Data use policy

This policy applies to personal data we hold about you as a registered user of the portal, whether you joined as an investor or a fundraiser. It applies from the moment you create an account and for as long as we hold your data.

We use your personal data only for the purposes below.

• Providing your account. Creating and securing your account, signing you in and recognising your devices.
• Verifying your identity. Meeting the identity checks required of crowdfunding platforms (see our Identity verification data processing notice).
• Investment limits and suitability. Checking your declared income, investor category and running totals against the limits that apply to you.
• Subscriptions and refunds. Administering your subscriptions, cancellations and refunds with the independent custodian.
• Service communications. Sending sign-in codes, security alerts, receipts and notices about your account and investments.
• Legal and regulatory duties. Keeping records and making reports required by the Securities and Exchange Commission (the “SEC”) and other authorities.
• Security and fraud prevention. Detecting, investigating and preventing fraud, identity theft and misuse of the portal.

We process your data where it is necessary to perform our agreement with you, to comply with a legal obligation, for our legitimate interests in running a secure platform (where these do not override your rights), or where you have given consent. Where we rely on your consent, for example for optional location data or marketing, you can withdraw it at any time.

• We do not use your data to give investment advice or to recommend any offer.
• We do not use optional data, such as location at sign-in or marketing preferences, unless you have agreed to it separately.
• We never ask you for your password, PIN or one-time codes. Do not share them with anyone claiming to be Pennytree.

Access within Pennytree is limited to staff who need it for their role, and administrative actions on customer records are logged. We share data outside Pennytree only with the parties described in the Privacy policy, such as the custodian, identity verification and payment providers acting on our instructions, fundraisers (limited to what they need to administer your instrument) and regulators.

Records that the SEC rules require us to keep are retained for at least seven years. Sign-in and device activity records are kept for a limited period and then archived. Where a legal retention duty applies, it takes priority over a request to delete your data.

You have the rights set out in our Privacy policy, including access, correction, objection and, where no legal retention duty applies, deletion. You may also complain to the Nigeria Data Protection Commission.

We may update this policy. Each version carries a version number and effective date at the top of this page. If we publish a new version that you need to accept, we will ask you to review and accept it the next time you sign in.

Questions about how your data is used can be sent to hello@mypennytree.com. Please do not include identity documents, BVN, NIN, passwords or bank details in email.