Privacy Policy

1.1 Controller. The data controller for personal data collected through the Buyant platform is Buyant, a company incorporated in Nigeria with its registered office at Suite 1 National Centre for Women Development, Opposite CBN, Central Business District, Abuja ("Buyant," "we," "us," or "our").

1.2 Scope. This Privacy Policy applies to personal data collected through portal.buyant.com, our mobile-optimised web application, and all related services, APIs, and communications (collectively, the "Platform").

3.2 To Improve the Platform. We use aggregated and anonymised usage data to analyse performance, detect errors, improve features, and develop new services.

3.3 For Safety and Fraud Prevention. We use data to detect and prevent fraudulent activity, money laundering, and other prohibited conduct, and to comply with legal and regulatory obligations.

3.4 Marketing (with your consent). With your consent, we may send you promotional messages about new Rallies, platform features, and offers via WhatsApp or email. You can withdraw this consent at any time through your account settings or by following the opt-out instructions in any marketing message.

4.1 How It Works. When you register or log in, we send an OTP to your WhatsApp number via the Meta WhatsApp Business Cloud API. We also send transactional notifications — such as Rally status updates, payment confirmations, and pickup alerts — through the same channel.

4.2 Data Shared With Meta. To deliver WhatsApp messages, we transmit your phone number and message content to Meta's servers. Meta processes this data in accordance with its own Privacy Policy and the WhatsApp Business Terms of Service. Buyant does not control Meta's data practices.

4.3 Opt-Out. You may opt out of non-essential WhatsApp communications at any time through your account settings. Opting out of marketing messages does not affect the delivery of OTPs and other messages required to operate your account.

5.1 Contract Performance. Most processing is necessary for us to fulfil our contract with you — to operate your account, process payments, manage your Rally commitments, and deliver goods at the Hub.

5.2 Legal Obligation. We process certain data to comply with applicable Nigerian law, including NDPR, FCCPC guidelines, anti-money-laundering requirements, and tax obligations.

5.3 Legitimate Interests. We process usage and technical data to improve platform security, detect fraud, and enhance service quality, where these interests are not overridden by your rights.

5.4 Consent. Where we rely on consent (for example, for marketing communications), you may withdraw it at any time without affecting the lawfulness of processing prior to withdrawal.

6.2 Rally Captains. Captains may see the number of Backers in a Rally but do not have access to individual Backer identities, phone numbers, or payment data.

6.3 Legal Disclosure. We may disclose your data where required by law, court order, regulatory authority, or to protect the rights, safety, or property of Buyant, our users, or the public.

6.4 Business Transfers. In the event of a merger, acquisition, or sale of Buyant's assets, your data may be transferred to the successor entity, subject to equivalent privacy protections.

6.5 No Sale of Data. Buyant does not sell, rent, or trade your personal data to third parties for their own marketing purposes.

7.1 Account Data. We retain your account data for as long as your account is active. If you close your account, we retain your data for up to five (5) years thereafter for legal, audit, and dispute resolution purposes.

7.2 Transaction Data. Financial and transaction records are retained for a minimum of seven (7) years in accordance with Nigerian tax and accounting requirements.

7.3 OTP and Authentication Logs. OTP tokens are invalidated immediately after use or expiry. Authentication logs are retained for up to twelve (12) months for security and audit purposes.

7.4 Anonymisation. After the applicable retention period, personal data is either securely deleted or anonymised so that it can no longer be associated with an individual.

8.1 Technical Measures. We use industry-standard security measures, including HTTPS/TLS encryption in transit, encrypted storage at rest, access controls, and regular security audits to protect your data.

8.2 Payment Security. Payment card data is processed entirely by Paystack, a PCI-DSS compliant payment processor. Buyant does not store, transmit, or have access to raw card details.

8.3 Incident Response. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant regulatory authority within the timeframes required by applicable law.

10.1 Essential Cookies. We use session cookies and authentication tokens strictly necessary to keep you logged in and to secure your account. These cannot be disabled without affecting platform functionality.

10.2 Analytics. We may use analytics tools to collect anonymised data about how users navigate the Platform. No personally identifiable data is shared with analytics providers.

10.3 No Third-Party Advertising Cookies. Buyant does not use advertising cookies or permit third-party ad networks to track you through our Platform.

11.1 Age Restriction. The Platform is not directed at or intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately and we will take steps to delete it.

12.1 Notification. We may update this Privacy Policy from time to time. Where changes are material, we will notify you through the Platform, by email, or via WhatsApp before the changes take effect.

12.2 Continued Use. Your continued use of the Platform after the effective date of any revision constitutes acceptance of the revised Policy. If you do not agree to the changes, you must stop using the Platform.