Privacy Policy

1. INTRODUCTION

This Privacy Policy describes how PRUNEDGE DEVELOPMENT TECHNOLOGIES LTD ("Prunedge", "we", "us", or "our") collects, uses, stores, transfers, discloses, and protects Personal Data obtained from users (you", "user", or "Data Subject") when you access or use our website, mobile applications, digital platforms, products, or services (collectively, the "Services").

This Privacy Policy is issued in compliance with the Nigeria Data Protection Act, 2023 ("NDPA 2023"), the Nigeria Data Protection General Application and Implementation Directive, 2025 ("GAID 2025"), and other applicable data protection, privacy, cybersecurity, consumer protection, and electronic communications laws and regulations of Nigeria.

By accessing or using our Services, you confirm that you have read, understood, and agreed to this Privacy Policy. If you do not agree, you must discontinue use of our Services immediately.

2. DEFINITIONS

For the purpose of this Privacy Policy:

"Anonymisation" means the irreversible process of altering Personal Data such that the Data Subject cannot be identified directly or indirectly.

"Applicable Data Protection Laws" means the Nigeria Data Protection Act 2023, the Nigeria Data Protection General Application and Implementation Directive 2025, and all subsidiary regulations, directives, guidelines, and regulatory instruments issued by the Nigeria Data Protection Commission ("NDPC" or "Commission").

"Consent" means any freely given, specific, informed, and unambiguous indication of the Data Subject's wishes by which the Data Subject signifies agreement to the processing of Personal Data.

"Controller" means a person, private entity, public commission, agency, or any other body who alone or jointly with others determines the purposes and means of processing Personal Data, and includes Prunedge in respect of the processing activities described in this Privacy Policy.

"Data Subject" means an identified or identifiable individual whose Personal Data is being processed.

"Personal Data" means any information relating to an identified or identifiable natural person, as defined under the NDPA 2023.

"Processing" means any operation or set of operations performed on Personal Data including collection, recording, organisation, storage, adaptation, retrieval,

consultation, use, disclosure, transfer, erasure, destruction, or restriction, whether or not by automated means.

"Processor" means any person or organisation that processes Personal Data on behalf of a Controller.

"Sensitive Personal Data" includes data relating to health, biometrics, genetics, sex life, ethnicity, religious beliefs, trade union membership, political opinions, or other categories classified as sensitive under Applicable Data Protection Laws, and which attract heightened protection under the NDPA 2023 and GAID 2025.

3. PERSONAL DATA WE COLLECT

We collect and process the following categories of Personal Data, limited to what is necessary for the purposes set out in this Privacy Policy:

3.1 Information You Provide Directly

This may include:

1. full name;
2. email address;
3. telephone number;
4. residential or business address;
5. username and login credentials;
6. payment or transaction information;
7. identity verification information;
8. customer support communications; and
9. any other information voluntarily submitted through our Services that is relevant to the Services being provided.

3.2 Information Collected Automatically

We may automatically collect:

1. IP address;
2. browser type and version;
3. device identifiers;
4. operating system information;
5. access logs;
6. usage analytics;
7. date and time of access;
8. referral URLs; and
9. cookie and tracking technology information.

3.3 Location Information

Where you have expressly enabled location access on your device or granted us permission, we may collect geolocation data strictly for the purposes of improving functionality, security, fraud prevention, personalisation, and user experience.

You may disable location permissions through your device settings at any time.

4. LEGAL BASIS FOR PROCESSING

We process Personal Data only where a lawful basis exists under Applicable Data Protection Laws. The applicable lawful bases are:

1. your Consent – where you have freely, specifically, and unambiguously agreed to processing;
2. performance of a contract to which you are a party, or steps taken at your request prior to entering a contract;
3. compliance with a legal or regulatory obligation;
4. protection of your vital interests or those of another natural person;
5. the performance of a task carried out in the public interest or in the exercise of official authority; or
6. our legitimate interests or those of a third party, where such interests are not overridden by your fundamental rights and freedoms.

Where processing is based on your Consent, you may withdraw that Consent at any time by contacting us using the details in Section 19. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

5. PURPOSES OF PROCESSING

We process Personal Data for the following purposes, each supported by a corresponding lawful basis:

1. providing, operating, and maintaining our Services;
2. verifying identity and preventing fraud;
3. managing customer accounts and transactions;
4. processing payments;
5. communicating with you regarding service updates, technical support, security notices, or administrative matters;
6. complying with legal and regulatory obligations;
7. improving service functionality, performance, and user experience;
8. conducting analytics, audits, and internal reporting;
9. conducting anonymised research and statistical analysis;
10. enforcing contractual rights and terms of use;
11. personalising user experience and recommendations;
12. sending marketing and promotional communications where you have provided Consent or where otherwise permitted by law; and

1. protecting the rights, property, systems, and security of Prunedge and its users.

6. COOKIES AND TRACKING TECHNOLOGIES

We use cookies, web beacons, analytics tools, and similar tracking technologies to improve functionality, understand usage patterns, enhance security, and personalise user experience.

Cookies may include:

1. strictly necessary cookies;
2. performance and analytics cookies;
3. functionality cookies; and
4. advertising or targeting cookies.

You may refuse or disable non-essential cookies through your browser settings. If you do so, certain features of the Services may not function as intended.

We shall obtain your Consent before deploying non-essential cookies, in accordance with Applicable Data Protection Laws.

7. ANALYTICS AND THIRD-PARTY TECHNOLOGIES

We engage third-party analytics and monitoring providers, including cloud hosting services, payment processors, communication tools, and advertising technology platforms.

Such third parties act as Processors and may process Personal Data on our behalf only under written instructions, subject to contractual obligations, confidentiality requirements, and Applicable Data Protection Laws. We remain responsible as Controller for their processing activities.

We may use analytics tools to monitor traffic, usage behaviour, performance metrics, and platform effectiveness.

8. DISCLOSURE OF PERSONAL DATA

We disclose Personal Data only where necessary and only to the following categories of recipients:

1. affiliated entities and corporate group companies;
2. vendors, service providers, contractors, and Processors engaged to support our operations;
3. financial institutions and payment service providers;
4. professional advisers including auditors, insurers, consultants, and legal advisers;

1. regulators, law enforcement agencies, courts, or other competent authorities where we are required or permitted to do so by law;
2. parties to or advisers in connection with a merger, acquisition, business restructuring, financing, or asset transfer, subject to appropriate confidentiality obligations; and
3. any other party to whom you have expressly consented to disclosure.

We shall ensure by contract that all third parties receiving Personal Data maintain appropriate confidentiality, security, and data protection standards at least equivalent to our own.

9. INTERNATIONAL DATA TRANSFERS

We do not transfer Personal Data outside Nigeria except where permitted under Applicable Data Protection Laws. Where such transfers occur, we shall ensure that:

1. the recipient country or territory has been assessed as providing an adequate level of data protection by the NDPC;
2. appropriate contractual safeguards are in place, including standard contractual clauses approved or recognised under Applicable Data Protection Laws;
3. the transfer is necessary for contractual performance or legal claims; or
4. you have provided explicit, informed Consent to the transfer after being informed of the risks. In all cases, we shall implement safeguards to ensure that transferred Personal Data continues to receive protection consistent with Applicable Data Protection Laws.

10. DATA RETENTION

We retain Personal Data only for as long as is necessary to fulfil the specific purposes for which it was collected, including compliance with legal, regulatory, contractual, tax, accounting, and operational requirements, and to resolve disputes or enforce our agreements.

Upon expiry of the applicable retention period, Personal Data shall be securely deleted, anonymised, or destroyed in a manner that prevents reconstruction, in accordance with our data retention schedule and Applicable Data Protection Laws.

11. DATA SECURITY

We implement appropriate technical, organisational, administrative, and physical safeguards to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, misuse, or access.

Such safeguards may include:

1. encryption;
2. access controls;

1. multi-factor authentication;
2. system monitoring;
3. vulnerability management;
4. employee confidentiality obligations;
5. incident response procedures; and
6. periodic security reviews.

Despite these measures, no transmission or storage system can be guaranteed as entirely secure. We cannot warrant absolute security, and we encourage you to take appropriate measures to protect your own credentials and account access.

12. DATA BREACH MANAGEMENT

Where a Personal Data breach occurs that is likely to result in a risk to the rights and freedoms of Data Subjects, we shall:

1. take immediate remedial action to contain and mitigate the breach;
2. notify the NDPC within the timeframe prescribed under Applicable Data Protection Laws; and
3. notify affected Data Subjects without undue delay where required. We maintain an internal breach response procedure to support timely and effective response.

13. YOUR RIGHTS AS A DATA SUBJECT

Subject to the conditions and limitations in Applicable Data Protection Laws, you are entitled to exercise the following rights in respect of your Personal Data:

1. the right to request access to your Personal Data and information about how it is processed;
2. the right to request correction or rectification of inaccurate or incomplete Personal Data;
3. the right to request erasure of your Personal Data where retention is no longer necessary or lawful;
4. the right to withdraw Consent;
5. the right to object to processing based on legitimate interests or for direct marketing purposes;
6. the right to request restriction of processing in specified circumstances;
7. the right to data portability;
8. the right not to be subject solely to automated decision-making, including profiling, that produces legal or similarly significant effects; and
9. the right to lodge a complaint with the NDPC.

To exercise any of these rights, please submit a request using the contact details in Section 19. We will respond within the timeframes prescribed under Applicable Data Protection Laws.

We reserve the right to verify your identity before processing any request, and may decline requests that are manifestly unfounded or excessive.

14. MARKETING COMMUNICATIONS

Where you have provided Consent or where we are otherwise permitted by law, we may send you marketing, promotional, or informational communications by electronic means.

You may opt out of marketing communications at any time by clicking the unsubscribe link in any such message, updating your account settings, or contacting us directly using the details in Section 19.

We shall not send unsolicited electronic marketing communications where prohibited by law, and shall always obtain Consent where required before doing so.

15. CHILDREN'S PRIVACY

Our Services are not directed to children under the age of 18, and we do not knowingly collect Personal Data from children without appropriate parental or guardian consent.

Where we are informed that a child's Personal Data has been collected without valid parental or guardian consent, we shall promptly delete such data. Where we process a child's Personal Data with appropriate consent, we shall do so in accordance with Applicable Data Protection Laws and apply heightened safeguards.

If you believe that a child has provided Personal Data without appropriate authorisation, please contact us immediately.

16. THIRD-PARTY LINKS

Our Services may contain links to third-party websites, applications, or platforms that are not operated, controlled, or endorsed by us.

We are not responsible for the privacy practices, data handling, or content of such third-party services. We encourage you to review the privacy notices of any third-party platforms you access through our Services.

17. AUTOMATED DECISION-MAKING AND PROFILING

We may use automated systems, machine learning tools, analytics, and profiling technologies to improve service delivery, detect fraud, personalise experience, and enhance security.

Where our automated processing produces decisions that have a legal or similarly significant effect on you, we shall inform you of the logic involved, the significance and envisaged consequences of such processing, and the safeguards available to you, including the right to request human review.

18. CHANGES TO THIS PRIVACY POLICY

We may amend or update this Privacy Policy from time to time to reflect changes in law, regulatory requirements, our operations, or technology.

Material updates shall be communicated to you by email or through a notice on our website at least 21 days before taking effect, unless immediate implementation is required by law. Continued use of our Services after the effective date constitutes acceptance of the updated Privacy Policy.

We encourage users to periodically review this Privacy Policy.

19. CONTACT DETAILS AND DATA PROTECTION ENQUIRIES

For all enquiries, complaints, data subject requests, or concerns regarding this Privacy Policy or our processing of your Personal Data, please contact our Data Protection Officer:

Data Protection Officer PRUNEDGE DEVELOPMENT TECHNOLOGIES LTD 9 Tema Street, Wuse Zone 6, Abuja-FCT info@prunedge.com

You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at any time, without prejudice to any other legal remedy available to you.

20. GOVERNING LAW

This Privacy Policy is governed by and shall be construed in accordance with the laws of the Federal Republic of Nigeria. Any disputes arising from or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of Nigeria.