Privacy Policy

Draft for legal review. Placeholders: {company}, {rc}, {address}, {dpo}, {support}, {regstatus}, {chatrules}.

This policy explains how {company} ("Globfolio", "we") collects and uses your personal data, and your rights, under the Nigeria Data Protection Act 2023 (NDPA) and related regulations. {company} is the data controller.

1. Our Data Protection Officer

You can reach our Data Protection Officer at {dpo}, or by post at {address}.

2. What we collect

• Account details: username, email address, full name (optional), WhatsApp number (optional), password (stored only as a secure hash).
• Subscription and payment details: your plan, add-ons, dates, amounts and payment references. Card details are handled by Paystack; we never see or store your card number. For bank transfers, we see the transfer reference and the receipt you choose to send us.
• What you do on Globfolio: Chatroom messages, reactions, mentions, stocks you follow, broker ratings and comments, course and webinar activity.
• Communication choices: your email preferences and your WhatsApp consent, including when and how you gave it.
• Technical data: device and browser type, IP address, and session cookies needed to keep you logged in. See our Cookie Policy.

3. Why we use it, and our lawful basis

• To provide your subscription (contract): your account, alerts, Chatroom, portfolios, courses, renewal reminders and payment confirmations.
• To send marketing (consent): free alert emails, the weekly news digest, offers and webinar invitations. WhatsApp messages are only sent if you've opted in. You can withdraw consent at any time.
• To keep Globfolio safe (legitimate interests): preventing fraud and account sharing, moderating the Chatroom, and improving the service.
• To meet the law (legal obligation): keeping financial records and responding to lawful requests from authorities.

4. Who we share it with

We don't sell your personal data. We share it only with service providers who process it on our behalf under contract, including: Paystack (payments), our email service provider, Meta (WhatsApp Business), Vimeo (course videos), Zoom (webinars), our hosting and content delivery providers, and our market data providers (who receive no personal data). Other members see your username, your messages, and, if you allow it, the brokers you use. We may disclose data where the law requires it.

5. Transfers outside Nigeria

Some providers store data outside Nigeria (for example in the European Union or the United States). We only transfer data where the NDPA allows it, such as to countries with adequate protection or under appropriate contractual safeguards.

6. How long we keep it

• Account data: while your account is active, and for up to 2 years after your last subscription ends, so you can return.
• Payment and financial records: 6 years, as Nigerian law requires.
• Chatroom messages: while the Chatroom is running, unless you or an admin delete them.
• Marketing consent records: for as long as we rely on the consent, plus 2 years.

7. How we protect it

We use encryption in transit, hashed passwords, access controls with admin roles, and regular backups. If a personal data breach is likely to put your rights at risk, we will notify the Nigeria Data Protection Commission within 72 hours and tell you without undue delay.

8. Your rights

Under the NDPA you can ask to access your data, correct it, delete it, restrict or object to how we use it, receive a copy in a portable format, and withdraw consent at any time. You can make most requests from My account, or by emailing {dpo}. We'll respond within 30 days. If you're unhappy with our response, you can complain to the Nigeria Data Protection Commission (NDPC).

9. Children

Globfolio is for adults. We don't knowingly collect data from anyone under 18.

10. Changes

We'll post any changes here with the date they take effect, and tell you about important changes.