Plus one data ("Plus one data", "we", "us") is the data controller for the personal data described here. This policy explains what we collect when you use our website and mobile app (the "Service"), why, who we share it with, how long we keep it, and your rights under the Nigeria Data Protection Act 2023 (NDPA).
1. Data we collect
1.1 You give us
- Account: full name, username, email address, phone number, password and PINs (passwords and PINs are stored only as one-way hashes; we cannot read them).
- Purchases: the recipient details you enter (phone number, smartcard/IUC, meter number, exam or education profile ID), amounts and saved beneficiaries.
- Identity verification (when you choose a feature that needs it): BVN or NIN and date of birth. These are stored encrypted. For NIN/BVN slip services, the number you enter is sent to the verification partner to produce your slip; we keep only a non-reversible fingerprint of it in our records.
- Business registration (if you use it): business names, addresses, nature of business, share capital, director ID card and passport photo, which we pass to the Corporate Affairs Commission process.
- Support and referrals: messages you send us, and the phone number of the person who referred you.
1.2 Collected automatically
- Device and security data: IP address, device name, app version, a random installation ID created by the app, sign-in times and security events (used to keep your account safe and alert you to new sign-ins).
- Notifications: a push token, if you allow notifications.
- Website analytics: pages visited and general usage, through Google Analytics, only if you accept analytics cookies. See our Cookie Policy.
1.3 App permissions
- Contacts (optional): only when you tap to pick a phone number. The number you pick fills the form; your contact list is not uploaded or stored.
- Usage access (optional, Data Manager): lets the app estimate your mobile data use per app. This stays on your phone and is never sent to us.
- Fingerprint/face: handled by Android. We never receive your biometric data; the phone only tells the app whether the check passed.
- Notifications (optional): to send receipts and account alerts.
We do not collect your location, camera images (other than documents you upload), or SMS messages.
2. Why we use it, and our lawful basis
| Purpose | Lawful basis (NDPA s.25) |
|---|---|
| Create your account, deliver purchases, keep your wallet and send receipts | Performance of our contract with you |
| Verify identity, prevent fraud, money laundering and abuse; keep transaction records | Legal obligation and legitimate interest in keeping the Service safe |
| Security alerts, sign-in protection, support | Legitimate interest and contract |
| Website analytics, promotional messages | Your consent (you can withdraw it at any time) |
We collect only what we need for these purposes. We do not sell your personal data, and we do not use it for automated decisions that have legal or similarly significant effects on you.
3. Who we share it with
- Service providers that fulfil your purchases: mobile networks, cable TV and electricity companies, exam bodies, and the licensed aggregators that connect us to them, only the details needed for your purchase.
- Payment partners: banks and licensed payment companies that run your funding accounts and process payments.
- Verification partners: licensed identity-verification providers, when you use a feature that needs verification.
- Technology suppliers: hosting, email, SMS/WhatsApp messaging, push notifications (Firebase, OneSignal) and analytics (Google Analytics, only with your consent).
- Authorities: when the law requires it, for example a court order or a request from a regulator or law-enforcement agency.
All suppliers act on our instructions and must protect your data. Some suppliers (for example Google and OneSignal) process data outside Nigeria; where that happens we rely on the safeguards allowed by Part VIII of the NDPA, such as contractual protections.
4. How long we keep it
- Account data: while your account is open.
- Transaction and wallet records: 7 years after the transaction, as required for tax and anti-money-laundering purposes, even if you close your account.
- Identity and business-registration documents: as long as needed for the service and to meet legal requirements, then deleted.
- Security and sign-in logs: only as long as needed to keep accounts secure and investigate incidents.
- When you close your account, personal data we do not have to keep is deleted within 30 days. See the Account Deletion Policy.
5. How we protect it
Data is sent over encrypted HTTPS connections. Passwords and PINs are stored as one-way hashes; BVN, NIN and date of birth are encrypted; access to personal data is limited to staff who need it. Accounts are protected with transaction PINs, optional two-step verification, sign-in protection and new-device alerts. If a personal data breach is likely to put your rights at risk, we will tell you and the Nigeria Data Protection Commission as the NDPA requires.
6. Your rights
Under the NDPA you can ask us to:
- give you a copy of your personal data, or send it to another service in a common format;
- correct inaccurate or incomplete data;
- delete your data (see the Account Deletion Policy; some records must be kept by law);
- restrict or object to some uses, including marketing;
- withdraw consent you gave (for example analytics cookies, via Cookie settings), without affecting earlier use.
Email Plusonedata26@gmail.com from your registered email address. We reply within 30 days. If you are not satisfied, you can complain to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.
7. Children
The Service is not intended for children under 18. We do not knowingly collect their data without a parent's or guardian's consent; if you believe a child has given us data, contact us and we will delete it.
8. Changes
We will update the effective date above when this policy changes, and tell you about important changes by email or in the app.
9. Contact
Questions about this policy or your data: Plusonedata26@gmail.com.