Cardtonic's Privacy Policy
Effective Date: September 2025
This Privacy Policy explains how The Tonic Technologies Limited ("Cardtonic", "we", "our", "us") collects, uses, stores, and protects your personal information when you use our website, mobile app, and related services (the "Platform").
By using Cardtonic, you consent to the practices described in this Policy.
1. Information We Collect
We may collect the following categories of personal information:a. Information you provide directly:• Full name, date of birth, contact details.• Government-issued ID and proof of address (for KYC).• Payment/bank account details.b. Information collected automatically:• Device information (IP address, browser type, OS).• Usage data (pages visited, time spent, transaction activity).c. Information from third parties:• Verification service providers, regulators, fraud prevention agencies.
2. How We Use Your Information
We process your personal data for the following purposes:• To create and manage your Cardtonic account.• To verify your identity and comply with AML/CFT laws.• To process transactions and provide services.• To detect and prevent fraud and misuse of the Platform.• To communicate with you (e.g., service updates, support).• To comply with legal and regulatory obligations in Nigeria and Ghana.
3. Legal Basis for Processing
We rely on one or more of the following legal grounds:• Consent – when you agree to the processing of your data.• Contractual necessity – to provide our services.• Legal obligation – to comply with AML/CFT and data protection laws.• Legitimate interest – to improve our services and ensure platform security.
5. International Data Transfers
Where your data is transferred outside Nigeria or Ghana, we ensure adequate protection through:• Countries with adequate data protection laws; or• Standard contractual safeguards with our service providers.
6. Data Retention
We retain personal data only as long as necessary for:• Providing services and managing your account.• Compliance with legal and regulatory obligations (e.g., AML recordkeeping requirements – typically 5–7 years).• Resolving disputes and enforcing our Terms.
7. Data Security
We apply appropriate technical and organisational measures to protect your data, including:• Encryption of sensitive information.• Access controls and monitoring.• Regular audits and vulnerability testing.
8. Your Rights
Depending on whether you are in Nigeria or Ghana, you have rights under applicable law to:• Access the personal data we hold about you.• Request correction or deletion of inaccurate data.• Withdraw consent (where processing is based on consent).• Restrict or object to certain processing.• Lodge a complaint with the Nigeria Data Protection Commission (NDPC) or the Ghana Data Protection Commission (DPC).Requests can be sent to: legal@cardtonic.com.
10. Children's Privacy
Our services are not directed to individuals under 18. We do not knowingly collect personal data from children.
11. Updates to this Policy
We may update this Privacy Policy from time to time. Updates will be posted on our website/app, and continued use of the Platform constitutes acceptance of the revised Policy.
12. Regulatory Registration
Nigeria: Cardtonic is duly registered with the Nigeria Data Protection Commission (NDPC) as a Data Controller of Major Importance, in compliance with the Nigeria Data Protection Act, 2023.Ghana: Cardtonic complies with the Data Protection Act, 2012 (Act 843) and will maintain registration with the Ghana Data Protection Commission (DPC) as required.
13. Contact Us
If you have questions or concerns about this Policy:Nigeria: legal@cardtonic.com