Privacy Policy
Last updated: September 1, 2026
This policy explains what personal data Providence Investment & Allied Ltd collects when you use our mobile apps and website, why we collect it, the lawful bases we rely on, who we share it with, and the rights you have under the Nigeria Data Protection Act 2023 ("NDPA") and its implementation directives.
1. Who we are
Providence Investment & Allied Ltd is the data controller for the personal data described in this policy. We are a company incorporated in Nigeria and operating in Nigeria.
- General privacy questions: privacy@plotpay.company
- Data Protection Officer (DPO): dpo@plotpay.company
- Registered office: Lagos, Nigeria.
2. Scope
This policy applies to the PlotPay user app, agent app, website, and any interaction with our team or accredited field agents. It does not cover third-party websites or services that have their own privacy policies (for example, your bank's app).
3. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Identity data | Full name (exactly as it should appear on land documents), date of birth, gender, marital status, nationality, country of residence | You |
| Verification data | Means of identification (National ID, driver's licence, voter's card, or international passport), identification number, proof of address, occupation, industry, work address | You |
| Next-of-kin data | Name, address, phone number, and email of your next of kin | You |
| Child beneficiary data | For purchases in a child's name (e.g. Tiara Cradle Estate): the child's full name, date of birth, and gender, plus the parent or guardian's identity and relationship to the child | Parent or guardian |
| Corporate data | For company subscriptions: company name, registered address, BC (incorporation) number, industry, and contact person's details | You |
| Contact data | Email address, phone number, residential address | You |
| Account data | Sign-in credentials and authentication events (managed by our authentication provider) | You / your device |
| Payment data | Bank transfer receipts you upload, amounts, dates, references, and your payout bank details. We never collect card numbers or internet-banking passwords | You / our bank |
| Goal data | Plots you view, select, and save toward; Goal amounts, Tenors, payment history, refund requests | Your activity |
| Referral data | How you heard about us, including realtor and influencer referral codes used at onboarding | You / Agents |
| Agent interactions | Collections made through Agents, inspection bookings, Agent notes linked to your account | You / Agents |
| Device & usage data | Device model, OS, app version, push-notification token, IP address, crash logs, feature usage | Your device |
| Communications | Messages you send us by email, in-app support, or through Agents | You |
We do not intentionally collect sensitive ("special category") data such as health, biometric, or religious information. Please do not include such information in receipts or messages you send us.
4. Purposes and lawful bases
We process personal data only where we have a lawful basis under Section 25 of the NDPA:
| Purpose | Data used | Lawful basis |
|---|---|---|
| Create and secure your account | Identity, contact, account data | Performance of a contract |
| Run your Goals: record and verify payments, reserve and allocate Plots, issue documentation | Identity, contact, payment, and goal data | Performance of a contract |
| Land documentation in your or your child's name | Identity, verification, child beneficiary, and corporate data | Performance of a contract and legal obligation (land registry requirements) |
| Refunds and payouts | Payment data, payout bank details | Performance of a contract |
| AML/CFT compliance, fraud detection, forged-receipt checks | Identity, payment, device data | Legal obligation (MLPPA 2022, SCUML) and legitimate interest |
| Service messages: payment reminders, goal updates, allocation notices | Contact, goal, and device data | Performance of a contract and legitimate interest |
| Product improvement and analytics (aggregated) | Device & usage data | Legitimate interest |
| Marketing: new estates, launch announcements | Contact data | Consent (you can withdraw at any time) |
| Establishing or defending legal claims | Any relevant records | Legitimate interest and legal obligation |
5. Cookies and similar technologies
Our website uses only strictly necessary cookies and storage required to serve pages securely. We do not use advertising or cross-site tracking cookies. The mobile apps store sign-in tokens and your app preferences on your device.
6. Who we share your data with
We share personal data only as needed to run PlotPay, and never sell it. Recipients:
| Recipient | Role | Data shared |
|---|---|---|
| Clerk | Authentication provider | Account and sign-in data |
| Supabase | Database hosting | Account, goal, and payment records |
| Cloudflare (R2) | Encrypted file storage | Payment receipts and documents |
| Resend | Transactional email delivery | Email address and message content |
| Expo / EAS | App delivery and push notifications | Device and push-token data |
| Accredited Agents | Payment support and inspections | Your name, contact, and relevant goal details |
| Regulators & authorities | NFIU, SCUML, NDPC, law enforcement, only where the law requires | As legally required |
| Professional advisers | Lawyers, auditors, bankers under confidentiality duties | As needed for the engagement |
Each service provider processes data on our documented instructions and under confidentiality and security obligations.
7. International transfers
Some of our service providers run infrastructure outside Nigeria. Where your data is transferred internationally, we do so in line with Sections 41-43 of the NDPA, on the basis of an adequacy determination by the Nigeria Data Protection Commission, or appropriate safeguards such as standard contractual clauses, or your explicit consent where required.
8. How long we keep your data
| Record | Retention period |
|---|---|
| Account and profile data | For the life of your account, then up to 7 years after closure to meet financial record-keeping obligations |
| Payment receipts and goal records | At least 7 years from the transaction date |
| KYC / verification documents | At least 5 years after the end of the relationship, as required by AML rules |
| Support correspondence | Up to 3 years |
| Marketing preferences | Until you unsubscribe or withdraw consent |
| Device and usage logs | Up to 24 months, then aggregated or deleted |
When data is no longer required, we delete it or irreversibly anonymise it.
9. How we protect your data
- Encryption in transit (TLS) on all app and web traffic, and encryption at rest for stored receipts and documents.
- Access to customer data is limited to a small number of super-admin accounts, with full audit logging of administrative actions.
- Receipt and document storage uses private, access-controlled buckets. Files are never publicly listed.
- Staff and Agents receive confidentiality and data-handling instructions, and Agent access is limited to the customers they serve.
- We review our service providers' security posture before integrating them.
9.1 Data breach response
If a personal data breach occurs, we will notify the Nigeria Data Protection Commission within 72 hours where the NDPA requires it, and . Where the breach is likely to result in a high risk to you, we will also notify you directly with advice on protective steps.
10. Your rights under the NDPA
You can, at any time:
- Request confirmation of whether we hold your personal data and obtain a copy of it (access).
- Ask us to correct inaccurate or incomplete data (rectification).
- Ask us to delete your data where we have no legal obligation to keep it (erasure).
- Ask us to restrict how we process your data in certain circumstances.
- Receive the data you gave us in a structured, commonly used, machine-readable format (portability).
- Object to processing based on legitimate interests, including profiling, and to direct marketing at any time.
- Withdraw consent where processing is based on consent. This does not affect processing already carried out.
- Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not currently make such decisions.
To exercise any right, email privacy@plotpay.company from your registered address. We respond within 30 days, as required by the NDPA. We may need to verify your identity first.
10.1 Complaints
If you are unhappy with how we handle your data, please contact us first. Most issues resolve quickly. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.
11. Children
PlotPay accounts are for adults. You must be 18 or older to create one. The only children's data we hold is for land purchased in a child's name (for example, on Tiara Cradle Estate): in that case the parent or legal guardian provides the child's details, consents to their use for the land documents, and acts on the child's behalf. We never market to or contact the child directly.
12. Changes to this policy
We may update this policy from time to time. Material changes will be announced in the app or by email before they take effect, and the "last updated" date above always shows the current version.
13. Contact
Privacy and data rights: privacy@plotpay.company · DPO: dpo@plotpay.company
For the rules on using the service, see our Terms & Conditions.