Privacy Policy

1. Introduction

ACTIV ("we", "us", or "our") respects your privacy and is committed to protecting personal data. This Privacy Policy explains how we collect, use, and safeguard information in accordance with the Nigeria Data Protection Act (NDP Act) 2023, the General Application and Implementation Directive (GAID) 2025, guidance from the Nigeria Data Protection Commission (NDPC), and other applicable laws.

When you use Activ to store your customers' contact details, preferences, or related records, you act as the data controller for that customer data. Activ acts as a data processor on your instructions. You must obtain a lawful basis (including freely given, specific, informed, and unambiguous consent where required) before entering customer personal data or sending them receipts, invoices, or messages. Customers may ask you to delete their profiles at any time; we will assist you in fulfilling lawful requests.

This policy is written in plain English. If you need it in another format or language, or have questions, contact privacy@support.activ.ng.

2. Information We Collect

We collect various types of information to provide and improve our Platform:

• Account Information: Name, business email address, and phone number.
• Business Information: Business name, CAC registration number, trading address, and logo.
• Transaction Data: Details of receipts generated, products sold, pricing, and dates.
• Device Data: Unique identifiers including International Mobile Equipment Identity (IMEI), Serial Numbers, and model information of devices processed through the Platform.
• Customer Data: Information about your customers (name, email, phone, and optional preferences such as budget or product interests) required for receipts, messaging, and matching features. Merchants are responsible for obtaining customer consent to store this data.
• Usage Data: Information about how you access and use the Platform, including IP addresses, browser type, and device information.

3. How We Use Your Information

We use your data for the following purposes:

• Service Provision: To create accounts, generate receipts, manage inventory, and provide customer support.
• Communication: To send transactional emails (e.g., receipt copies), updates, and security alerts.
• Fraud Prevention and Asset Protection: To maintain a registry of Device Data (IMEIs/Serial Numbers) to verify product history, prevent the circulation of stolen goods, and protect the integrity of the Platform.
• Legal Compliance: To comply with legal obligations, resolve disputes, and enforce our Terms of Service.
• Automated matching: Where enabled, merchants may use tools (including artificial intelligence) to match stated customer preferences to available products or listings. Customers may ask the merchant for human review of a match or to opt out of automated matching. For more detail, contact privacy@support.activ.ng.

4. Information Sharing and Disclosure

We do not sell personal data. We use subprocessors to operate the Platform. Data may be processed outside Nigeria (including by providers in the United States and other jurisdictions) under appropriate safeguards permitted by the NDP Act and GAID 2025, such as adequacy arrangements or contractual protections. Categories of recipients include cloud hosting, email delivery, optional analytics, device identifier lookup, and messaging providers where those features are enabled. A current list of subprocessors is available on request at privacy@support.activ.ng.

• Service providers: Vendors who assist us under data processing agreements.
• Device lookup: IMEI queries may be sent to third-party device databases for technical specifications only. Customer personal data is not shared through this feature.
• Legal Requirements: If required by law, court order, or government regulation.
• Business Transfers: In connection with a merger, acquisition, or sale of assets.

5. Data Security

We implement industry-standard technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction. However, no internet transmission is completely secure, and we cannot guarantee absolute security.

6. Data Retention

We retain personal and business data only as long as needed for the purposes below, unless a longer period is required by law:

• Active merchant accounts: retained while the account is active.
• Closed merchant accounts: deleted within 12 months after closure, except records we must keep for legal, tax, or dispute purposes.
• Customer profiles (including Concierge preferences): deleted 6 months after the last interaction, or sooner if the merchant or customer requests deletion.
• Chat and messaging logs: deleted 90 days after creation, unless needed for security or legal compliance.
• Device Data (IMEI/serial): retained for up to 3 years for fraud prevention and legal compliance.

7. Your Rights

Under the NDP Act and GAID 2025, you have the right to:

• Access and request a copy of your personal data (including in a standard portable format such as CSV or JSON where applicable).
• Rectify inaccurate or incomplete data.
• Request erasure of your data (subject to legal retention requirements, including backups held for a limited period).
• Object to the processing of your data for direct marketing purposes.
• Request human review of, or opt out of, solely automated matching that significantly affects you.
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC).

Merchants (as controllers) handle many requests about their Customers; Activ (as processor) assists. Account holders can export data and request deletion from Settings → Profile → Privacy. You may also email privacy@support.activ.ng from your account email. We aim to respond without undue delay and within 14 days of a verified request. We process deletion through a verified workflow that first marks the account for review before any irreversible actions.

8. Cookies and Tracking

We use essential cookies for authentication and session management. Optional analytics cookies are used only after you accept them in the consent banner or enable them in Settings → Privacy.

9. Data Privacy Impact Assessments

For new features involving artificial intelligence or large-scale processing, we conduct Data Privacy Impact Assessments (DPIAs) to identify and reduce risks. Summaries are available on request at privacy@support.activ.ng.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on the Platform. Your continued use of the Platform after changes are posted constitutes your acceptance.

11. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at: