Privacy Policy
1. Introduction
Welcome to GN Data ("we," "our," or "us"). We are committed to protecting your personal data and ensuring that your privacy is respected when using our platform.
This Privacy Policy explains how GN Data collects, uses, stores, shares, and protects your information across our website, mobile application, developer APIs, and digital utility services (collectively, the "Platform"). Our services include the purchase of Airtime, Mobile Data Bundles, Electricity Tokens, Cable TV Subscriptions, and digital wallet funding.
By registering, accessing, or using GN Data, you consent to the practices described in this Privacy Policy. This document is formulated in strict accordance with the Nigeria Data Protection Act (NDPA) 2023 and the Nigeria Data Protection Regulation (NDPR) 2019.
2. Information We Collect
We only collect information strictly required to operate your account, process transactions, protect against fraud, and comply with applicable laws.
A. Account & Profile Information
- Full Name: Required to identify your account and record transaction ownership.
- Email Address: Your primary credential used for account authentication, password recovery, and delivery of transaction receipts.
- Phone Number: Used as an alternate identifier and for customer support communication.
B. Financial & Wallet Records
- Wallet Transactions: Complete ledger history of wallet funding, utility purchases, debits, credits, and refunds.
- Dedicated Virtual Accounts: Unique account numbers generated by our licensed payment partners to allow direct bank transfer wallet funding.
- Identity Verification (KYC for Virtual Accounts): In accordance with Central Bank of Nigeria (CBN) regulatory guidelines and requirements of our licensed banking partners (PaymentPoint, Monnify), you may be requested to provide your Bank Verification Number (BVN) or National Identity Number (NIN) to generate dedicated virtual bank accounts. GN Data does not store your BVN or NIN on our servers. Your identification number is securely transmitted directly to our licensed payment partner via encrypted connections solely for real-time verification.
- Payment Card Details: When you fund your wallet using a debit card, your card details are processed directly by our PCI-DSS certified payment gateways (Paystack, Monnify, PaymentPoint). GN Data does not store your card number, expiration date, or CVV.
C. Service Fulfillment & Beneficiary Information
- Recipient telephone numbers (for Airtime and Data top-ups).
- Electricity meter numbers and account types (Prepaid/Postpaid).
- Cable TV smartcard and IUC numbers (DStv, GOtv, Startimes).
D. Technical & Security Information
- Device Push Tokens: Firebase Cloud Messaging (FCM) tokens required to deliver real-time push notifications regarding transaction status and wallet balance updates.
- Security & Access Logs: IP address, login timestamps, and failed authentication counters to detect and prevent unauthorized access.
- Developer / API Users: Configured IP whitelists, webhook URLs, and securely hashed API secret keys.
3. How We Use Your Information
We use your personal data exclusively for legitimate operational, security, and contractual purposes:
- Processing Orders: Delivering airtime, data bundles, electricity meter tokens, and cable TV activations to your designated beneficiary details.
- Wallet Management: Maintaining an accurate financial ledger of wallet balances, deposits, transfers, and reversals.
- Fraud Prevention & Security: Enforcing automated brute-force protection, account lockouts on consecutive failed password/PIN attempts, and unauthorized activity detection.
- Account Notifications: Transmitting verification links, password resets, and transaction confirmations via our transactional email service.
- Real-Time Alerts: Dispatching instant push notifications to your mobile device upon transaction completion.
- Regulatory Compliance: Complying with statutory financial reporting, anti-money laundering (AML) guidelines, and applicable Nigerian regulations.
4. Third-Party Sharing & Service Providers
We do not sell, monetize, or rent your personal data to any third party. We only share information with vetted, PCI-DSS compliant, and legally regulated service partners necessary to provide our services:
| Category | Service Provider | Purpose | Data Shared |
|---|---|---|---|
| Payment Processing & Virtual Accounts | Paystack, Monnify, PaymentPoint | Processing payment card transactions, bank transfers, and generating dedicated virtual bank accounts for wallet deposits. | Name, email address, transaction amount, and identity verification numbers (BVN/NIN provided during virtual account setup, transmitted securely to the provider and never stored on GN Data servers). (Card information is captured directly by payment gateways). |
| Utility & Telecom Fulfillment | Authorized Distribution & Telecom Aggregators | Delivering airtime, data bundles, electricity disco tokens, and cable TV activations. | Beneficiary phone number, smartcard/IUC number, or meter number. |
| Transactional Email | Resend | Delivering account verification links, password reset messages, and transaction receipts. | User email address and name. |
| Push Notifications | Google Firebase (FCM) | Sending real-time mobile push notifications for transactions and account updates. | Device notification token. |
| Law Enforcement & Regulators | Nigerian Regulatory Authorities | Compliance with legal warrants, court orders, or statutory anti-money laundering obligations. | As strictly mandated by Nigerian law. |
5. Data Security
We maintain comprehensive technical and organizational safeguards to protect your personal and financial data:
- Cryptographic Password & PIN Hashing: Your password and 4-digit transaction PIN are hashed using modern cryptographic algorithms (such as PBKDF2/bcrypt) and are never stored or visible in plaintext.
- Brute-Force & Lockout Protection: Accounts are automatically locked for 15 minutes after 5 consecutive failed login or transaction PIN attempts to safeguard against unauthorized access.
- API Secret Protection: Reseller and developer API keys are stored as cryptographic SHA-256 hashes, with support for IP address whitelisting.
- Encrypted Transmission: All communications between your device, browser, and our servers are encrypted using modern Transport Layer Security (TLS/HTTPS).
6. Data Retention
We retain personal information for the period necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required or permitted by law:
- Account & Ledger Records: Maintained for the duration of your active account and up to 7 years after account closure to fulfill statutory financial auditing and anti-money laundering (AML) record-keeping obligations.
- Authentication & Security Logs: Retained for 12 months for security auditing and fraud investigation, after which they are systematically deleted.
- Verification Tokens: One-time email verification and password reset tokens expire automatically and are purged immediately.
7. Your Rights & Account Deletion
Under the Nigeria Data Protection Act (NDPA) 2023, you have clear rights regarding your personal information:
- Right to Access & Rectification: You may review and update your personal information through your account profile.
- Right to Data Portability: You may request an export of your transaction history and account records.
- Right to Account & Data Deletion (Erasure): You have the right to request deletion of your account and personal data at any time.
How to request Account Deletion:
You can request the deletion of your account directly inside the GN Data Mobile App by navigating to Settings > Delete Account, or by sending an email request to support@gndata.com.ng. Upon receiving your request, your account and non-regulatory personal data will be permanently purged within 30 days, subject to statutory financial retention requirements.
8. Cookies & Device Identifiers
Our website utilizes essential session cookies to maintain your authenticated session and protect against Cross-Site Request Forgery (CSRF). These cookies are strictly necessary for the platform to function securely.
Our mobile app utilizes Firebase Cloud Messaging (FCM) device identifiers solely to route transaction notifications directly to your phone. You can manage or disable push notifications at any time via your device operating system settings.
9. Children's Privacy
GN Data is intended solely for persons aged 18 years or older. We do not knowingly collect or maintain information from individuals under the age of 18. If we become aware that a minor has created an account, we will take immediate steps to terminate the account and remove associated data.
10. Changes to This Privacy Policy
We may periodically update this Privacy Policy to reflect improvements to our platform or changes in regulatory standards. When significant changes occur, we will notify you through an email alert, an in-app notice, or by updating the effective date at the top of this document.
11. How to Contact Us
If you have any questions, inquiries, or requests regarding this Privacy Policy or the handling of your data, please contact us:
- Brand Name: GN Data
- Support Email: support@gndata.com.ng
- Website: https://gndata.com.ng