Privacy Policy

1. Operator and document status

This preliminary document is prepared for PanovaaX Technologies Ltd, the proposed operator of PanovaaX. It is a first draft for founder and Nigerian legal counsel review, not an approved policy or a representation of regulatory compliance. It does not take effect merely because it is displayed or read.

PanovaaX connects organisations, their people and participating merchants and service providers through lifestyle benefits, everyday services and experiences. The features and contractual responsibilities described here must be checked against the services actually offered at launch.

2. Scope and data protection roles

This draft covers personal information processed through PanovaaX public forms, accounts, benefits, marketplace features, support and internal operational workflows. The Nigeria Data Protection Act 2023 and applicable directives are the intended primary framework. A privacy notice describes processing; reading it is not blanket consent to every use.

PanovaaX may determine purposes for its own account, security and service operations. Employers and providers may determine their own purposes for employee programmes or delivered services. Controller, processor or joint-controller roles must be established for each data flow, rather than assumed from a participant's title.

3. Information categories and collection sources

The current platform includes account and profile details, contact and location information, organisation membership and invitation information, benefit allocations and transaction records, marketplace booking and payment references, and information supplied in support requests. Public intake may include Launch List interest, recommendations, business or partnership applications and team applications with résumé attachments.

Community messages, uploaded materials and verification evidence may contain personal information. Information may be supplied by the person concerned, an authorised organisation, a participating business or an operational provider. Only information reasonably needed for a stated purpose should be requested; health, identity or other sensitive information needs a specific assessment, not a general permission.

Public website traffic is designed to record allowlisted page views and clicks without personal identifiers or form values. Signup totals are derived separately from profile creation. Hosting, security and provider logs may process additional technical information and require separate verification.

4. Purposes and lawful bases

Potential purposes include creating and securing accounts, linking checked organisation memberships, administering benefit programmes, processing confirmed bookings, reviewing business applications, responding to support requests, preventing fraud and preparing aggregated operational reporting.

Each processing activity needs a documented lawful basis under applicable law. Contract necessity, legal obligations, legitimate interests and consent are distinct bases, not interchangeable labels. Where legitimate interests are used, assess necessity and the person's interests and rights. Where consent is required, make it informed, specific, freely given and withdrawable.

Marketing, optional tracking, sensitive-data processing and materially new uses must be assessed separately. Withdrawal of consent does not invalidate processing already lawfully performed, but must stop future processing that depends on that consent, subject to applicable legal exceptions.

5. Recipients, service providers and international transfers

Access should be limited to authorised personnel and service providers who need the information for the agreed purpose. An employer should receive only appropriate programme information, not unrestricted access to a person's personal account or private conversations. Merchants and providers should receive only information required to supply the relevant service.

Technology, authentication, hosting, storage, payment, communication and intelligence providers may process information under appropriate agreements. Disclosure may also be required by law or necessary for a verified legal claim. Provider locations, subprocessors and cross-border transfers must be assessed against applicable safeguards; this draft does not claim all information stays in Nigeria.

6. Retention, security and incidents

Personal data should be kept only for a documented purpose and lawful retention period, then deleted, anonymised or otherwise handled under the approved schedule. Account closure must be distinguished from statutory record retention, unresolved disputes and backup handling. No universal period is adopted here.

The service uses access-controlled account and private document features, but technical safeguards alone do not establish complete compliance. Organisational measures, staff access reviews, supplier controls and incident handling need verification. No system can be represented as perfectly secure.

A personal-data incident requires containment, investigation and an assessment of legally required notifications to the Nigeria Data Protection Commission and affected people. Applicable deadlines and risk thresholds must be implemented under the Act and relevant guidance.

7. Rights, requests and complaints

Subject to applicable law and its exceptions, people may request information and access, correction, erasure, restriction, portability, object to relevant processing and withdraw consent where processing relies on it. Protections relating to solely automated decisions with significant effects require separate attention.

Requests should use a verified privacy channel with proportionate identity checks and lawful response handling. A refusal or limitation must have a lawful reason. People may complain to the Nigeria Data Protection Commission; an internal complaint process must not remove that right.

8. Children and third-party information

Do not assume that every participant has reached a particular age. Processing children's information requires a specific legal and product assessment. A person providing someone else's details must have authority or another lawful basis and should not submit unnecessary private or sensitive information.

9. Changes, effective date and acceptance

This draft is version 0.2, updated on 31 October 2026 with confirmed contact channels and current platform safeguards. Its effective date is not confirmed. Approved terms should identify the applicable version, explain material changes and use reasonable notice and explicit acceptance where the law or relationship requires it.

Visiting a page, viewing a preview or remaining silent does not create a recorded acceptance under this draft. Existing business contracts and mandatory law are not replaced by these preliminary pages.