Privacy notice
Draft for legal review — last updated [date]. Prepared with reference to the Nigeria Data Protection Act 2023 and the NDPC General Application and Implementation Directive.
1. Who controls your data
Kitovu Technology Company Limited (RC 1348965), Kitovu Business Hub, Sawmill Area, Iseyin-Saki Expressway, Iseyin, Oyo State, Nigeria, is the data controller for ComboTrader.
Data Protection Officer: [name], privacy@combotrader.com.ng.
2. What we collect
| Category | Examples |
|---|---|
| Identity and contact | Name, email, phone number, country, city, next of kin |
| Verification | Results of BVN and bank-account checks from Paystack; ID documents you upload (Champions outside Nigeria) |
| Financial | Bank account for payouts, wallet transactions, trades, payments (card details are handled by Paystack and never reach us) |
| Account and security | Password (stored only as a one-way hash), two-step verification settings, log-in times, IP addresses and device type |
| Communications | Messages to support, newsletter preferences, chat conversations through tawk.to |
| Usage | Pages visited and actions taken on the Platform, to keep it secure and working |
We do not knowingly collect data from anyone under 18.
Your BVN is sent to Paystack for verification and is not stored by ComboTrader.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis (NDPA) |
|---|---|
| Open and run your account, wallet and trades; pay you | Performance of our contract with you |
| Verify identity; prevent fraud and money laundering; keep financial records | Legal obligation; legitimate interest in preventing fraud |
| Send trade, payout and security messages | Performance of contract |
| Send the newsletter and marketing | Consent (you can withdraw at any time) |
| Show your first name and city in the live activity feed | Consent (opt in at sign-up; change in your profile) |
| Live chat cookies (tawk.to) | Consent through the cookie banner |
| Improve and secure the Platform | Legitimate interest |
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Large price movements and some withdrawals are reviewed by a person.
4. Who we share it with
- Paystack — payments, transfers and identity checks
- Email and SMS providers — [Resend/Brevo, Termii] — to send you messages
- tawk.to — live chat, only if you accept chat cookies
- Meta (WhatsApp) — if you message us on WhatsApp or turn on WhatsApp updates
- Anthropic — an AI service that drafts support replies and internal reports; it receives only the question and the account details needed to answer it, under a data processing agreement, and does not use them to train its models [confirm in the signed terms]
- Hosting provider — [name and location]
- Professional advisers and auditors, under confidentiality
- Regulators, law enforcement and courts, where the law requires
We do not sell your personal data.
5. International transfers
Some providers process data outside Nigeria. We transfer data only where the recipient is subject to adequate protection, such as appropriate contractual safeguards, as required by the NDPA.
6. How long we keep it
- Account, trade and transaction records: for the life of your account and at least [6] years after it closes, to meet financial record-keeping and anti-money-laundering obligations.
- ID documents: until verification is complete and then for the record-keeping period above.
- Marketing preferences: until you unsubscribe.
- Security logs: [12] months.
7. Your rights
Under the NDPA you can:
- ask whether we hold your data and get a copy, including in electronic form;
- correct inaccurate data;
- ask us to delete data we no longer need;
- object to processing based on legitimate interest, or to marketing;
- withdraw consent at any time (this does not affect processing before withdrawal);
- not be subject to decisions based solely on automated processing (no decision about your money or account is made by AI alone);
- download your data yourself (Profile → Your data and statements), and close your account from your profile;
- complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
Email privacy@combotrader.com.ng. We will respond without undue delay and in any case within [30] days. Some data must be kept by law even if you ask us to delete it; we will tell you if that applies.
8. Security
We encrypt data in transit, store passwords as one-way hashes, require two-step verification for staff, restrict access by role, and log every administrative action. If a breach is likely to put your rights at risk, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it and tell you promptly, with steps you can take.
9. Changes
We will post any changes here and tell you of material changes by email or in the app.