Cloverr Technologies Limited is the Data Controller responsible for your personal data collected through the Cloverr Platform. We are registered under Nigerian law and our principal place of business is Lagos, Nigeria.

Our Data Protection Officer (DPO) can be reached at privacy@cloverr.ng. We have registered with the Nigeria Data Protection Commission (NDPC) as required by the NDPA 2023.

2.1 Information You Provide

2.2 Information Collected Automatically

• Device Information: Device type, operating system, unique device identifiers, mobile network information, and browser type.
• Log Data: IP address, access times, pages viewed, links clicked, referring URLs, and session duration.
• Location Data: Approximate location derived from IP address. We do not collect precise GPS location unless you explicitly grant permission for a location-sensitive feature.
• Usage Data: How you interact with tasks, your task acceptance rate, task completion speed, verification outcomes, and transaction history.
• Cookie & Tracking Data: See Section 7 (Cookies) for full details.

2.3 Information from Third Parties

• Social media platforms (where you grant us permission) — profile verification data and public account metrics.
• Identity verification service providers — document authentication results.
• Payment processors and banks — transaction confirmation data.
• Fraud prevention services — risk scores and flagging signals.

We process your personal data only where we have a lawful basis to do so. The table below summarises our processing activities:

Cloverr does not sell your personal data. We share your data only in the following circumstances:

4.1 Service Providers

We work with carefully selected third-party service providers who process data on our behalf under strict data processing agreements. These include:

• Cloud hosting and infrastructure providers (servers located within Nigeria and the EU).
• Payment processors and financial institutions for withdrawal processing.
• Identity verification and KYC service providers.
• Fraud detection and cybersecurity services.
• Customer support and communication platforms.
• Analytics and crash reporting services.

4.2 Legal Requirements

We may disclose your information to government agencies, law enforcement, regulators, or courts where we are legally required to do so, or where we believe disclosure is necessary to protect the rights, property, or safety of Cloverr, our Users, or the public.

4.3 Business Transfers

In the event of a merger, acquisition, reorganisation, or sale of all or substantially all of Cloverr's assets, your personal data may be transferred to the acquiring entity. We will notify you via email and a prominent Platform notice at least 30 days before any such transfer, and the acquiring entity will be bound by this Privacy Policy.

After the applicable retention period, your data is securely deleted or anonymised in a manner that means it can no longer be attributed to you.

Under the NDPR 2019 and NDPA 2023, you have the following rights regarding your personal data. To exercise any right, contact privacy@cloverr.ng. We will respond within 30 days.

• Right of Access — You may request a copy of the personal data we hold about you, along with information about how we use it.
• Right to Rectification — You may request correction of any inaccurate or incomplete personal data we hold about you.
• Right to Erasure — You may request deletion of your personal data where we no longer have a lawful basis to process it, subject to our legal retention obligations.
• Right to Restrict Processing — You may request that we limit the way we use your data in certain circumstances, for example while a dispute is being resolved.
• Right to Data Portability — You may request that we provide your personal data in a structured, machine-readable format so you can transfer it to another service.
• Right to Object — You may object to processing based on legitimate interest, including direct marketing, at any time.
• Right to Withdraw Consent — Where processing is based on your consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
• Right to Lodge a Complaint — You have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng if you believe we have not handled your data lawfully.

7.1 What We Use

7.2 Managing Cookies

You can manage or disable non-essential cookies through your browser settings or our Cookie Preference Centre accessible from the footer of our Platform. Please note that disabling essential cookies will affect Platform functionality and your ability to log in.

We do not use advertising or third-party tracking cookies. We do not permit third-party advertisers to place cookies on the Platform.

Cloverr implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or damage, including:

• AES-256 encryption of data at rest and TLS 1.3 encryption of all data in transit.
• Role-based access controls ensuring that employee access to personal data is limited to what is necessary for their role.
• Regular security assessments, penetration testing, and vulnerability scanning.
• Multi-factor authentication for all internal systems containing personal data.
• Incident response procedures including mandatory breach notification to the NDPC within 72 hours of discovery where required.
• Regular staff training on data protection and information security.

The Platform is not directed at children under the age of 18, and we do not knowingly collect personal data from anyone under 18 years of age. If we discover that we have inadvertently collected personal data from a person under 18, we will delete it immediately. If you believe a child under 18 has provided us with personal data, please contact us at privacy@cloverr.ng.

Your personal data is primarily processed and stored on servers located within Nigeria. Where we use third-party service providers that process data outside Nigeria, we ensure that appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the NDPC.
• Transfer to countries that the NDPC has determined provide an adequate level of protection.
• Binding corporate rules where the recipient is part of a group of companies.

You may request details of the safeguards in place for any specific international transfer by contacting our DPO at privacy@cloverr.ng.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:

• Update the "Last Updated" date at the top of this Policy.
• Notify you by email at least 14 days before the changes take effect where the changes are material.
• Display a prominent notice on the Platform.

We encourage you to review this Policy periodically. Your continued use of the Platform after the effective date of a revised Policy constitutes your acknowledgement of the changes.

For any questions about this Privacy Policy, to exercise your data subject rights, or to report a concern about how we handle your data, please contact us: