Privacy Policy

Contents

1. Introduction
2. Information We Collect
3. Legal Basis for Data Processing
4. How We Use Your Information
5. Sharing and Disclosure of Your Data
6. Data Security and Retention
7. Your Rights as a Data Subject
8. Changes to This Privacy Policy
9. Contact Information

Introduction
At ElitePoints, protecting your personal information is fundamental to our operations and commitment to you. This Privacy Policy explains how we collect, use, share, and safeguard your data in compliance with Nigerian data protection law, including the Nigeria Data Protection Regulation (NDPR). We are dedicated to transparency, accountability, and the responsible management of your data.
Information We Collect
Personal Information
When you register for or use our services, we may collect and process the following personal data:
• Identification & Contact Data: Your name, email address, phone number, and mailing address.
• Account Credentials: Username, password (securely encrypted), and any other details required for account management.
• Payment & Transaction Data: Payment methods and transaction details, processed securely by our trusted partners.
• Other Information: Data you provide through customer support or surveys, as well as any information you choose to share via our platforms.
Technical and Usage Data
To enhance your experience and secure our systems, we also collect:
• Usage Data: Pages visited, features used, and interaction duration.
• Device & Log Data: IP address, browser type, operating system, and device identifiers.
• Location Data: Your device's precise GPS coordinates to provide store proximity alerts. This includes:
  • Your real-time location when the app is active and you have granted location permissions
  • GPS coordinates to detect when you are within 500 meters of a partner store
  • Location history for determining home and work locations (processed on your device only)
  Important: Location data is processed locally on your device and is never transmitted to our servers. You maintain full control and can disable location services at any time through your device settings or the app's settings menu.
• Cookies & Tracking Technologies: Used to personalize your experience, monitor service performance, and secure your interactions with our site.
Legal Basis for Data Processing
ElitePoints processes your personal data in accordance with the NDPR and other applicable laws. Our legal bases include:
• Consent: Where you have given clear permission for us to process your data for a specific purpose, including explicit permission to access your device location.
• Contractual Necessity: To provide, maintain, and improve our services, including processing transactions and managing your account.
• Legal Obligations: To comply with applicable laws, regulatory requirements, and to protect our legal rights.
• Legitimate Interests: When necessary for our legitimate interests, provided such interests are not overridden by your rights and freedoms.
How We Use Your Information
We use your data for several key purposes:
• Service Provision & Improvement: To operate and enhance our platform, manage your loyalty points, and customize your user experience.
• Store Proximity Alerts: To send you notifications when you are near a partner store location (within 500 meters), helping you discover opportunities to earn or redeem ElitePoints. This feature:
  • Works only when you have explicitly granted location permission
  • Processes your location on your device only
  • Includes smart safeguards to prevent notification spam (maximum 3 alerts per day, 72-hour cooldown per store, and detection of home/work locations)
  • Does not send location data to our servers
• Communication: To send you essential updates, respond to your inquiries, and inform you about promotions, subject to your consent.
• Transaction Processing: To securely manage payment processing and record keeping.
• Security & Compliance: To detect, prevent, and mitigate security threats and to comply with legal obligations.
Sharing and Disclosure of Your Data
Your privacy is paramount, and we share your personal data only under the following circumstances:
• Trusted Service Providers: We may disclose information to third-party vendors who assist in payment processing, data analytics, and customer support, under strict confidentiality and security agreements. Location data is not shared with third parties.
• Legal & Regulatory Requirements: When required by law, regulation, or legal process, or to protect the rights, property, or safety of ElitePoints, our users, or others.
• Business Transfers: In the event of a merger, acquisition, or asset sale, your information may be transferred to the new entity, with the assurance that the new party will continue to protect your data in accordance with this policy.
• Cross-Border Data Transfers: Where your data is transferred outside Nigeria, we ensure that adequate safeguards are in place to protect your personal information.
Data Security and Retention
Security Measures
ElitePoints employs robust security measures including:
• Encryption: Sensitive data is encrypted both in transit and at rest.
• Access Controls: Only authorized personnel have access to your data, based on role-specific needs.
• On-Device Processing: Location data for proximity alerts is processed directly on your device without transmission to our servers, providing an additional layer of privacy protection.
• Regular Audits: We conduct periodic security reviews and audits to ensure the ongoing protection of your data.

Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy and to comply with legal obligations. When your data is no longer required, it will be securely disposed of or anonymized.
Location data processed for proximity alerts is retained only on your device and is not stored on our servers.
Your Rights as a Data Subject
In line with the NDPR, you have the following rights regarding your personal data:
• Right of Access: Request details of the personal data we hold about you.
• Right to Correction: Request corrections to any inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data, subject to legal and operational constraints.
• Right to Object: Object to or restrict the processing of your data in certain circumstances, including location processing. You can disable location access through your device settings or our app settings at any time.
• Right to Data Portability: Request the transfer of your data to another service provider, where technically feasible.
• Right to Withdraw Consent: At any time, you may withdraw consent for the processing of your data, where processing is based solely on consent. This includes withdrawing permission for location data collection through your device settings.
To exercise any of these rights, or for inquiries regarding our data practices, please contact us using the details provided below.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The revised version will be posted on our website with an updated effective date. We encourage you to review this policy periodically.
Contact Information
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact: