Objection date
    Support and complaint records	Both	5 years	Closure
    Security, application and access logs	Both	12 months	Log date
    Breach register entries	Both	7 years	Incident closure
    Backups	Both	90 days maximum rolling	Backup date

    Swipe sideways to see the full table →

20. 20.Annex C - Processor and sub-processor register

    Maintained current and published at [SUB-PROCESSOR LIST URL]. Complete before issue.

    Processor	Function	Data categories	Location	Transfer safeguard	DPA date	Last review
    [Cloud provider]	Hosting, storage, backup	All	[Region]	[Adequacy / BCC + TIA]	[Date]	[Date]
    [VAS aggregator]	SMS/USSD transport, charging	MSISDN, message payloads	Nigeria	N/A - domestic	[Date]	[Date]
    [SMS/email provider]	Service and marketing messaging	Contact identifier, content	[Region]	[Safeguard]	[Date]	[Date]
    [KYC provider]	Identity and biometric verification	Name, DOB, ID number, document image, biometric	[Region]	[Safeguard]	[Date]	[Date]
    Paystack	Card and bank payment processing	Transaction data, tokenised method	Nigeria	N/A - domestic	[Date]	[Date]
    OPay	Wallet and payout	Transaction data, account reference	Nigeria	N/A - domestic	[Date]	[Date]
    [Analytics]	Product analytics	Pseudonymised usage events	[Region]	[Safeguard]	[Date]	[Date]
    [Logging/SIEM]	Log aggregation and detection	Tokenised identifiers, technical data	[Region]	[Safeguard]	[Date]	[Date]
    [RNG certifier / draw auditor]	Draw integrity assurance	Pseudonymised entry pools, seed/outcome logs	[Region]	[Safeguard]	[Date]	[Date]

    Swipe sideways to see the full table →

21. 21.Document control

    This Statement is a public commitment. Where a control described here is not in place at the point of reading, that is a defect in our operations and we want to know: [SECURITY EMAIL].

    Version	Date	Author	Change	Approved by
    1.0	1 August 2026	[CTO], countersigned [DPO]	Initial issue	[BOARD / MANAGEMENT COMMITTEE]

    Swipe sideways to see the full table →

Have a question about data security? Contact us.