- Who we are
- Our role, and the school's role
- What we collect
- Students and children's information
- Why we use it, and our lawful basis
- Who we share it with
- Transfers outside Nigeria
- How long we keep it
- How we protect it
- Your rights
- Cookies and analytics
- Marketing
- Changes to this policy
- Contact and complaints
1. Who we are
Penney is operated by [Operating company name — to be confirmed] (RC [RC number — to be confirmed]), [Registered address — to be confirmed]. For questions about your personal information, contact [Data Protection Officer contact — to be confirmed].
2. Our role, and the school's role
- Your own account. For the information you give us when you sign up and use Penney, we are the data controller.
- Student and school records. When a school uploads student bills and records to Penney, the school decides what information is used and why. For that information the school is generally the data controller and Penney processes it on the school's behalf to bill, collect and reconcile fees. [Controller/processor split to be confirmed by counsel and reflected in school agreements]
- Payment partners. Banks and payment processors that handle your payment are responsible for the information they process under their own privacy policies and legal obligations.
3. What we collect
| Who | Information |
|---|---|
| All users | Name, email address, phone number, password (stored in protected form), transaction PIN (stored in protected form), and account settings. |
| Identity checks | Bank Verification Number (BVN) and the details returned when it is verified, such as your name and date of birth, used to confirm who you are and apply payment limits. |
| Parents and payers | The school and student you pay for, the amounts you pay, payment method, receipts and payment history. |
| Students | Name, admission or registration number, class, school, session and term, fees billed and paid, and outstanding balance — as supplied by the school. |
| Schools and businesses | Business name and contact details, the people who manage the account, settlement bank account details, and collection and settlement records. |
| Payments | Transaction references, amounts, dates, status, and the bank or account a payment came from or went to. We do not store full card numbers; card details are handled by our card-processing partner. |
| Technical and security | IP address, device and browser information, login times and activity logs, used to keep accounts secure and investigate problems. |
4. Students and children's information
Many students are under 18. Penney does not ask students to open accounts. Student information on Penney is supplied by the school or by a parent or guardian paying a bill, and is used only to bill, collect, receipt and reconcile fees. We do not use student information for marketing or profiling. Schools should only upload what is needed for fee collection and must have a lawful basis for doing so.
5. Why we use it, and our lawful basis
| Purpose | Lawful basis (NDPA s.25) |
|---|---|
| Creating and running your account; processing payments, receipts and settlements | Performance of a contract with you |
| Verifying identity (BVN), applying limits, preventing fraud and meeting anti-money-laundering, tax and record-keeping requirements | Legal obligation; legitimate interests in keeping the platform safe |
| Billing students and recording school fee payments for schools | Performance of the contract with the school, on the school's instructions |
| Customer support, complaints and disputes | Performance of a contract; legal obligation |
| Keeping the service secure and working, and improving it | Legitimate interests |
| Sending marketing messages | Your consent, which you can withdraw at any time |
6. Who we share it with
We do not sell your personal information. We share it only where needed:
- Banking and payment partners that process card payments, bank transfers, dedicated account numbers and settlements.
- Identity-verification providers that check BVN details.
- Schools — when you pay a school fee, the school sees the payment, the payer's name and the receipt.
- Bill providers (electricity, telecoms, cable TV) — the details needed to deliver what you paid for, such as a meter or smartcard number.
- Service providers that host our systems, send SMS and email, and help us run the platform, under contracts that require them to protect your information.
- Regulators, law enforcement and courts where the law requires it.
7. Transfers outside Nigeria
Some of our service providers may store or process information outside Nigeria. Where that happens, we transfer it only in line with Part VIII of the NDPA — for example to a country with adequate data protection or under appropriate safeguards. [Hosting locations and transfer safeguards to be confirmed]
8. How long we keep it
We keep personal information only as long as we need it for the purposes above. Transaction and identity records are kept for as long as financial, anti-money-laundering and tax laws require, even after an account is closed. When we no longer need information, we delete or anonymise it. [Retention periods to be confirmed]
9. How we protect it
We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse and alteration — including encrypted connections, access controls, protected storage of passwords and PINs, and limiting staff access to what their role needs. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a personal data breach is likely to put your rights at risk, we will notify the Nigeria Data Protection Commission and, where required, you, as the NDPA requires.
10. Your rights
Under the NDPA you have the right to:
- be told how your information is used, and get a copy of it;
- have inaccurate information corrected;
- have information deleted where there is no longer a good reason to keep it;
- restrict or object to some processing, including processing based on our legitimate interests;
- receive your information in a commonly used format and have it sent to another organisation;
- withdraw consent at any time, where we rely on consent;
- not be subject to decisions based solely on automated processing that significantly affect you;
- complain to the Nigeria Data Protection Commission.
To use any of these rights, contact us (details below). For student records held for a school, we may pass your request to the school, which decides how it is handled. Some rights are limited where we must keep records by law.
11. Cookies and analytics
We use cookies that are needed to sign you in, keep your session secure and remember your choices. We also use analytics tools to understand how the website is used so we can improve it. You can block or delete cookies in your browser settings; if you block the cookies that keep you signed in, parts of Penney will not work.
12. Marketing
We will only send you marketing messages if you have agreed to receive them, and you can opt out at any time using the link in the message or by contacting us. Service messages about your account and payments are not marketing and will still be sent.
13. Changes to this policy
We may update this policy. The date at the top shows the latest version, and we will tell you about significant changes.
14. Contact and complaints
Contact us about privacy at [email protected] . If you are not satisfied with our response, you can complain to the Nigeria Data Protection Commission.