Privacy Policy
Contents
1. The short version
We collect what we need to run your account and complete your transactions: who you are, how to reach you, and what you bought. We do not sell your data. We do not use it for advertising. We do not track you across other apps or websites. There are no third-party advertising or analytics trackers in our apps.
2. Who controls your data
Pundit Technologies (CAC BN 2580834), No. 9A Drive 6, Prince and Prince Estate, Apo, FCT Abuja, Nigeria, operates the platform.
If you are a customer, you buy from a vendor who uses our platform. That vendor is a controller of your data for their own purposes — serving you, supporting you and meeting their own legal duties — and we process it to deliver the service and as a controller for platform integrity, fraud prevention, security and our own legal obligations. Your vendor's identity is shown in the app and on their storefront.
If you are a vendor, we are the controller of your business account data.
3. What we collect
This table is the same disclosure we give to the Apple App Store and Google Play.
| Category | Examples | Why | Linked to you |
|---|---|---|---|
| Identity | Name, phone number, email address | Creating and securing your account; support | Yes |
| Authentication | Password hash, transaction PIN hash, two-factor secret, recovery codes, session tokens | Signing you in and authorising payments | Yes |
| Transactions | Orders, amounts, recipient number or meter/smartcard, wallet entries, deposit declarations | Delivering what you bought; keeping an accurate ledger; disputes | Yes |
| Financial | Bank account name and number you fund from or withdraw to; payment references | Crediting deposits and making payouts | Yes |
| Identity verification | Where required for higher limits or payouts: government ID details, BVN or NIN as required by a payment partner | Legal and payment-partner obligations | Yes |
| Device and diagnostics | IP address, app version, device model, operating system, crash and error logs | Security, fraud prevention, fixing faults | Yes |
| Support | Messages you send us and our replies | Answering you; a record of what was agreed | Yes |
We do not collect your precise location, your contacts, your photos, your browsing history outside our service, or any advertising identifier. We do not fingerprint your device for tracking.
Card details are entered on the payment gateway's own page and are never received or stored by us. We see only the outcome of the payment and a reference.
4. Why we use it
Under the Nigeria Data Protection Act 2023 we rely on these lawful bases:
| Purpose | Lawful basis |
|---|---|
| Creating your account and completing your orders | Performance of a contract |
| Keeping an accurate financial record | Legal obligation; legitimate interest |
| Fraud prevention, security and abuse detection | Legitimate interest |
| Identity verification where required | Legal obligation |
| Transactional messages (receipts, order outcomes, security alerts) | Performance of a contract |
| Marketing messages, where we send them | Consent, which you can withdraw at any time |
We do not make decisions producing legal effects about you by automated means alone. Automated checks may flag a transaction or an account for review; a person decides the outcome.
5. Who we share it with
We share only what each recipient needs:
- Your vendor — if you are a customer, the vendor you buy from sees your account and your transactions with them. They cannot see any other vendor's customers, and no other vendor can see you.
- Network operators, billers and aggregators — the recipient number, meter number or smartcard number needed to deliver what you bought.
- Payment gateways and banks — the reference and amount needed to take or send a payment.
- Infrastructure providers — our hosting and messaging providers, under contract, acting on our instructions only.
- Authorities — where we are required by law, a court order, or a lawful regulatory request.
We do not sell personal data and we do not share it for advertising.
6. How long we keep it
| Data | Kept for |
|---|---|
| Account profile | While the account is open, then up to 90 days |
| Transaction and ledger records | At least 7 years, as financial records require |
| Identity verification records | As required by the relevant payment partner or law |
| Diagnostic and error logs | Up to 90 days |
| Support correspondence | Up to 3 years |
Financial records outlive your account on purpose. We cannot delete the record of a payment that was made; we can, and do, detach it from your profile when your account is deleted.
7. How we protect it
- Traffic is encrypted in transit (TLS 1.2 or better).
- Passwords and transaction PINs are hashed, never stored in a readable form. A PIN is hashed at the same cost as a password precisely because it is short.
- Credentials belonging to vendors and to the platform are encrypted at rest and are never returned by our API in readable form.
- Each vendor's data is isolated twice over: in the application, and again by the database itself, so a fault in one layer is caught by the other.
- The financial ledger is append-only. It cannot be rewritten, by us or by anyone else — a correction is a new entry.
- Accounts that can move money require a second factor.
- Access to production systems is limited to staff who need it, and administrative actions are recorded in an audit trail.
No system is perfectly secure. If a breach affects your rights we will notify you and the Nigeria Data Protection Commission as the law requires.
8. Your rights
Under the Nigeria Data Protection Act 2023 you may:
- ask what personal data we hold about you and get a copy;
- have inaccurate data corrected;
- ask us to delete data we no longer have a lawful reason to keep;
- object to, or ask us to restrict, certain processing;
- receive data you gave us in a portable format;
- withdraw consent where we relied on it, without affecting what we did before;
- complain to the Nigeria Data Protection Commission.
Write to pundittechnology@gmail.com. We respond within 30 days. We may need to verify your identity first — we will not hand someone else your transaction history on the strength of an email address.
9. Deleting your account
You can request deletion from inside the app, or at vtu.pits.ng/delete-account. That page explains exactly what is removed, what is kept, and for how long.
10. Children
The service is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, tell us and we will remove it.
11. Transfers outside Nigeria
Our primary infrastructure is operated for the Nigerian market. Some providers — for example error reporting or email delivery — may process data outside Nigeria. Where that happens we transfer only under a lawful mechanism recognised by the Nigeria Data Protection Act, and under contracts requiring an adequate level of protection.
12. Changes
We will post any change here and update the date at the top. If a change materially affects how we use your data we will tell you in the app or by email before it takes effect.
13. Contact and complaints
Data Protection contact, Pundit Technologies
No. 9A Drive 6, Prince and Prince Estate, Apo, FCT Abuja, Nigeria
pundittechnology@gmail.com
If you are not satisfied with our response you may complain to the Nigeria Data Protection Commission.