1. Who we are
This policy explains how BineBit uses your personal data when you use our app, website and services. The company responsible for your data (the "controller") depends on where you live:
- Nigeria: [Nigerian legal entity name], [Registered address, Nigeria]. We follow the Nigeria Data Protection Act 2023 (NDPA).
- United Kingdom: [UK legal entity name], [Registered address, United Kingdom]. We follow the UK GDPR and the Data Protection Act 2018.
Our Data Protection Officer is [Data Protection Officer name or role]. Contact them at privacy@binebit.com.
2. What we collect
| Type | Examples |
|---|---|
| Identity | Name, date of birth, nationality, BVN or NIN (Nigeria), ID document details and images (UK) |
| Biometric | Your selfie and the facial measurements used to match it to your ID and check it is really you |
| Contact | Email address, phone number, home address |
| Financial | Bank account details for payouts, source of funds information |
| Transactions | Sales, quotes, payouts, deposits, wallet addresses, transaction hashes, eSIM orders |
| Gift cards | Card photos, codes, receipts, brand, value and country |
| eSIM | Destination, plan and the device details needed to install the eSIM |
| Device and usage | IP address, device model and identifiers, app version, approximate location from your IP, in-app activity |
| Communications | Messages and calls with support, complaints, survey responses |
3. Where we get it
- From you, when you sign up, verify your identity, sell, deposit or contact us.
- From your device, when you use the app or website.
- From others: identity verification partners, the BVN/NIN databases (Nigeria), fraud prevention and sanctions screening services, blockchain analytics providers, banks and payment partners.
4. Why we use it
| Purpose | Legal basis |
|---|---|
| Opening and running your account, processing sales, payouts, deposits and eSIM orders | To perform our contract with you |
| Verifying your identity, anti-money laundering checks, sanctions screening, keeping records, reporting to authorities | To comply with the law |
| Detecting and preventing fraud, securing our systems, checking gift cards and crypto deposits | Legal obligation and our legitimate interest in protecting customers and BineBit |
| Improving the app, fixing problems, understanding how features are used | Our legitimate interests |
| Sending offers and news | Your consent, which you can withdraw at any time |
Biometric data
Your selfie and facial measurements are sensitive data. We use them only to verify your identity and prevent fraud, with your explicit consent where required and, in the UK, under the conditions the law allows for preventing fraud and complying with regulatory requirements. We do not use them for anything else and never sell them.
5. Automated decisions
Some checks are automated, for example matching your selfie to your ID, screening against sanctions lists and flagging unusual transactions. These can lead to a transaction being held or an application declined. You can ask for a person to review any automated decision that significantly affects you and to explain it.
7. International transfers
Some of our partners process data outside Nigeria or the UK. When this happens we protect your data with the safeguards the law requires, such as transfers to countries recognised as having adequate protection, or contracts approved for this purpose (including the UK International Data Transfer Agreement or Addendum, and the conditions for cross-border transfers under the NDPA).
8. How long we keep it
| Data | How long |
|---|---|
| Identity checks and transaction records | At least 5 years after your account closes, as anti-money laundering laws require |
| Account details | While your account is open, then as above |
| Unfinished sign-ups | [12 months], unless the law requires longer |
| Support messages and complaints | [3 years] after the matter is closed |
| Marketing preferences | Until you withdraw consent or close your account |
| Device and security logs | [12 months] |
9. Keeping it safe
We protect your data with encryption in transit and at rest, strict access controls on a need-to-know basis, staff training and regular security testing. If a breach puts your rights at risk, we will tell you and the regulator as the law requires.
10. Your rights
You have the right to:
- get a copy of your personal data;
- correct data that is wrong or incomplete;
- ask us to delete data, where we are not required to keep it;
- object to or restrict how we use it;
- receive your data in a portable format;
- withdraw consent at any time, without affecting earlier use;
- ask for a person to review automated decisions.
Email privacy@binebit.com. We may need to confirm your identity first. We will reply within one month (UK) or [the period required by the NDPA] (Nigeria). It is free, unless a request is clearly unfounded or excessive.
Some data, such as identity and transaction records, must be kept for legal reasons even if you ask us to delete it. We will explain if this applies.
11. Marketing
We will only send you marketing if you agree. You can opt out at any time from the app settings or the link in any marketing email. We will still send messages about your account, transactions and security.
12. Children
BineBit is only for people aged 18 or over. If we learn that we hold data about someone younger, we will delete it unless the law requires us to keep it.
14. Complaints to a regulator
Please contact us first so we can try to help. You also have the right to complain to the data protection regulator:
- Nigeria: Nigeria Data Protection Commission (NDPC), ndpc.gov.ng
- United Kingdom: Information Commissioner's Office (ICO), ico.org.uk
15. Changes to this policy
We will update this policy when our practices change and tell you in the app or by email before significant changes take effect.