Privacy policy

1. Who we are

Xpanda Technologies is operated by Xpanda Technolgies Ltd, RC No. 9761187 ("Xpanda", "we", "us" or "our"). This policy explains how we handle personal information when you visit xpanda.tech, create or use an account, request a quotation, order a project, make a payment, receive support, or otherwise interact with our websites, applications and services.

2. Scope

This policy applies to Xpanda's public website, customer and administrator portals, project-delivery services, communications and related business operations. A separately branded customer project may have its own privacy notice. Where we process information only on a customer's documented instructions for such a project, that customer may be the data controller and its privacy notice will also apply.

3. Information we collect

Depending on how you use our services, we may collect:

• identity and contact information, including your name, email address and telephone number;
• account information, login records, authentication events and communication preferences;
• business details, project requirements, branding materials, content, approvals and technical instructions;
• orders, proposals, contracts, invoices, receipts, transaction references and payment status;
• support tickets, project messages, feedback, call records where notified, and correspondence;
• device, browser, IP address, session, security, audit and diagnostic information; and
• other information you voluntarily provide or authorise a third party to provide to us.

We do not ask you to publish passwords, private API keys, card PINs or other sensitive credentials in ordinary project messages. Credentials required for an approved integration should be supplied only through the secure method we specify.

4. How information is collected

We collect information directly from you, automatically through your use of our services, from authorised representatives, and from payment, hosting, identity, communications or other service providers involved in your requested project. We may also receive lawful business information from publicly available sources.

5. Why we use information

We process information where necessary to:

• create and secure accounts, authenticate users and prevent unauthorised access;
• prepare quotations, confirm scope, deliver projects and administer the customer relationship;
• process and reconcile payments, maintain financial records and address billing enquiries;
• provide customer support, communicate project updates and respond to requests;
• configure, maintain, diagnose, secure and improve our websites, software and infrastructure;
• detect fraud, abuse, security incidents and breaches of our terms;
• comply with legal, tax, accounting, regulatory and dispute-resolution obligations; and
• send service communications and, where permitted or consented to, relevant marketing communications.

6. Lawful grounds

Depending on the circumstances, we rely on performance of a contract or steps requested before entering a contract, compliance with legal obligations, your consent, protection of vital interests, and our legitimate interests in operating, securing and improving our business. Where we rely on consent, you may withdraw it at any time without affecting prior lawful processing.

7. Project information and confidentiality

Non-public project requirements, credentials, business records and customer materials are treated as confidential and used only for delivery, support, security and lawful administration. We may use anonymised or aggregated operational information that does not identify you. We will not publicly display a private project as portfolio work without an appropriate basis, such as your approval or the project already being publicly launched.

8. Sharing and service providers

We may share only the information reasonably required with authorised staff, contractors and providers supporting hosting, domains, email, analytics, security, payment processing, VTU integrations, customer support and professional advice. We may also disclose information when required by law, to protect users or our systems, in connection with a corporate reorganisation, or with your direction or consent. Providers are expected to process information for authorised purposes and apply appropriate safeguards.

9. We do not sell personal information

Xpanda does not sell, rent or trade personal information. We do not give customer information to unrelated third parties for their independent marketing. Information shared with an approved integration or service provider is limited to what is reasonably needed to provide, secure or administer the requested service.

10. Cookies and similar technology

We use essential cookies and local storage to maintain sessions, remember settings, protect accounts and operate the portal. We may use limited analytics to understand performance and improve usability. You can control non-essential cookies through available settings or your browser, although blocking essential storage may prevent parts of the service from working.

11. International processing

Some infrastructure or service providers may process information outside Nigeria. Where this occurs, we take reasonable steps to use lawful transfer mechanisms and contractual, technical or organisational safeguards appropriate to the information and destination.

12. Retention

We retain information only for as long as reasonably necessary for the purpose collected, including active service delivery, warranties, support, security, fraud prevention, backups, accounting, tax, legal claims and regulatory obligations. Retention periods vary by record type. When information is no longer required, we securely delete, anonymise or isolate it unless a lawful reason requires continued retention.

13. Security

We use reasonable administrative, technical and organisational safeguards, including access controls, authentication, encryption in transit where supported, audit logging, backups and restricted production access. No internet service or storage system can guarantee absolute security. You must protect your credentials and promptly notify us of suspected compromise.

14. Your data-protection rights

Subject to the Nigeria Data Protection Act 2023 and applicable limitations, you may request confirmation and access to personal information, correction, deletion, restriction or objection, data portability where applicable, and information about relevant automated decision-making. You may also withdraw consent and lodge a complaint with the Nigeria Data Protection Commission. We may verify your identity and retain information where a legal obligation or valid exemption applies.

15. Children

Our business and project-ordering services are not directed to children. A person who cannot legally enter a binding contract must use the services only through a parent, guardian or duly authorised representative. If we learn that information was collected from a child without a lawful basis or required authorisation, we will take appropriate steps to remove it.

16. Privacy requests and complaints

Send privacy requests to support@xpanda.tech or call 09131158307. Please describe your request clearly. We will respond within the period required by applicable law and may request information needed to confirm your identity or authority. You may also complain to the Nigeria Data Protection Commission if you believe your rights have not been properly addressed.

17. Changes to this policy

We may revise this policy to reflect legal, technical or operational changes. The version shown on this page is the version that applies when you use the service. Where a change materially affects your rights, we will provide an appropriate notice through the website, portal or email.