1. Introduction
This Privacy Policy is intended to comply with applicable data protection and privacy laws, including the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Regulation 2019 (NDPR), and, where applicable, the General Data Protection Regulation (GDPR). By accessing or using our services, you acknowledge that you have read and understood this Privacy Policy and consent to the practices described herein where consent is required.
2. Definitions
For the purpose of this Privacy Policy, Personal Data means any information relating to an identified or identifiable natural person. Processing means any operation performed on personal data, including collection, recording, storage, use, disclosure, transfer, deletion, or destruction. Data Subject means the individual whose personal data is processed. Data Controller means the entity that determines the purposes and means of processing personal data. Data Processor means an entity that processes personal data on behalf of a controller.
3. Information we collect
We may collect identification data, financial and transactional data, technical data, business data, and compliance and security data. This can include your name, contact details, government-issued identification documents, bank account details, tax identification information, transaction history, cryptocurrency wallet addresses, trade notes, IP address, browser type and version, device identifiers, operating system, usage logs, cookies and tracking technologies, company registration documents, tax compliance records, business agreements, compliance and audit documentation, fraud monitoring information, AML/KYC verification records, authentication logs, and audit trail records.
4. How we collect information
We collect information through user registration forms, transactions conducted on the platform, customer support interactions, cookies and automated tracking technologies, third-party integrations and payment providers, compliance verification procedures, and API integrations and connected services.
5. Lawful basis for processing
We process personal data under one or more lawful bases. Consent applies where you provide explicit consent through platform consent mechanisms, toggles, or acceptance prompts. Contractual necessity applies where processing is necessary to perform obligations under agreements with you or your business. Legal obligation applies where processing is required to comply with tax laws, anti-money laundering obligations, financial reporting requirements, regulatory directives, court orders, or lawful government requests. Legitimate interests apply where processing is necessary for fraud prevention, cybersecurity, service improvement, operational efficiency, dispute resolution, business continuity, and protection of Tradepal AI's legal rights.
6. Use of personal data
We may use your information to provide and maintain our services, verify identity and conduct KYC checks, process transactions and payments, facilitate cryptocurrency-related transactions, monitor compliance obligations, detect fraud, abuse, or unauthorized activity, improve user experience and platform functionality, provide customer support, generate analytics and usage insights, send service notifications and updates, and comply with legal and regulatory obligations. Cryptocurrency wallet information is processed solely for transaction facilitation, compliance monitoring, fraud prevention, and lawful reporting.
8. User rights
Subject to applicable laws, you may provide or withdraw consent at any time through platform settings or by contacting us. You may request access to your personal data and obtain copies in machine-readable formats such as CSV, JSON, or PDF. You may correct inaccurate or incomplete personal data, request deletion of your account and personal data subject to legal and regulatory retention obligations, request restrictions on certain processing activities, enable privacy settings such as masking wallet addresses or limiting data visibility, export and transfer your personal data to another service provider, and object to certain types of processing. Deletion requests will generally be processed within 30 days unless retention is required by law.
9. Data controller and processor role
Tradepal AI generally acts as a Data Controller for customer account information and may act as a Data Processor where services are provided on behalf of enterprise or business clients. All third parties receiving personal data are required to implement appropriate security and confidentiality safeguards.
10. International data transfers
Personal data may be transferred outside Nigeria where necessary for service delivery, cloud hosting, analytics, compliance, or infrastructure operations. Where international transfers occur, Tradepal AI ensures appropriate safeguards are implemented, including Standard Contractual Clauses (SCCs), adequacy decisions, contractual confidentiality obligations, or other lawful transfer mechanisms recognized under the NDPA and GDPR. Data may be hosted on secure cloud infrastructure located in jurisdictions outside Nigeria.
11. Data retention
We retain personal data only for as long as reasonably necessary to fulfill the purposes for which the data was collected, comply with legal and regulatory obligations, resolve disputes, enforce agreements, and maintain audit and security records. Typical retention periods may include financial and tax records for up to 7 years, compliance and AML/KYC records as required by law, security and audit logs for 12 to 24 months, and account information until account deletion or prolonged inactivity. Where retention is no longer necessary, personal data will be securely deleted, anonymized, or archived in accordance with applicable laws and internal retention schedules.
12. Security measures
We use role-based access controls, end-to-end encryption of sensitive information, multi-factor authentication for privileged accounts, secure server infrastructure, audit logging and monitoring, periodic vulnerability assessments, employee confidentiality obligations, and security incident response procedures. Despite these safeguards, no system can guarantee absolute security.
13. Data breach notification
In the event of a personal data breach, Tradepal AI will take reasonable steps to investigate and contain the incident, assess associated risks, mitigate potential harm, and notify affected users and relevant authorities where legally required. Notifications may be delivered through email, SMS, WhatsApp, in-platform alerts, or dashboard notifications. Where applicable, notifications shall be made without undue delay and within applicable legal timelines, including the 72-hour requirement under relevant laws.
14. Automated decision-making
Tradepal AI may use automated systems for fraud detection, compliance monitoring, transaction risk analysis, and security screening. However, Tradepal AI does not make solely automated decisions producing legal or similarly significant effects without appropriate human oversight.
15. Children's privacy
Our services are not directed toward individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that personal data of a minor has been collected without appropriate authorization, such information will be deleted promptly.
16. User responsibilities
Users are responsible for maintaining account confidentiality, securing login credentials, using strong passwords, enabling available security measures, ensuring the accuracy of information provided, and promptly notifying Tradepal AI of any suspected unauthorized access or security incidents.
17. Third-party services
Our platform may integrate with third-party providers including payment processors, banking partners, analytics providers, cloud hosting services, and compliance verification vendors. Tradepal AI is not responsible for the independent privacy practices of third-party services. Users are encouraged to review their respective privacy policies.
18. Privacy policy updates
We may update this Privacy Policy periodically to reflect legal developments, operational changes, security enhancements, or service improvements. Users will be notified of material changes through email notifications, dashboard alerts, or platform prompts requesting review and acceptance where required. Continued use of the services after updates constitutes acceptance of the revised Privacy Policy.