Privacy Policy

The National Investment Board (NIB) and its platform operator, Multigis eServices (SL) Limited, collect and process personal information through the Online Business Registration System (OBRS) in connection with business registration functions carried out under Sierra Leonean law. This policy explains what information we collect, why we collect it, and what rights you have in relation to it.

1.  Who this policy applies to

This policy applies to every individual who creates an account on OBRS, submits an application, or is named as a director, owner, secretary, shareholder, or agent in any filing made through the platform, whether or not that individual made the filing themselves.

2.  What we collect

We collect the following categories of personal information:

• Identity data: full name, National Identification Number (NIN) or passport number, date of birth, nationality, and a scanned copy of your identity document.
• Contact data: email address and phone number.
• Registration data: business names, entity types, registered addresses, capital amounts, membership roles, and any other information you submit as part of a registration or amendment application.
• Transaction data: records of fees paid, payment channel used, and transaction reference numbers. We do not store card numbers or mobile money PINs.
• Usage data: IP address, browser type, pages visited, and timestamps, collected automatically by our servers for security and operational purposes.

We do not knowingly collect information from persons under the age of 18 except where they are named as a beneficiary or minor stakeholder in a filing and the relevant information is submitted by an authorised adult.

3.  Why we collect it

All personal information collected through OBRS is used for one or more of the following purposes:

• To process, review, and decide on business registration applications and related filings.
• To maintain the statutory register of businesses and members as required by law.
• To verify the identity of applicants in line with anti-money laundering requirements.
• To issue certificates, confirmation letters, and other official documents.
• To communicate with you about the status of your applications and your account.
• To detect and prevent fraud, unauthorised access, and abuse of the platform.
• To produce aggregate statistics and reports for government oversight. These reports do not identify individuals.

We do not use personal information for marketing or sell it to any commercial third party.

4.  Legal basis for processing

Our primary basis for processing personal data is the performance of statutory functions. NIB is required by law to collect certain information in order to register businesses in Sierra Leone. Where processing goes beyond that legal obligation (for example, sending you service notifications by email), we rely on your consent given at account registration. You may withdraw consent for non-statutory communications at any time by updating your notification preferences in your account settings.

5.  How we protect your information

Identity documents and national identification numbers are encrypted at rest using AES-256 encryption and are accessible only to NIB officers with an assigned role that requires access to that category of data. Transmission between your browser and OBRS is secured using TLS 1.2 or higher. We maintain audit logs of every access to sensitive personal records, and those logs are reviewed regularly.

No system is perfectly secure. In the event of a data breach that is likely to result in risk to individuals, NIB will notify affected users and the relevant authorities in accordance with applicable Sierra Leonean law within a reasonable period of becoming aware of the incident.

6.  Who we share your information with

Your personal data may be shared with the following parties strictly on a need-to-know basis:

• Government agencies: the National Revenue Authority (NRA), NASSIT, local councils, and other statutory bodies, where disclosure is required by law or triggered by a completed registration event.
• The National Civil Registration Authority (NCRA): for the purpose of verifying identity documents against the national register.
• Multigis eServices (SL) Limited: as the platform operator, Multigis has access to personal data to the extent necessary to run and maintain OBRS on NIB's behalf. Multigis is bound by a data processing agreement that prohibits it from using the data for any other purpose.
• Payment processors: where applicable, the minimum information necessary to process a transaction is shared with the payment provider.

We do not transfer personal data outside of Sierra Leone except where required by law or with your explicit consent.

7.  How long we keep your information

Information held in connection with a registered business is retained for the lifetime of that business plus the period required by law after it has been wound up, struck off, or otherwise ceased. Account information for users with no registered businesses is retained for three years of inactivity, after which the account is flagged for review and, if still inactive, deleted with 30 days' notice to the registered email address.

8.  Your rights

Subject to applicable law, you have the right to:

• Request a copy of the personal information we hold about you.
• Ask us to correct information that is inaccurate or incomplete.
• Ask us to delete your personal information: note that where data forms part of a statutory register required by law, it cannot be deleted, but we will inform you of this at the time of your request.
• Object to processing that is not based on a legal obligation.

To exercise any of these rights, write to us at info@nib.gov.sl with "Personal Data Request" in the subject line. We will respond within 30 days. Where a request is manifestly unfounded or excessive, we may charge a reasonable fee or decline to respond, and we will tell you why.

9.  Cookies

OBRS uses session cookies that are strictly necessary for the platform to function, for example, to keep you signed in between pages. These cookies do not track you across other websites and are deleted when you close your browser or sign out. We do not use analytics or advertising cookies. No consent is required for strictly necessary cookies under applicable law, but you can disable all cookies in your browser settings; note that doing so will prevent you from signing in.

10.  Changes to this policy

This policy may be updated when there is a change in the law, a change in NIB's data processing practices, or a material change to OBRS. Where a revision is significant, registered users will be notified by email at the address on file. The version date at the top of this page reflects when the current version took effect.

11.  Contact and complaints

Questions about this policy or how your data is handled should be directed to info@nib.gov.sl or in writing to the National Investment Board, 3 Jomo Kenyatta Road, Freetown, Sierra Leone. If you are not satisfied with our response, you may make a complaint to the appropriate data protection authority in Sierra Leone.