Privacy Policy

1. Introduction

Welcome to VecoXL ("VecoXL", "we", "us", or "our"). VecoXL is a platform that enables individuals, businesses, organisations and other users to distribute airtime and, as the platform develops, other digital products and services to intended recipients. We recognise the importance of protecting your personal data and respecting your privacy.

This Data Privacy Policy explains how VecoXL collects, uses, stores, shares and protects personal data when you use our website, applications, APIs and related services. This Policy is designed in accordance with the Nigeria Data Protection Act, 2023 (NDPA) and other applicable data protection laws and regulations. The NDPA requires organisations processing personal data to provide data subjects with clear information about the processing of their data and to respect applicable data subject rights.

By using VecoXL, you acknowledge that you have read and understood this Privacy Policy. Where applicable law requires your consent for a particular processing activity, we will obtain that consent separately.

2. Who Is Responsible for Your Personal Data?

The entity responsible for determining how and why your personal data is processed through VecoXL is:

• Legal Name: Pitchvide Technologies
• Trading Name: VecoXL
• Website: https://pitchvide.com
• Email: contact@pitchvide.com

For the purposes of applicable Nigerian data protection law, VecoXL may act as a Data Controller for personal data that we process for our own purposes. In some circumstances, VecoXL may process personal data on behalf of a business or organisation using our services. In those circumstances, our role may be that of a Data Processor, depending on the nature of the processing and the relationship between the parties.

3. What Personal Data Do We Collect?

The information we collect depends on how you use VecoXL. We aim to collect only information that is reasonably necessary for the purpose for which it is being processed.

3.1 Account information

When you create a VecoXL account, we may collect: full name, email address, phone number, password or authentication credentials, account identifiers, account status, and security and authentication information. Passwords are not intended to be stored in plain text.

3.2 Identity and verification information

Where identity verification is required for a particular VecoXL service, we may collect information such as: date of birth, Bank Verification Number (BVN), name associated with a BVN, identity verification results, verification status, and information required to satisfy applicable legal, regulatory, fraud-prevention or financial-service requirements.

Where we use a third-party identity or verification provider, your information may be transmitted to that provider for the relevant verification purpose. For example, where applicable to our services, VecoXL may use a payment or identity-verification provider to verify information supplied by you. We will not request identity information that is unnecessary for the service being provided.

3.3 Wallet and transaction information

When you fund or use a VecoXL wallet, we may process: wallet ID, transaction ID, amount, transaction type, transaction status, payment reference, funding information, recipient information, airtime transaction information, date and time of transactions, and related account and ledger information.

Where payments are processed through a third-party payment provider, sensitive payment information may be processed directly by that provider in accordance with its own privacy policy. VecoXL does not intend to store payment card information that we do not need to provide our services.

3.4 Recipient information

When you use VecoXL to send airtime or another product to another person, you may provide information about that recipient. This may include: phone number, name, email address, amount to be distributed, transaction information, and other information you choose to associate with the recipient.

You are responsible for ensuring that you have an appropriate basis for providing another person's personal data to VecoXL. For example, if you upload an Excel file containing the phone numbers of recipients, you should only provide information that you are permitted to provide and use for the intended purpose.

3.5 Lists and uploaded files

Where the relevant feature is available, VecoXL may allow users to create recipient lists or upload files such as Excel or CSV files. These files may contain information such as: names, phone numbers, email addresses, amounts, and other recipient information supplied by the user. We process this information to provide the requested distribution service. We do not sell uploaded recipient lists to third parties.

3.6 Technical information

When you use VecoXL, we may automatically collect certain technical information, including: IP address, browser type, device type, operating system, application information, login activity, authentication events, approximate location derived from technical information where necessary, error logs, security logs, and usage information. We use this information primarily to operate, secure and improve VecoXL.

4. How We Use Your Personal Data

We may use personal data for the following purposes:

Providing our services

To create and manage your account, provide wallet functionality, process airtime transactions, process recipient distributions, manage recipient lists, process payments, provide customer support, maintain transaction records, and provide services you request.

Security and fraud prevention

To protect accounts, detect suspicious activity, prevent fraud and abuse, investigate security incidents, protect our users and infrastructure, and enforce our Terms of Service.

Identity verification

Where required, to verify your identity, meet applicable legal or regulatory requirements, establish eligibility for particular services, prevent impersonation and fraud, and maintain appropriate account and transaction controls.

Legal and regulatory compliance

We may process personal data where necessary to comply with applicable law, respond to lawful requests from regulators, courts or law-enforcement authorities, meet financial, accounting or reporting obligations, and prevent or investigate unlawful activity.

Service improvement

We may use appropriate information to understand how our services are used, identify technical problems, improve performance, develop new features, and monitor service reliability. Where possible, we may use aggregated or de-identified information for these purposes.

5. Lawful Bases for Processing

We process personal data only where we have a lawful basis to do so. Depending on the circumstances, our lawful basis may include:

Performance of a contract

We may process information necessary to provide services you have requested or to take steps at your request before entering into a contract. For example, processing your account information and transaction information may be necessary to provide your VecoXL account and distribution services.

Legal obligation

We may process information where required to comply with applicable laws, regulations, regulatory requirements or lawful orders.

Consent

Where consent is required, we will request it in an appropriate manner. You may withdraw consent where applicable. Withdrawal of consent does not affect processing that occurred before the withdrawal or processing that has another lawful basis.

Legitimate interests

Where permitted by law, we may process personal data where necessary for legitimate interests, provided that those interests do not override your applicable privacy rights and interests. Examples may include: fraud prevention, information security, service improvement, protection of our systems, and business administration.

The NDPA recognises several lawful bases for processing, including consent, contractual necessity, legal obligations and legitimate interests, subject to the requirements of the Act.

6. Data Minimisation

We aim to collect and process only personal data that is relevant and reasonably necessary for the purpose for which it is being used. For example, if a VecoXL service only requires a recipient's phone number to deliver airtime, we do not require the recipient to provide unnecessary identity information merely to receive that airtime. Our processing is guided by the principles of purpose limitation and data minimisation under the NDPA.

7. How We Share Personal Data

We may share personal data with trusted third parties where necessary to provide VecoXL services or comply with applicable law. These may include:

• Payment providers: We may use third-party payment providers to process wallet funding, payments and related transactions.
• Identity verification providers: Where identity verification is required, we may use third-party identity verification providers.
• Airtime and service providers: We may share necessary recipient information with telecommunications providers, aggregators or other service providers to fulfil transactions.
• Technology providers: We may use cloud infrastructure providers, database and hosting providers, monitoring and security providers, communication providers, email/SMS providers, and software infrastructure providers.
• Professional advisers: Where reasonably necessary, we may disclose information to professional advisers such as lawyers, accountants, auditors or compliance professionals.
• Government authorities: We may disclose information where required by applicable law, court order, regulatory requirement or lawful government request.

We require relevant service providers to handle personal data appropriately and to implement suitable security and confidentiality measures. The NDPA places obligations on controllers when engaging processors and requires appropriate measures to protect data subjects' rights.

8. International Transfers

Some of our technology, infrastructure or service providers may process personal data outside Nigeria. Where personal data is transferred outside Nigeria, we will take appropriate steps to ensure that the transfer and subsequent processing comply with applicable Nigerian data protection requirements. Depending on the circumstances, this may include appropriate contractual, organisational or other safeguards required by applicable law.

9. How We Protect Your Personal Data

We use appropriate technical and organisational measures designed to protect personal data against: unauthorised access, unauthorised disclosure, accidental loss, destruction, alteration, unauthorised processing, fraud, and other security threats.

Depending on the system and information involved, our security measures may include: encryption in transit, encryption or appropriate protection at rest, password hashing, access controls, authentication mechanisms, role-based permissions, audit logging, secure infrastructure, monitoring and security controls, backups, security testing, and internal access restrictions.

No internet-based system can be guaranteed to be completely secure. However, we continuously work to improve the security of our systems.

10. Data Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, unless a longer retention period is required or permitted by law. Retention periods may depend on: the type of information, the purpose for processing, whether your account remains active, legal or regulatory requirements, fraud prevention requirements, financial and accounting obligations, dispute resolution, and security requirements.

When personal data is no longer required, we will take reasonable steps to delete, anonymise or securely dispose of it. The NDPA requires personal data not to be retained for longer than necessary for the relevant lawful purpose, subject to applicable exceptions.

11. Your Rights

Subject to applicable law and any relevant exceptions, you may have rights including the right to: be informed about the processing of your personal data; request access to personal data we hold about you; request correction of inaccurate or incomplete information; request deletion or erasure of personal data; request restriction of processing in appropriate circumstances; object to certain processing; withdraw consent where processing is based on consent; request data portability where applicable; lodge a complaint regarding the processing of your personal data; and exercise other rights provided under applicable data protection law.

The NDPC identifies rights including access, rectification, objection, restriction, portability, erasure and the right not to be subjected to certain automated decision-making. Some rights are subject to legal limitations. For example, VecoXL may need to retain certain information where required by law or where necessary to establish, exercise or defend legal claims.

12. How to Exercise Your Rights

To exercise your privacy rights, contact: Privacy / Data Protection Email: hello@vecoxl.com

Your request should include enough information for us to understand and verify the request. For security purposes, we may need to verify your identity before responding to certain requests. We will process requests within the timeframes required by applicable law.

The NDPC itself states that data subjects can make access requests for the personal data held about them and associated information about processing and applicable retention periods.

13. Accuracy of Your Information

We expect personal information provided to VecoXL to be accurate and, where necessary, kept up to date. You should notify us or update your account information where you believe information associated with your account is inaccurate or incomplete. Where we identify inaccurate information, we may take reasonable steps to correct it.

14. Children's Privacy

VecoXL is not intended to be used by children in circumstances where applicable law requires parental or guardian involvement. We do not knowingly collect personal data from children where such collection is prohibited by applicable law. If you believe that a child has provided personal data to us improperly, please contact us at: hello@vecoxl.com

15. Cookies and Similar Technologies

VecoXL may use cookies and similar technologies to keep you logged in, maintain security, remember preferences, understand how our website is used, diagnose technical problems, and improve our services.

Where required, we will provide appropriate cookie controls and information about the cookies we use. You may be able to manage cookies through your browser settings or through controls provided by VecoXL.

16. Marketing Communications

Where we send marketing or promotional communications, we will do so in accordance with applicable law. You may opt out of marketing communications by using the unsubscribe mechanism provided in the communication or by contacting us. Opting out of marketing communications does not necessarily stop essential service communications, such as security alerts, transaction notifications or important account messages.

17. Third-Party Websites and Services

VecoXL may contain links to third-party websites or integrate with third-party services. Those third parties may have their own privacy policies and terms. This Privacy Policy does not govern the privacy practices of third parties that we do not control. We encourage you to review the privacy policies of third-party services before providing them with personal information.

18. Data Breaches and Security Incidents

We maintain procedures designed to detect, assess and respond to personal data breaches and other security incidents. Where applicable, we will take steps required by the NDPA and other applicable laws, including notifying the relevant regulatory authority and affected data subjects where notification is legally required. We will also take reasonable steps to contain, investigate and remediate security incidents.

19. Automated Decision-Making

VecoXL may use automated systems for purposes such as: security monitoring, fraud detection, transaction monitoring, account protection, and service optimisation. Where applicable law gives you a right relating to solely automated decision-making that produces legal or similarly significant effects, you may contact us to exercise that right.

20. Changes to Your Personal Data

You may update certain personal information through your VecoXL account where the relevant functionality is available. Where information cannot be changed directly through your account, you may contact us. We may request additional information where necessary to verify the requested change.

21. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes may be made where: our services change, our data processing practices change, applicable law changes, regulatory guidance changes, we introduce new products or features, or we identify ways to improve transparency.

When we make material changes, we will provide appropriate notice. The updated version will be published on the relevant VecoXL platform with a revised "Last Updated" date.

22. Complaints

If you have a concern about how VecoXL processes your personal data, we encourage you to contact us first. Email: hello@vecoxl.com

We will investigate privacy complaints and take reasonable steps to resolve legitimate concerns. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) where applicable. The NDPC is Nigeria's supervisory authority for data protection.

23. Contact Us

If you have questions about this Privacy Policy, your personal data, or your privacy rights, please contact us:

• VecoXL
• Legal Entity: Pitchvide Technologies
• Website: https://pitchvide.com
• Email: contact@pitchvide.com