Privacy Policy

1. Who We Are

Reelaay Technologies Limited is a technology and transaction management company incorporated in the Federal Republic of Nigeria. We operate a B2B commerce platform that facilitates structured commercial transactions between Suppliers and Buyers, with capital coordination from Funding Partners.

For the purposes of the NDPA and NDPR, Reelaay is the Data Controller in respect of personal data processed on the Platform. Where we engage third-party service providers to process data on our behalf, those providers act as Data Processors under our instruction and subject to appropriate data processing agreements.

2. Information We Collect

We collect different categories of information depending on your role and your interactions with the Platform.

2.1 Personal Information

• Full legal name of individual users, directors, and beneficial owners.
• Date of birth and nationality.
• Government-issued identification documents (e.g. National ID, International Passport, Driver's Licence, BVN).
• Residential or correspondence address.
• Email address and phone number.
• Photograph or biometric data where required for identity verification.

2.2 Business Information

• Legal business name and trading name.
• Corporate registration number and date of incorporation.
• Registered office address and principal place of business.
• Details of directors, shareholders, and beneficial owners.
• Copies of incorporation documents, memoranda of association, and board resolutions.
• Tax identification number (TIN) and VAT registration details.
• Business sector, nature of operations, and annual turnover.

2.3 Financial Information

• Bank account details (account name, account number, bank name, and sort code).
• Bank statements submitted for creditworthiness or KYC assessment.
• Transaction values, payment history, and outstanding obligations.
• Financing eligibility data and repayment records.

2.4 KYC & Identity Verification Information

• Copies of identity documents submitted for KYC purposes.
• Beneficial ownership declarations and politically exposed person (PEP) screening results.
• Sanctions screening and watchlist check results.
• Credit bureau data and third-party verification outcomes.
• AML and CFT risk assessments.

2.5 Transaction Information

• Purchase order details, including goods or services description, quantities, and values.
• Invoice and delivery documentation submitted to the Platform.
• Counterparty information (Buyer or Supplier) associated with each Transaction.
• Transaction status, milestone records, and delivery confirmations.
• Correspondence and communications related to a Transaction.

2.6 Device & Technical Information

• IP address and approximate geographic location.
• Browser type, version, and operating system.
• Device identifiers and screen resolution.
• Pages visited, features accessed, and time spent on the Platform.
• Referring URLs and exit pages.
• Log files and error reports.

2.7 Communications Data

• Content of messages sent through the Platform's communication features.
• Email communications with Reelaay's team.
• Records of support enquiries, feedback, and complaints.
• Marketing preference records.

3. How We Collect Information

We collect information through the following methods:

3.1 Directly from You

• Account registration and onboarding forms.
• KYC document submission.
• Transaction initiation and management activity on the Platform.
• Communications with Reelaay by email, phone, or Platform messaging.
• Responses to surveys, questionnaires, or research requests.

3.2 Automatically

• Cookies and similar tracking technologies (see Section 7).
• Server logs recording your interaction with the Platform.
• Analytics tools that monitor Platform usage patterns.

3.3 From Third Parties

• Identity verification and KYC service providers.
• Credit bureaus and financial data providers.
• Sanctions screening and PEP databases.
• Funding Partners who share User information in connection with a Transaction.
• Publicly available sources such as corporate registries, government databases, and court records.

4. Legal Basis for Processing

Where required by the NDPA and NDPR, Reelaay processes personal data only where a lawful basis exists. The table below sets out the primary legal bases we rely on:

5. How We Use Your Information

We use the information we collect for the following purposes:

5.1 Platform Operations

• To create and manage your Account.
• To process, structure, and manage Transactions.
• To coordinate payments and disbursements.
• To provide customer support and respond to enquiries.

5.2 Verification & Compliance

• To verify your identity and business credentials as part of our KYC process.
• To screen you and your business against sanctions lists, PEP databases, and adverse media.
• To comply with AML/CFT obligations, including filing suspicious activity reports where required by law.
• To verify the authenticity of documents submitted to the Platform.

5.3 Risk Management & Fraud Prevention

• To assess the risk profile of Transactions and Users.
• To detect, investigate, and prevent fraudulent or suspicious activity.
• To enforce our Terms of Service and Acceptable Use Policy.

5.4 Capital Facilitation

• To share relevant User and Transaction data with Funding Partners to enable financing decisions.
• To assess financing eligibility on behalf of Funding Partners.

5.5 Platform Improvement

• To analyse Platform usage and identify areas for improvement.
• To develop new features and services.
• To conduct internal research and analytics.

5.6 Communications

• To send transactional notifications, account updates, and compliance requests.
• To send marketing communications where you have provided consent (see Section 8).

5.7 Legal & Regulatory Obligations

• To comply with applicable laws, court orders, and regulatory directives.
• To respond to lawful requests from Nigerian regulatory authorities, including the Central Bank of Nigeria, the Securities and Exchange Commission, the Financial Intelligence Unit, and the Nigeria Data Protection Commission.
• To establish, exercise, or defend legal claims.

6. Data Sharing

We do not sell your personal information. We share your information only in the circumstances described below, and only to the extent necessary for the stated purpose.

6.1 Counterparties to a Transaction

Relevant Transaction information will be shared with the counterparty to a Transaction (e.g. a Buyer will see Supplier delivery information and vice versa) to the extent necessary to execute the Transaction.

6.2 Funding Partners

Where a Transaction involves capital from a Funding Partner, we share the information necessary for the Funding Partner to conduct its own due diligence and financing decision. This may include KYC documentation, Transaction details, and financial information. Funding Partners are contractually required to protect your data in accordance with applicable law.

6.3 Third-Party Service Providers

We engage reputable third-party providers to support our operations, including:

• Identity verification providers — for KYC and document verification.
• Cloud infrastructure providers — for hosting and data storage.
• Payment processors — for payment coordination and collection account management.
• Credit bureaus and data providers — for creditworthiness and risk assessments.
• Analytics and monitoring tools — for Platform performance and fraud detection.
• Communication platforms — for email, SMS, and in-app notifications.

All third-party providers are selected with care, are subject to contractual data protection obligations, and are prohibited from using your data for their own independent purposes.

6.4 Regulatory Authorities & Law Enforcement

We may disclose your information to Nigerian regulatory authorities (including the Central Bank of Nigeria, the Securities and Exchange Commission, the Nigeria Data Protection Commission, and the Financial Intelligence Unit), law enforcement agencies, or courts where required or permitted by law, including in connection with:

• AML/CFT reporting obligations.
• Tax and revenue authority requests.
• Court orders, subpoenas, or other legal process.
• Regulatory investigations or examinations.

6.5 Corporate Transactions

In the event of a merger, acquisition, restructuring, or sale of all or part of Reelaay's business, your information may be transferred to the acquiring or successor entity, subject to equivalent privacy protections.

6.6 With Your Consent

We may share your information with other third parties where you have provided your explicit consent to such sharing.

7. Cookies & Tracking Technologies

7.1 What Are Cookies?

Cookies are small text files placed on your device when you visit the Platform. We also use similar technologies such as pixel tags, local storage, and session tokens.

7.2 Types of Cookies We Use

7.3 Managing Cookies

You can control and manage cookies through your browser settings. Please note that disabling essential cookies will impair your ability to use the Platform. For analytics and functional cookies, you can opt out at any time. Details of how to manage cookies are available in your browser's help section.

7.4 Third-Party Analytics

We may use third-party analytics providers to help us understand Platform usage. These providers may set their own cookies. Where we do so, we ensure appropriate data processing agreements are in place and that data is processed in accordance with applicable law.

8. Marketing Communications

1. We will only send you marketing communications (such as product updates, newsletters, and promotional content) where you have provided your consent or where permitted under applicable law.
2. You can withdraw your consent at any time by: (a) clicking the "unsubscribe" link in any marketing email; or (b) contacting us at hello@reelaay.com.
3. Withdrawal of marketing consent does not affect the lawfulness of processing carried out before withdrawal, and does not affect your receipt of transactional or compliance-related communications.
4. We will not share your contact details with third parties for their own marketing purposes.

9. Data Retention

We retain personal and business data for as long as necessary to fulfil the purposes for which it was collected, including compliance with legal and regulatory obligations. The following minimum retention periods apply:

At the end of the applicable retention period, data is securely deleted or anonymised in accordance with Reelaay's data lifecycle management procedures. Where legal obligations require longer retention, data is retained for the legally mandated period.

10. International Data Transfers

1. Reelaay is incorporated in Nigeria and primarily processes data within Nigeria. However, some of our third-party service providers (such as cloud infrastructure providers and analytics tools) may process data outside Nigeria.
2. Where data is transferred internationally, we ensure that appropriate safeguards are in place, including: (a) transfers to countries with adequate data protection laws; (b) standard contractual clauses approved by the Nigeria Data Protection Commission; or (c) other appropriate mechanisms permitted under the NDPA.
3. As Reelaay expands into additional African markets, this Policy will be updated to reflect any additional cross-border transfer mechanisms required to comply with the data protection laws of those jurisdictions.
4. You may request details of the safeguards applicable to any international transfer by contacting us at hello@reelaay.com.

11. Data Security

1. Technical safeguards. Reelaay implements industry-standard technical security measures, including encryption of data in transit (TLS/HTTPS), encryption of sensitive data at rest, role-based access controls, multi-factor authentication, and intrusion detection systems.
2. Organisational safeguards. We maintain internal data security policies, conduct staff training on data protection, and restrict access to personal data to employees and contractors who need it to perform their duties.
3. Third-party security. We conduct due diligence on third-party providers and require them to maintain security standards consistent with applicable law and industry practice.
4. Incident response. Reelaay maintains a data breach response procedure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission and, where required, notify affected Users within the timeframes prescribed by the NDPA.
5. Limitation. No security system is impenetrable. Reelaay cannot guarantee the absolute security of your data, and transmission of data over the internet carries inherent risks. You are responsible for the security of your own device and Account credentials.

12. Your Rights

Under the Nigeria Data Protection Act 2023 and the NDPR, you have the following rights in respect of your personal data:

How to Exercise Your Rights

To exercise any of the rights above, please submit a written request to hello@reelaay.com. We will respond within thirty (30) days of receiving a valid request. We may ask you to verify your identity before processing the request.

Please note that some rights are subject to limitations. For example, we may be unable to delete data that we are legally required to retain under AML, tax, or other applicable laws.

13. Children's Privacy

The Reelaay Platform is designed for use by businesses and adult individuals engaged in B2B commercial activity. The Platform is not directed at, and we do not knowingly collect personal data from, individuals under the age of 18. If you believe that we have inadvertently collected data from a minor, please contact us immediately at hello@reelaay.com and we will take appropriate action, including deletion of such data.

14. Third-Party Links

The Platform may contain links to third-party websites, resources, or services. This Privacy Policy does not apply to those third-party sites. We encourage you to review the privacy policies of any third-party sites you visit. Reelaay is not responsible for the privacy practices or content of third-party services.

15. Changes to This Policy

1. We may update this Privacy Policy from time to time to reflect changes in our data processing practices, regulatory requirements, or Platform features.
2. Where changes are material, we will provide at least fourteen (14) days' advance notice by email or by prominent notice on the Platform.
3. Your continued use of the Platform after the effective date of an updated Policy constitutes your acceptance of the changes.
4. The most current version of this Policy is always available at reelaay.com/privacy.

16. Contact Information

For questions about this Privacy Policy, to exercise your data rights, or to report a privacy concern, please contact us at:

You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your personal data has been processed in violation of applicable law.