Privacy Notice

Who we are

Trust Aboki is the data controller for the personal data described here, under the Nigeria Data Protection Act 2023 (“NDPA”). Contact us about your data at privacy@trustaboki.com. These rules sit alongside our Terms of Use.

What we collect

• Account: your name, email address and a scrypt hash of your password (we never store your password itself). A phone number only if you choose to confirm one.
• Profile: whether you want to buy/sell FX or run a BDC, and the city you choose.
• Marketplace activity: the requests you post (currency, amount, purpose, timing and area, never a street address), the offers BDCs send you, the terms you agree, what each side reports about the exchange, and reviews.
• Messages: what you and a BDC write to each other after you choose its offer, and any photos, screenshots or PDFs either of you share there.
• Reports, disputes and appeals: what you tell us and any evidence you upload.
• BDC businesses: business and licence details, and the documents a BDC uploads for its verification. These are stored encrypted and only staff reviewing them can open them.
• Security records: sign-in sessions (with IP address and browser type) and an audit log of important account actions, including which version of these terms you accepted. In the audit log, IP addresses are stored only as a keyed hash.
• Notification settings: your choices, and a device address if you turn on browser notifications.
• Usage events: what happens in the marketplace (for example “offer sent”), linked to an internal id, never to your email, phone or name.

We do not collect your BVN, NIN, passport, card or bank details. Licensed BDCs perform their own identity checks when you exchange money with them, as their regulator requires, and they are responsible for the data they collect. We never receive or hold the money you exchange: you pay the BDC directly.

Why we use it, and on what legal basis

• To create and secure your account, pass your request to BDCs that can serve it, deliver their offers and your messages, and keep a record of what was agreed: performance of our contract with you.
• To prevent fraud and abuse, investigate reports and disputes, verify BDCs’ licences and improve the service: our legitimate interests, which we balance against your rights.
• To keep records and respond to lawful requests from regulators, law enforcement and courts: legal obligation.
• Optional emails, text messages and browser notifications: your consent, which you can withdraw at any time in your notification settings. Security emails are always sent.

We don’t make decisions with legal or similar effects about you by automated means alone. Automated risk signals only flag activity for a person on our staff to review.

Who sees it

• BDCs: a BDC that can serve your request sees its details, never your email or phone. After you choose its offer, that BDC sees your first name and last initial and can message you.
• Other users: reviews show only a short version of your name.
• Our staff: only when reviewing a report, dispute, appeal or verification; opening private files is recorded in the audit log.
• Service providers that run parts of the service for us under contract, such as hosting, file storage, email and text-message delivery, malware scanning and error tracking (error reports carry no names, emails or messages).
• Authorities: when the law requires it, or to protect someone’s safety or our legal rights.

We don’t sell personal data and we don’t use advertising trackers.

Cookies and storage on your device

We use only the cookies needed to keep you signed in and protect your account, and your browser’s local storage for conveniences such as unsent message drafts. We use no advertising or third-party tracking cookies, so there is nothing to opt out of.

Transfers outside Nigeria

Some service providers may process data outside Nigeria. Where they do, we use the safeguards the NDPA allows, such as a country the Nigeria Data Protection Commission recognises as adequate, or contractual commitments that protect your data to the same standard.

How long we keep it

Account data is kept while your account is open. Messages are kept for two years after a conversation’s last message, shared files for 90 days after the request closes (longer while a dispute is open), dispute records for six years after closure and the audit log for five years. When you delete your account, your personal details are removed at once and linked records follow these schedules, unless the law requires us to keep them longer.

Security

We protect data with encryption in transit, encrypted storage for private files, access limited to staff who need it with two-step sign-in, and an append-only audit log. If a breach is likely to put your rights at risk, we will tell the Nigeria Data Protection Commission within 72 hours and tell you without undue delay.

Your rights

Under the NDPA you can ask to access, correct or delete your personal data, to receive it in a portable format, to restrict or object to processing, and to withdraw consent. Write to privacy@trustaboki.com; we will answer within the time the law sets. You can also complain to the Nigeria Data Protection Commission.

Children

Trust Aboki is for people aged 18 and over. We don’t knowingly collect children’s data.

Changes

We will update this notice when what we do changes, and tell account holders about material changes before they take effect.