Privacy Policy

1. Introduction

VineSub Tech ("we", "us", "our") operates Q-VTU & Reseller Hub (the "Platform"). This Privacy Policy explains how we collect, use, disclose and safeguard your information when you use the Platform.

We are committed to protecting your personal data in line with the Nigeria Data Protection Act (NDPA) 2023 and, where applicable, the Nigeria Data Protection Regulation (NDPR). By using the Platform, you consent to the practices described in this Policy.

2. Information We Collect

2.1 Information You Provide

• Registration data: full name, username, email, phone number, state of residence, and password.
• KYC data (optional): BVN, NIN, ID type and number (only if you choose to submit for verification).
• Profile data: profile photo, transaction PIN (hashed), 2FA secret.
• Bank account data: bank name, account name, account number (for withdrawals).
• Support data: tickets you submit, replies, feedback, ratings.
• Payment data: the amount you fund, the funding channel used, and the reference generated. We never store raw card details — those are handled entirely by Flutterwave.

2.2 Information Collected Automatically

• Device & browser: user-agent, browser type, screen size.
• Network: IP address, approximate location (city-level).
• Usage: pages visited, features used, transaction history, login times.
• Security: login attempts, failed 2FA attempts, unusual activity signals.

2.3 Information from Third Parties

• VINE-VTU: transaction status, provider references, wallet balances at the provider.
• Flutterwave: payment status, confirmation references, and (for dispute resolution) limited customer details.
• Telecom/cable/exam providers: only delivery confirmations — never your personal identifiers.

2.4 Information We Do NOT Collect

• Raw card numbers, CVV, or full PIN blocks.
• Biometric data.
• Contacts or SMS from your phone.
• Location history (we only resolve IP to city level for security).

3. How We Use Your Data

We process your data for the following purposes and legal bases:

4. Data Sharing & Disclosure

We do not sell your personal data. We share information only with the following parties, under strict confidentiality:

4.1 Service Providers

• VINE-VTU — your transaction request (network, recipient number, plan, amount) is sent to VINE-VTU to fulfil the purchase. They do not receive your account password or email.
• Flutterwave — for card and online payments, we share your name, email and phone number as required by the payment processor. They handle all card details under PCI-DSS compliance.
• Telecom / cable / exam providers — recipient number and plan details only, as required to deliver the service.

4.2 Legal & Regulatory

We may disclose data when required to:

• Comply with a lawful court order, subpoena or regulator request.
• Enforce our Terms of Service.
• Protect the rights, property or safety of the Company, our users, or the public.

4.3 Business Transfers

If the Company is acquired, merged or undergoes a similar corporate event, your data may be transferred to the successor entity under the same privacy commitments.

5. Cookies & Similar Technologies

We use cookies and similar technologies for the following purposes:

• Essential cookies: session management, login persistence.
• Security cookies: CSRF tokens, login attempt tracking.
• Preference cookies: remembering your UI choices.
• Analytics cookies (optional): aggregated, anonymised statistics about how users navigate the Platform.

You can control cookies through your browser settings. Disabling essential cookies may prevent the Platform from working properly.

6. Data Security

We implement a range of technical and organisational measures to protect your data:

• Encryption in transit — all connections use TLS/HTTPS.
• Password hashing — passwords and PINs are stored using bcrypt; we never see your plain password.
• Session security — HTTP-only cookies, SameSite protection.
• Rate limiting — on login, API and funding endpoints.
• Access control — only authorised staff can access user data on a need-to-know basis.
• Audit logging — every sensitive admin action is logged.
• Regular backups — encrypted and access-controlled.

7. Data Retention

We retain your data for as long as necessary to fulfil the purposes in this Policy, plus any additional period required by law:

8. Your Rights

Under Nigerian data protection law, you have the following rights:

• Right to be informed — how we process your data (this Policy).
• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — correct inaccurate or incomplete data.
• Right to erasure — request deletion of your data (subject to legal retention requirements).
• Right to restrict processing — limit how we use your data.
• Right to object — to certain processing activities such as direct marketing.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to withdraw consent — for consent-based processing.
• Right to lodge a complaint — with the Nigeria Data Protection Commission (NDPC).

To exercise any of these rights, contact us at vinesubtech@gmail.com. We will respond within 30 days.

9. Children's Privacy

The Platform is not intended for users under 18 years old. We do not knowingly collect data from minors. If you believe a minor has provided us with personal data, please contact us immediately and we will delete it.

10. Third-Party Links

The Platform may contain links to third-party websites (WhatsApp, Flutterwave, provider docs, etc.). We are not responsible for the privacy practices of those sites. We encourage you to review their policies before submitting any data.

11. International Data Transfers

Some of our service providers (e.g., Flutterwave, cloud infrastructure) may store or process data outside Nigeria. When this happens, we ensure appropriate safeguards are in place (standard contractual clauses or equivalent) as required by the NDPA.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal requirements. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Send an in-app notification.
• Where appropriate, email you at your registered address.

Continued use of the Platform after an update constitutes acceptance of the revised Policy.

13. Contact / Data Protection Officer

For any privacy-related questions, requests or complaints, contact our Data Protection Officer:

• Email: vinesubtech@gmail.com
• Phone / WhatsApp: +2347039615126
• Support ticket: Create a ticket
• Data Controller: VineSub Tech

If you are unsatisfied with our response, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.