Privacy policy
How Tovajo collects, uses, protects and retains personal data, and your rights under the Nigeria Data Protection Act 2023.
Who we are
Tovajo is operated by [Tovajo legal entity name], [registered address] ("Tovajo", "we"). We are the data controller for the personal data described here. Contact our data protection officer at [DPO contact].
What we collect and why
| Data | Why we use it | Lawful basis |
|---|---|---|
| Name, username, email, phone number, profile photo, country, time zone | To create and run your account and show you to the groups you join | Contract |
| Date of birth (where needed) | To confirm you are old enough to join financial groups | Legal obligation / contract |
| Group activity: contributions recorded, confirmations, payout order, messages | To provide the group features you and your group members use | Contract |
| Security records: IP address, browser and device type, sign-in times, security events | To protect your account, detect fraud and investigate incidents | Legitimate interests; legal obligation |
| Messages you send us | To answer you | Legitimate interests |
We do not collect precise location or invasive device fingerprints, and we do not sell personal data.
Security records
When you register, sign in or make important account changes, we record the IP address your request came from (as seen by our servers), your browser and device type, and the time. We use these records only to keep accounts secure, detect suspicious activity and investigate problems. They are visible only to you (for your own sessions) and to authorised Tovajo staff. Other group members never see them. We keep them for 24 months.
Who can see your data
- Group members see your display name, username, profile photo and your activity in groups you share. They do not see your email, phone number, IP address or devices.
- Service providers that host our systems, send emails or messages, or provide security services, under contracts that require them to protect your data.
- Authorities where the law requires us to share information.
How long we keep data
Account data is kept while your account is open. Financial and contribution records are kept for at least six years after a group ends, because financial record-keeping laws may require it. Security records are kept for 24 months. Contact messages are kept for 24 months.
Your rights
Under the Nigeria Data Protection Act 2023 you can ask to access, correct, port or delete your data, object to certain processing, and withdraw consent where we rely on it. Some records (for example financial records we must keep by law) cannot be deleted while that obligation applies. You can complain to the Nigeria Data Protection Commission.
Security
We use encryption in transit, hashed passwords, encryption of sensitive secrets, access controls and audit logs. If a data breach is likely to put your rights at risk, we will notify you and the regulator as the law requires.
Changes
We will tell you about material changes before they take effect.