Privacy Policy

Vebpac is operated by Techclan Innovations Ltd (RC [RC NUMBER — TO CONFIRM]), a company registered in Nigeria with its registered office at [REGISTERED ADDRESS — TO CONFIRM].

For the purposes of the Nigeria Data Protection Act 2023 (the "NDPA"), we are the data controller of the personal information described in this policy. That means we decide what information is collected and why.

If you have any question about this policy, or want to exercise any of the rights described in it, write to us at [PRIVACY EMAIL — TO CONFIRM].

We only collect what we need to run your account, take payments, pay you out, and keep competitions fair. In practice that falls into six groups.

Account information, given when you sign up:

• Your first name and surname
• Your username, which is also your referral code and is visible to other members
• Your email address
• A password, which we store only as a salted hash and can never read
• The referral code of whoever invited you, if you signed up through one

Contact and verification information:

• Your phone number and, optionally, your WhatsApp number
• One-time codes we send by email or SMS to confirm those details belong to you

Identity and payout information, given during KYC and only needed before you withdraw money:

• Your date of birth and gender
• Your residential address
• Your bank account name, number and bank, so we can pay you
• A delivery address, if you win a physical prize that needs shipping

Financial and transaction information:

• Your wallet balances and every transaction against them
• Deposits, withdrawal requests and their status
• Your membership tier, subscription history and subscription charges
• Card authorisation tokens returned by our payment processor. We never see or store your full card number, expiry date or CVV
• Referral rewards earned on people you invited

Competition information:

• Which WishPools you entered and when
• Your quiz answers, the time you took, and your resulting score and rank
• Whether you won, and any prize fulfilment details

Technical information, collected automatically:

• Your session, so you stay signed in between visits
• Your IP address and browser or device information, used for security and to detect duplicate or automated entries
• A record of significant actions on your account, kept in our audit log

Under the NDPA we must have a lawful basis for every use of your information. Ours are as follows.

To perform our contract with you. This covers creating and running your account, entering you into WishPools, scoring quizzes, awarding and delivering prizes, taking subscription payments, crediting your wallet and processing your withdrawals.

To comply with a legal obligation. This covers verifying your identity, keeping financial and transaction records for the periods the law requires, and responding to lawful requests from regulators, tax authorities or law enforcement.

For our legitimate interests. This covers keeping the platform secure, preventing fraud and cheating, enforcing our Terms of Use, understanding how the product is used so we can improve it, and defending legal claims. We have weighed your rights in each case and do not rely on this basis where your interests override ours.

With your consent. This covers optional marketing messages and any non-essential cookies. You can withdraw consent at any time, and withdrawing it does not affect anything we did before you withdrew it.

WishPool winners are decided by a scoring process that runs automatically: your quiz answers are marked for accuracy, ranked against other entrants, and tie-broken by completion time, under the rules published on each pool before you enter.

This is automated decision-making, and it affects whether you win a prize. We do it this way deliberately, because a rule the software applies identically to everyone is fairer than a human judgement made after the fact. The published rules, the final leaderboard and your own answers are all available to you.

We also run automated checks for duplicate accounts, automated entry and other manipulation, using the technical information described above. If a check flags your entry, you have the right to ask a person to review it. Write to us and a member of the team will look at it and explain the outcome.

We do not sell your personal information, and we never will. We share it only with the service providers we need to run the platform, and only what they need to do their job.

• Paystack, for payment processing, card authorisation and bank transfers for your withdrawals
• Termii, for sending one-time verification codes by SMS
• Resend, for sending transactional email such as verification codes, receipts and withdrawal notifications
• DiceBear, for generating your profile avatar from your username. No account information is sent beyond the seed used to draw the image
• Our hosting and database providers, who store the platform and its data

Each of these processes your information on our instructions and under a contract that requires them to protect it.

We may also share information where the law requires it, with regulators, tax authorities, law enforcement or a court, or where we need to establish, exercise or defend a legal claim. If our business is ever sold or reorganised, your information may transfer to the new owner, who would remain bound by this policy.

Some of the providers listed above process information outside Nigeria. Where that happens we rely on the transfer mechanisms permitted by the NDPA: either the country in question offers an adequate level of protection, or our contract with the provider imposes protections equivalent to those you have here.

You can ask us for details of the safeguards that apply to any particular transfer by writing to [PRIVACY EMAIL — TO CONFIRM].

We keep your information for as long as your account is open, and afterwards only as long as we have a reason to.

• Account and profile information, until you close your account, then deleted or anonymised
• Financial and transaction records, including wallet, subscription and withdrawal history, kept for the period Nigerian financial and tax law requires, which is longer than the life of your account
• KYC and identity records, kept for the retention period required of us after the account relationship ends
• Quiz entries, answers and leaderboards, kept while the pool is live and for a period afterwards so results stay auditable and disputes can be resolved
• Security logs and audit records, kept for a limited period for fraud prevention and security

When a retention period ends we delete the information or anonymise it so it can no longer be linked to you.

The NDPA gives you the following rights over your personal information. All of them are free to exercise, and we will respond within 30 days.

• Access, to ask for a copy of the information we hold about you
• Rectification, to have inaccurate or incomplete information corrected
• Erasure, to ask us to delete your information where we have no overriding legal reason to keep it
• Restriction, to ask us to pause our use of your information while a dispute about it is resolved
• Objection, to object to processing we carry out for our legitimate interests, and to direct marketing at any time
• Portability, to receive the information you gave us in a structured, commonly used, machine-readable format
• Withdrawal of consent, where we rely on consent, at any time
• Human review of an automated decision that affects you, as described above

To exercise any of these, write to [PRIVACY EMAIL — TO CONFIRM]. We may need to confirm your identity first, so that we don't disclose your information to someone else.

If you are not satisfied with how we have handled your request, you can complain to the Nigeria Data Protection Commission (NDPC). We would ask you to come to us first, so we have a chance to put it right.

Passwords are stored only as salted hashes, so nobody at Vebpac can read yours. Traffic between your device and our servers is encrypted in transit. Access to production data is limited to staff who need it, and significant staff actions are written to an audit log.

Withdrawals carry extra protection: your email address must be verified, and a bank account locks once you have saved it, so it cannot be quietly changed by someone who gains access to your account.

No system is perfectly secure, and we will not pretend otherwise. If a breach occurs that is likely to result in a risk to your rights, we will notify the NDPC and, where the risk is high, you directly.

Vebpac is not for children. You must be at least 18 to open an account, and we do not knowingly collect information from anyone under 18.

If you believe a child has given us their information, write to [PRIVACY EMAIL — TO CONFIRM] and we will delete it and close the account.

We use a small number of cookies, chiefly to keep you signed in. Our Cookie Policy explains what each one does and how to control them.

We update this policy when the way we handle information changes. The "last updated" date at the top always reflects the current version.

If a change materially affects your rights, we will tell you by email or through an in-app notice before it takes effect, rather than relying on you to notice.