Privacy Policy

1. Introduction

CreativePluck Limited ("we", "us", or "our") operates the Witti platform, comprising the website accessible at https://trywitti.com and the Witti mobile application (collectively, the "Service"). We are committed to protecting and respecting your privacy, and this Privacy Policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us.

This Privacy Policy should be read in conjunction with our Terms and Conditions, which govern your use of the Service. By accessing or using our Service, you acknowledge that you have read, understood, and consent to the data practices described herein. If you do not agree with the terms of this Privacy Policy, you are advised to discontinue use of our Service immediately.

We encourage you to read this document carefully. If you have any questions or concerns, please contact us using the details provided at the end of this document.

2. Definitions

For the purposes of this Privacy Policy, the following terms shall have the meanings ascribed to them below:

• "Service" means the Witti website at https://trywitti.com and the Witti mobile application operated by CreativePluck Limited.
• "Personal Data" means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, or online identifier.
• "Usage Data" refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself, such as the duration of a page visit or feature interaction.
• "Cookies" are small data files placed on your device (computer or mobile device) when you access or use the Service.
• "Data Controller" means the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of Personal Data. For the purposes of this Privacy Policy, CreativePluck Limited is the Data Controller.
• "Data Processor" or "Service Provider" means any natural or legal person who processes data on behalf of the Data Controller.
• "Data Subject" means the living individual to whom Personal Data relates.
• "User" means the individual accessing or using the Service. The User corresponds to the Data Subject.
• "Chargeback" means a reversal of a payment transaction initiated by a cardholder or bank, resulting in a return of funds to the payer.

3. Information We Collect

We collect information to deliver and continuously improve our Service. The categories of information we collect are described below.

3.1 Personal Data

When you register for, access, or use the Service, we may collect certain personally identifiable information that allows us to identify and communicate with you. This may include, but is not limited to:

• Full name and contact details (email address, phone number)
• Residential or business address, including city, state, and postal code
• Financial and banking information necessary to facilitate transactions on the Service
• Identity verification information, including government-issued ID, Bank Verification Number (BVN), or passport number, as required to comply with applicable Know Your Customer (KYC) obligations

We may use your Personal Data to communicate with you regarding your account, updates to the Service, and, where you have consented, to send you promotional or marketing materials. You may withdraw consent for marketing communications at any time by clicking the unsubscribe link in any such communication or by contacting us directly.

3.2 Usage Data

We automatically collect certain technical information whenever you interact with the Service. This Usage Data may include your device's Internet Protocol (IP) address, browser type and version, the pages of the Service you visit, timestamps of your visits, time spent on pages, unique device identifiers, and other diagnostic data. On mobile devices, this information may additionally include your device model, mobile operating system, and mobile browser type.

3.3 Location Data

With your prior consent, we may collect and process information about your approximate or precise geographical location to provide and enhance certain features of the Service. You may enable or disable location tracking at any time through your device settings. Disabling location services may affect your ability to access certain features of the Service.

3.4 KYC and Identity Verification Information

In order to comply with applicable anti-money laundering (AML), counter-terrorism financing (CTF), and financial services regulations in Nigeria and other applicable jurisdictions, we may be required to verify your identity before enabling certain features, such as payment processing. You may be required to provide a valid government-issued identification document, your Bank Verification Number (BVN), or your international passport number. This information is processed securely and in accordance with applicable law.

3.5 Cookies and Tracking Technologies

We use cookies and similar tracking technologies (such as web beacons, pixel tags, and scripts) to track activity on the Service, maintain session integrity, and improve user experience. You may configure your browser to refuse cookies or to alert you when cookies are being placed. Please note that refusing cookies may impair the functionality of certain parts of the Service.

We use the following categories of cookies:

• Session Cookies – Used to maintain your session and operate core features of the Service.
• Preference Cookies – Used to remember your preferences and personalised settings.
• Security Cookies – Used to support our security mechanisms and protect your account.
• Advertising Cookies – Used to deliver advertisements relevant to your interests and browsing activity.

4. How We Use Your Information

CreativePluck Limited processes your data for the following purposes:

• To provide, maintain, and improve the Service;
• To process and facilitate transactions, including payments and disbursements;
• To verify your identity and comply with applicable regulatory and legal obligations, including KYC/AML requirements;
• To notify you of material changes to the Service or this Privacy Policy;
• To respond to your enquiries and provide customer support;
• To monitor and analyse usage patterns to improve the performance and features of the Service;
• To detect, investigate, and prevent fraudulent, unauthorised, or illegal activity;
• To send you transactional communications, including account notifications, payment confirmations, and renewal notices;
• To send you marketing and promotional communications, where you have consented to receive them;
• To fulfil any other purpose for which the information was provided, or as disclosed at the time of collection;
• To comply with applicable laws and to enforce our legal rights and obligations.

5. Retention of Data

We will retain your Personal Data only for as long as is reasonably necessary for the purposes described in this Privacy Policy, or as required by applicable law. In particular, data collected for regulatory compliance purposes (including KYC/AML records) may be retained for a minimum of five (5) years following the conclusion of the relevant business relationship, in accordance with Nigerian financial services regulations and applicable international standards.

Usage Data is generally retained for a shorter period, unless it is required to be retained for security purposes, to improve the functionality of the Service, or where we are under a legal obligation to retain it for a longer period.

When your Personal Data is no longer required, we will take reasonable steps to ensure it is securely deleted or anonymised in a manner that prevents reconstruction or identification.

6. Transfer of Data

Your Personal Data may be transferred to, and processed on, servers located outside of your country of residence or the Federal Republic of Nigeria, including in jurisdictions where data protection laws may differ from those applicable in your jurisdiction. Where such transfers occur, we will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy, including, where required, by implementing appropriate contractual safeguards.

By using the Service and providing us with your information, you consent to such transfers. We will not transfer your Personal Data to any organisation or country unless adequate data security controls are in place.

7. Disclosure of Your Information

We may disclose your Personal Data in the following circumstances:

• Law Enforcement and Regulatory Compliance – We may disclose your information where required to do so by law, or in response to a valid court order, subpoena, regulatory directive, or request from a competent public authority, including the Central Bank of Nigeria (CBN), the Nigerian Financial Intelligence Unit (NFIU), or any other applicable regulatory body.
• Business Transactions – In the event of a merger, acquisition, restructuring, or sale of all or substantially all of our assets, your Personal Data may be transferred to the relevant successor entity. We will notify you in advance of any such transfer where required by law.
• Affiliates and Subsidiaries – We may share your information with our affiliated entities and subsidiaries for purposes consistent with this Privacy Policy.
• Service Providers – We engage third-party vendors and service providers who process your data on our behalf, subject to contractual obligations of confidentiality and data security. These parties are not permitted to use your data for any purpose other than providing services to us.
• Protection of Rights – Where we reasonably believe disclosure is necessary to protect the rights, property, or safety of CreativePluck Limited, our users, or third parties.
• With Your Consent – In any other circumstance, with your prior explicit consent.

8. Payment Processing

Where the Service involves paid features or financial transactions, we use reputable third-party payment processors to handle all payment-related activities. We do not store, process, or have access to your full payment card details at any point. Such information is transmitted directly and securely to our payment processing partners.

We currently work with the following payment processors:

• Flutterwave – Operated by Flutterwave, Inc. Their Privacy Policy is available at https://flutterwave.com/us/privacy-policy
• Paystack – Operated by Paystack Payments Limited, a subsidiary of Stripe, Inc. Their Privacy Policy is available athttps://paystack.com/terms

Both processors are compliant with applicable PCI-DSS (Payment Card Industry Data Security Standard) requirements, as managed by the PCI Security Standards Council. Their security practices are designed to ensure the secure handling of cardholder and financial data.

9. Third-Party Service Providers and Analytics

9.1 Analytics

We may engage third-party analytics providers to help us understand how users interact with our Service. These providers collect information such as visit frequency, pages viewed, and feature usage, using cookies and similar tracking technologies. This data is used to improve the quality and relevance of the Service.

Google Analytics: We use Google Analytics, a web analytics service provided by Google LLC. Google uses the data collected to track and report on Service usage. For more information, please visit Google's Privacy Terms at https://policies.google.com/privacy.

9.2 Remarketing and Advertising

We may use third-party advertising networks and remarketing services to display targeted advertisements to you on other platforms following your visit to our Service. This is done using cookies and tracking technologies. You may opt out of interest-based advertising at any time through the relevant platform settings.

Our remarketing partners may include:

• Google Ads (AdWords) – You may opt out via the Google Ads Settings page or by installing the Google Analytics Opt-out Browser Add-on.
• Meta (Facebook) – You may manage your ad preferences via your Facebook account settings.
• X (Twitter) – You may opt out of interest-based ads via your X account settings.

9.3 Development and Infrastructure

We use GitHub, a development platform operated by GitHub, Inc. (a subsidiary of Microsoft Corporation), for code management and software development infrastructure. For more information, please visit the GitHub Privacy Statement athttps://docs.github.com/en/site-policy/privacy-policies/github-privacy-statement.

10. Security of Your Data

The security of your Personal Data is of paramount importance to us. We implement and maintain appropriate technical and organisational measures to protect your data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include encryption of data in transit, access controls, and secure server infrastructure.

However, you should be aware that no method of electronic transmission or storage is entirely secure. While we endeavour to protect your data using commercially reasonable means, we cannot guarantee its absolute security. You are responsible for maintaining the confidentiality of any credentials used to access the Service and for immediately notifying us of any suspected unauthorised use of your account.

11. Your Rights Under Applicable Data Protection Law

11.1 General Data Protection Regulation (GDPR)

If you are a resident of the European Union (EU) or European Economic Area (EEA), you are entitled to the following rights under the General Data Protection Regulation (EU) 2016/679 (GDPR):

• Right of Access – You have the right to request a copy of the Personal Data we hold about you.
• Right of Rectification – You have the right to request that we correct any inaccurate or incomplete Personal Data.
• Right to Erasure – You have the right to request the deletion of your Personal Data, subject to applicable legal retention obligations.
• Right to Restrict Processing – You have the right to request that we limit the processing of your Personal Data in certain circumstances.
• Right to Data Portability – You have the right to receive your Personal Data in a structured, commonly used, and machine-readable format.
• Right to Object – You have the right to object to the processing of your Personal Data on grounds relating to your particular situation.
• Right to Withdraw Consent – Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please contact us at the email address set out at the end of this Policy. We may require you to verify your identity before responding to your request. You also have the right to lodge a complaint with your local Data Protection Authority within the EEA.

11.2 California Consumer Privacy Act (CCPA)

If you are a resident of the State of California, you have the following rights under the California Consumer Privacy Act (CCPA):

• The right to know what categories of Personal Data we collect about you, the purposes for collection, and the third parties with whom it is shared.
• The right to request deletion of your Personal Data, subject to applicable exceptions.
• The right to opt out of the sale of your Personal Data. We do not sell or rent your Personal Data to any third parties for commercial purposes.
• The right not to be discriminated against for exercising any of your CCPA rights.

To exercise your rights under the CCPA, please contact us by email at hello@trywitti.com. We will respond to all verifiable consumer requests within the timeframes prescribed by applicable law.

11.3 Nigerian Data Protection Act (NDPA)

CreativePluck Limited recognises the applicability of the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation (NDPR) issued by the Nigeria Data Protection Commission (NDPC). Nigerian users have the right to access, correct, and request deletion of their Personal Data, and to object to or restrict its processing, in accordance with the NDPA. For enquiries or complaints relating to your rights under Nigerian law, you may also contact the Nigeria Data Protection Commission at https://ndpc.gov.ng.

12. Do Not Track Signals

We honour Do Not Track (DNT) signals transmitted by your web browser. Where a DNT browser mechanism is active, we will not track your browsing activity, plant advertising cookies, or serve targeted advertisements based on your browsing history. You may enable or disable the Do Not Track preference through your browser's settings or preferences page.

13. Children's Privacy

The Service is not directed at, nor intended for use by, individuals under the age of thirteen (13) years. We do not knowingly collect personally identifiable information from children under the age of 13. If you are a parent or guardian and you believe that your child has provided us with Personal Data without your consent, please contact us immediately at hello@trywitti.com. Upon becoming aware of such a situation, we will take prompt steps to delete the relevant information from our systems.

14. Links to Third-Party Websites

The Service may contain hyperlinks to third-party websites, applications, or services that are not owned or operated by CreativePluck Limited. We have no control over, and accept no responsibility for, the content, privacy policies, or practices of any such third-party platforms. We strongly encourage you to review the privacy policy of any third-party site you visit. The inclusion of a link on the Service does not constitute an endorsement by us of the linked platform.

15. Changes to This Privacy Policy

We reserve the right to amend or update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Service features. Where we make material changes, we will notify you by posting the revised Privacy Policy on this page, updating the effective date at the top of the document, and, where appropriate, by sending you a direct notification via email or a prominent in-Service notice prior to the change taking effect.

You are encouraged to periodically review this Privacy Policy to stay informed of how we are protecting your information. Your continued use of the Service after the posting of an updated Privacy Policy constitutes your acceptance of the revised terms.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please do not hesitate to contact our Data Protection team using the details below:

CreativePluck Limited

Operator of the Witti Platform

Email: hello@trywitti.com

Website: https://trywitti.com

We will endeavour to respond to all queries within a reasonable timeframe, and in any event within the period prescribed by applicable data protection legislation.