The Owerri Chamber of Commerce, Industry, Mines and Agriculture ("OCCIMA", "the chamber", "we") holds personal data about the businesses in its register, the people who contact it, and the people who apply for work through it. This policy explains what we hold, why, who else can see it, and what you may ask us to do about it.
It applies to occima.org and to the member portal and secretariat systems behind it. We are the data controller for that information. If you have a question about anything here, write to info@occima.org.
What we collect
When a business registers or joins. Business name, contact email address, telephone number, physical address, sector, local government area, trade group, year of establishment, and a description of what the business does.
When a business seeks verification. Registration and compliance documents, which may include a CAC certificate or status report, proof of address, tax identification, and any further document the chamber asks for. These are held in private storage and are described separately below.
When a business pays. Payment references, amounts, dates and the membership tier or fee paid. We do not receive or store card numbers. Card details are handled by our payment provider and never reach the chamber.
When you contact us or register for something. Your name, contact details and whatever you write to us, whether that is a general enquiry, a Certificate of Origin application, an event or training registration, or an enquiry to a member business through the directory.
When you apply for a job. Your name, contact details, a covering note and your curriculum vitae.
What a member publishes. Products, services, certifications and business information that a member chooses to display on its public listing. This is published deliberately and is visible to anyone.
Technical information. To limit abuse of our public forms we record a one-way cryptographic hash of the submitter's email address or network address, together with a salt. We do not store the address itself, and the hash cannot be reversed to recover it.
What we do not collect
We do not use advertising, analytics or tracking of any kind. There are no advertising cookies, no tracking pixels, no third-party analytics scripts and no profiling. We do not sell, rent or share personal data for marketing, and we never have.
The only cookies this site sets are the session cookies that keep you signed in to the member portal or the secretariat dashboard. They are necessary for those areas to work, they are not used to follow you anywhere, and if you never sign in, none are set.
Why we hold it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Maintaining the member register and the public directory | Performance of the membership contract |
| Verifying that a business is what it says it is | Performance of the membership contract, and our legitimate interest in a directory that buyers can rely on |
| Collecting dues and fees, and issuing receipts | Performance of the membership contract, and legal obligation for financial records |
| Answering enquiries and processing applications | Steps taken at your request before entering a contract, and our legitimate interest in responding to those who write to us |
| Passing a job application to the employer who advertised the vacancy | Consent, given when you apply |
| Limiting abuse of public forms | Our legitimate interest in keeping the site usable |
Documents you send us
Verification documents and curricula vitae are held in private storage that is not readable from the public internet. They are never given a public address.
When a member of the secretariat, or an employer reviewing an application, needs to open one, the system issues a signed link that expires: sixty seconds for a curriculum vitae, five minutes for a member document. After that the link is dead. A link forwarded to someone else is useless by the time they click it.
Access is restricted at the database itself and not only in the interface. A member can reach its own documents and no others. An employer can reach the applications made to its own vacancies and no others.
Who else processes it
We use a small number of established service providers. Each processes data only on our instructions and for the purpose stated.
| Provider | What it does | Where |
|---|---|---|
| Supabase | Database, authentication and file storage | European Union |
| Vercel | Website hosting and delivery | Global network |
| Resend | Sending the emails the platform generates | European Union |
| Paystack | Card and bank payment processing | Nigeria |
| Anthropic | Wording for the answers given by Onyeoma, our website guide | United States |
About Onyeoma. Onyeoma answers questions about the chamber using only pages the chamber has already published. It receives the question you type and the published extracts that match it. It does not receive, and cannot reach, the member register, member documents, payment records, enquiries or any other personal data. If you type personal information into the question box it will be sent as part of that question, so please do not. Questions and the answers given are recorded so the secretariat can check that the assistant is answering correctly.
We disclose personal data to no one else, except where the law requires it or where you have asked us to. Where a service provider processes data outside Nigeria, that transfer is made under the safeguards required by the Nigeria Data Protection Act 2023.
What members can see
A member business can see its own record, its own documents, the enquiries sent to it, its own payment history and the applications made to its own vacancies. It cannot see any other business's records, documents, enquiries, payments or applicants. That boundary is enforced by the database rather than by the screens, so it holds regardless of how a request is made.
How long we keep it
| Information | Retained |
|---|---|
| Member records and the register | For the duration of membership, and afterwards for as long as the chamber's own records require |
| Verification documents | Until superseded by a newer document, or until membership ends and the chamber's record-keeping obligations have run |
| Payment records | Six years, to meet financial record-keeping requirements |
| Enquiries and registrations | Two years after the matter is closed |
| Job applications and curricula vitae | Twelve months after the vacancy closes |
| Abuse-prevention hashes | A rolling window measured in hours |
Your rights
Under the Nigeria Data Protection Act 2023 you may ask us to:
- tell you what personal data we hold about you, and give you a copy;
- correct anything that is wrong or incomplete;
- delete data we no longer have a reason to keep;
- stop or restrict a particular use;
- provide your data in a portable form;
- withdraw a consent you previously gave, without affecting what was done before you withdrew it.
A member can do much of this without asking. Signing in to the portal lets a business correct its own details, replace its documents, and see every payment it has made.
To exercise any of these rights, write to info@occima.org. We will respond within thirty days. If we cannot do what you have asked, we will tell you why.
If you believe we have handled your data wrongly, you may complain to us first, and you may complain to the Nigeria Data Protection Commission at any time.
Security
Data is encrypted in transit and at rest. Access rules are enforced in the database, not only in the interface, so a fault in a page cannot expose records the viewer is not entitled to. Private documents are never publicly addressable. Every change made in the secretariat dashboard is recorded with who made it and when, in a log that cannot be altered.
No system is perfectly secure. If a breach affects your personal data and is likely to put you at risk, we will tell you and the Nigeria Data Protection Commission without undue delay.
Children
This site is for businesses and the people who run them. It is not directed at children and we do not knowingly collect data about anyone under eighteen. If you believe we hold data about a child, write to us and we will remove it.
Changes
If we change this policy we will change the date at the top. Where a change materially affects how we use your data, we will tell members by email before it takes effect.
Contact
Owerri Chamber of Commerce, Industry, Mines and Agriculture
FSP Park, Owerri, Imo State, Nigeria
info@occima.org