Privacy policy

Pennytree is the controller of the personal data described in this policy and processes it in accordance with applicable Nigerian data protection law, including the Nigeria Data Protection Act 2023 and the Nigeria Data Protection Regulation.

• Identity data: your name, date of birth, address, BVN or NIN, and identity documents.
• Account data: your email address, phone number and credentials (passwords are stored in hashed form).
• Suitability data: your investor category, declared net annual income and declared crowdfunding running total.
• Transaction data: subscriptions, cancellations, refunds and instruments held.
• Household data: where a family or household relationship is relevant to a lock-in exception.
• Technical data: device, browser, IP address and access logs used for security and audit.

To verify your identity; to enforce your statutory investment limit; to administer subscriptions and refunds through the custodian; to meet our reporting obligations to the SEC; and to detect and prevent identity theft and fraud. Our Data use policy sets out these uses in more detail. Where we rely on your consent, you can withdraw it at any time.

• The independent custodian holding subscription monies.
• Identity verification and payment service providers acting on our instructions.
• The Securities and Exchange Commission and other regulators where required by law.
• Fundraisers, limited to the information they need to issue and administer your instrument.

We do not share your data with anyone else except where the law requires it.

We use access controls, encryption of sensitive identifiers such as your BVN and NIN, secure systems and backups, and measures to prevent identity theft. Access within Pennytree is limited to staff who need it for their role.

We keep records that the SEC rules require for at least seven years. Other data is kept only as long as needed for the purposes above. Where a legal retention duty applies, it takes priority over a request to delete.

You may ask for access to your personal data, ask us to correct it, object to or restrict our processing, ask for a copy of it in a portable form, or ask us to delete it where no legal retention duty applies. You may also withdraw any consent you have given. To exercise a right, contact us using the details below. You also have the right to complain to the Nigeria Data Protection Commission.

We may update this policy. Each version carries a version number and effective date at the top of this page, and earlier versions remain available in the version history below. If we publish a new version that you need to accept, we will ask you to review it the next time you sign in.

Questions about this policy or requests about your data can be sent to hello@mypennytree.com. Please do not include identity documents, BVN, NIN, passwords or bank details in email.