Privacy Policy

Who is responsible for your data

Version 2026-10 · Effective [CONFIRM: date]

This policy explains what personal data Platnova collects, why, who we share it with, how long we keep it and the rights you have. It is written to meet the Nigeria Data Protection Act 2023 ("NDPA") and applies wherever you use Platnova.

1. Who is responsible for your data

Platnova Technologies Limited (RC 6934651), Milagro Mall, Orchid Road, Eleganza Bus Stop, Lekki, Lagos, Nigeria, is the data controller for the personal data described here.

Data Protection Officer: legal@platnova.com.ng. Contact our DPO about anything in this policy or to exercise your rights (section 9).

Where a Partner, such as a bank, card issuer or travel supplier, decides for itself how to use your data to provide its own regulated service, that Partner is also a controller, and its own privacy notice applies to that use.

2. The data we collect

You give us:

  • Identity: name, date of birth, gender, nationality, username and Nova Tag.
  • Contact: email address, phone number, residential address.
  • Verification: BVN or NIN, passport, driving licence, voter's card or national ID, proof of address and, where needed, proof of funds.
  • Biometric data: a selfie and short liveness capture, used to confirm you are a real person and match your ID. We also use it when you sign in on a new device or make a sensitive change. Biometric data is sensitive personal data under the NDPA. We collect it only with your explicit consent, given at the point of capture, and use it only for these checks.
  • Financial: bank and card details you add, beneficiaries, and the details of payments you make and receive.
  • Communications: support chats (including with our AI assistant, Nova), messages, voice notes and attachments you send to other users, and call records. We store who called whom and when, not the call itself.
  • Other products: travel bookings (passenger names, passport details where the airline requires them), share-offer applications (CSCS/CHN number, dividend account, and details of a child or other adult you apply for), and gift card or eSIM orders.

We collect automatically:

  • Device and usage: device ID, model and operating system, app version, IP address, approximate country, push-notification tokens, sign-in events and security signals, and how you use the app (screens and features).
  • Location: only if you allow it, to help you pick an address on a map. We do not track your location.
  • Contacts: only if you allow it, read on your device to help you choose a phone number for airtime. Your contact list is not uploaded to us.

We receive from others:

  • results of identity, BVN, NIN and address checks from verification providers;
  • payment and transaction information from banks and payment Partners;
  • fraud and sanctions-screening results; and
  • information from the person who referred you or sent you a payment request.

3. Why we use your data, and our lawful basis

Opening and running your account, processing payments and providing the products you choose — performance of our contract with you.

Verifying your identity, screening for sanctions, preventing money laundering and fraud, keeping records and reporting to authorities — legal obligation.

Biometric liveness and face matching — your explicit consent, and legal obligation for identity verification.

Securing accounts: device checks, step-up verification, detecting unusual activity — legitimate interests (keeping you and the platform safe) and legal obligation.

Customer support, including Nova AI — contract; legitimate interests (resolving your issue quickly).

Improving the app: usage analytics and crash reports — legitimate interests. You can turn analytics off at any time (section 7).

Service messages about your account, payments and security — contract and legal obligation (these cannot be turned off).

Marketing: news, offers and referral promotions — your consent. Off unless you opt in, and you can withdraw at any time.

We will not use your data for a new purpose that is incompatible with these without telling you and, where required, asking for your consent.

4. Automated decisions

Some checks run automatically:

  • liveness and face matching at verification and sign-in;
  • fraud and risk scoring on sign-ins and transactions; and
  • confirming you meet our age and country requirements.

An automated check can delay or decline an action. If a decision that significantly affects you is made automatically, you can ask for a person to review it, explain your point of view and contest it. Contact support or our DPO.

5. Who we share your data with

We share only what each party needs:

  • Banking, payment and card Partners that hold funds, issue accounts and cards and move money for you. Examples include Bridge, Revolut, Flutterwave, Paga, PalmPay, Blusalt and Globus Bank, Miden and Hostcap. The Partners involved depend on the product and currency you use.
  • Identity and verification providers: Smile ID, Prembly, Sumsub, QoreID, and Amazon Web Services (Rekognition liveness and Textract document reading). OpenAI is used to read address documents and match bank names.
  • Service providers that run our platform: hosting and infrastructure (Google Cloud London and Amazon Web Services; Cloudflare for security and delivery), messaging (email via Amazon SES, SMS via Termii, push notifications via Ably, Firebase Cloud Messaging, Apple Push Notification service, OneSignal), calls (Agora), support tools (Zoho, and Anthropic, which provides the AI model behind Nova), analytics and crash reporting (Amplitude, Google Firebase), error monitoring (Sentry), and marketing email (Sendy, only if you opted in).
  • Product partners, when you use their product: travel (Duffel, Mapbox for place search), bills and gift cards (Reloadly, CoralPay, Xpress, Paga), eSIMs (eSIM Go), and the broker, registrar and receiving parties for a share offer.
  • Authorities: regulators, law enforcement, courts and tax authorities, where the law requires it.
  • Others with your instruction: for example the person you pay, or someone you choose to share a receipt with.
  • A buyer or successor, if our business is reorganised or sold. They will be bound by this policy.

Our service providers act on our instructions under written contracts that require them to keep your data secure and confidential. We do not sell your personal data.

6. International transfers

Some of the parties above store or process data outside Nigeria, including in the United Kingdom, the European Union and the United States. Our main servers are in London. When we transfer personal data abroad we do so in line with NDPA Part VIII. That means the destination provides adequate protection, or we use appropriate safeguards such as contractual clauses that bind the recipient to equivalent protection. Where neither applies, we rely on another basis the NDPA permits, such as the transfer being necessary to perform our contract with you. Ask our DPO for details of the safeguards for a particular transfer.

7. Your choices

  • Marketing: off by default. Turn it on or off in Settings → Legal → Marketing messages, or use the unsubscribe link in any marketing email.
  • Analytics: on by default, because it helps us find and fix problems. Turn it off in Settings → Legal → Share usage analytics, and we stop sending analytics events from your device.
  • Device permissions (camera, photos, contacts, location, microphone, notifications) are optional, apart from those a feature cannot work without. You can change them in your device settings.

8. How long we keep your data

  • While your account is open, we keep the data we need to provide the Services.
  • After your account is closed, the law requires us to keep identity-verification records and transaction records for [CONFIRM: statutory period, e.g. 5 years under the Money Laundering (Prevention and Prohibition) Act 2022]. During that period we store them securely, restrict access and use them only to meet our legal obligations, then delete or anonymise them.
  • Other personal data, such as marketing preferences, device tokens and app preferences, is deleted or anonymised when your account is closed, or on request, where no legal duty requires us to keep it.
  • Unfinished sign-ups, where the account was never confirmed, are deleted automatically.

9. Your rights

Under the NDPA you have the right to:

  • be informed about how we use your data (this policy);
  • access the personal data we hold about you and receive a copy;
  • correct inaccurate or incomplete data;
  • delete your data, where we no longer need it and the law does not require us to keep it;
  • restrict or object to processing based on our legitimate interests, including profiling;
  • withdraw consent at any time, for marketing or biometrics. Withdrawing consent does not affect processing already carried out, but without biometric consent we may be unable to verify you;
  • data portability: receive data you gave us in a commonly used format, or have it sent to another provider where technically feasible;
  • not be subject to a decision based solely on automated processing that significantly affects you, without the safeguards in section 4; and
  • complain to the Nigeria Data Protection Commission (NDPC). We would appreciate the chance to help first.

To exercise a right, email legal@platnova.com.ng or use Help & Support in the app. We will verify your identity before acting. We will respond within [CONFIRM: response time permitted by the NDPA and our process] and tell you if we need longer or cannot fully comply, and why.

10. Security

We protect your data with measures appropriate to the risk:

  • encryption in transit;
  • access controls and logging for staff;
  • multi-factor authentication for staff and customers; and
  • regular security reviews.

If a personal data breach is likely to put your rights at risk, we will notify the NDPC within 72 hours of becoming aware of it, as the NDPA requires. Where the risk to you is high, we will also tell you directly and explain what you can do.

11. Children

Platnova accounts are for people aged 18 and over. We do not knowingly open accounts for children. If we learn a child has opened an account, we will close it and handle their data as this policy describes. When an adult applies for a share offer on behalf of a child, we collect the child's details only for that application, with the adult's authority as parent or guardian.

12. Cookies and similar technologies

Our websites use cookies and similar technologies, and our app uses software development kits for analytics and crash reporting. Our Cookie Policy explains which ones and how to control them.

13. Changes to this policy

We will update this policy when our practices or the law change. For changes that matter to you, we will notify you in the app and by email before they take effect. Where a change relies on your consent, we will ask for it again. Each version is dated and numbered, and you can find it under Settings → Legal.

14. Contact

  • Data Protection Officer: legal@platnova.com.ng
  • Account help: support@platnova.com
  • Post: Platnova Technologies Limited, Milagro Mall, Orchid Road, Eleganza Bus Stop, Lekki, Lagos, Nigeria