GDPR data protection notice

1.About this notice

This notice explains how EBITPOINT LTD processes personal data when you visit ebitpoint.com, create or use an ebitpoint account, or contact us. It is written to meet the transparency requirements of the EU General Data Protection Regulation (GDPR) and the UK GDPR, and it also describes the rights you have under Ghana's Data Protection Act, 2012 (Act 843) and the Nigeria Data Protection Act, 2023. It adds detail to our Privacy notice.

ebitpoint's services are intended for customers in Ghana and Nigeria. Where you use ebitpoint from the European Economic Area (EEA) or the United Kingdom, this notice sets out how the GDPR and UK GDPR apply to that processing.

2.Who is responsible for your data

3.How we approach personal data

We aim to process personal data in line with the data protection principles. In practice, that means we:

• Process it lawfully, fairly, and in a way we explain to you.
• Collect it for specific purposes and do not use it in ways that conflict with them.
• Limit it to what we need, and keep it accurate and up to date.
• Keep it only for as long as we need it.
• Protect it with appropriate security, and take responsibility for how we handle it.

4.Personal data we process

Identity verification compares measurements of your face, which some laws treat as biometric or other special category personal data. We use them to verify your identity, to prevent fraud and money laundering, and to stop one person opening several accounts. We do not ask for other special categories of personal data, such as health or religious information. The Automated processing section explains how these checks work.

5.Why we use it and our legal bases

Where we rely on legitimate interests, we have balanced those interests against your rights. Where we rely on consent, you can withdraw it at any time; this does not affect processing that already took place. If you do not give us information we need for our contract or legal obligations, we may not be able to open or maintain your account.

6.Who we share it with

We do not sell personal data. Only authorised people at ebitpoint can access customer records. We share personal data with the service providers below, who process it on our behalf to run ebitpoint:

When we send your payout, we give your bank or Mobile Money provider the account number, account name, and amount needed to pay you, and we check payments you make to us against our own bank and Mobile Money records. We may also disclose personal data to professional advisers, to a buyer or successor if our business is reorganised or sold, and to courts, regulators, law enforcement, or other authorities where the law requires it or where it is needed to protect our customers, our rights, or others.

Approved reviews are public. They show your rating, your review, its date, which coin you bought or sold, and your first name and last initial.

7.International transfers

Our main database is hosted in the United States, and several of our providers, including Vercel, Resend, Amazon Web Services, Anthropic, and Google, are based there. Your personal data may therefore be processed outside Ghana, Nigeria, the EEA, and the UK.

Where the law requires safeguards for these transfers, we rely on the data processing terms our providers offer, which include recognised transfer mechanisms such as the European Commission's Standard Contractual Clauses or equivalent protections. Contact us if you would like more information about the safeguards for a particular provider.

8.How long we keep it

We keep personal data only for as long as we need it for the purposes above, including security, record-keeping, handling disputes, and meeting legal obligations. Some records have set periods:

9.Your rights

Depending on the law that applies to you, you have the right to:

• Access your personal data and receive a copy of it.
• Correct inaccurate or incomplete data. You can change your phone number and country in Settings; contact Support to correct your name or other details you cannot change yourself.
• Erase your data. You can delete your account yourself in Settings, under Security, or ask Support to help. The request waits 30 days, and you can cancel it at any point in that time. It can be made once your balance is zero and nothing is in progress (our Refund policy lists what must be settled first). Deleting your account removes your name, contact and sign-in details, support history, notifications, and reviews. We keep your identity verification records and documents, your orders, deposits, withdrawals, and swaps with the payout accounts and wallet addresses they used, and our financial and compliance records, to meet anti-money-laundering record-keeping and other legal obligations. These stay linked only to an anonymous account record.
• Restrict how we use your data while a concern is being resolved.
• Port data you gave us, in a structured, commonly used format. You can download a copy of your data in Settings, under Security.
• Object to processing based on our legitimate interests, and to direct marketing at any time.
• Withdraw consent at any time, for example by changing your privacy choices or turning off browser notifications.
• Complain to a data protection authority (see section 13).

To exercise a right, email info@ebitpoint.com with the subject line “Data protection”, or contact Support while signed in. We may need to confirm your identity before acting on a request. We aim to respond within one month, and will tell you if we need longer because a request is complex. Making a request is free unless it is clearly unfounded or excessive.

10.Automated processing

When you submit your identity documents, the text on your ID is read automatically and compared with the name on your account, and your selfie is checked for a face. Where the live camera check is offered, the camera frames are compared with your selfie and ID photo. Measurements of your face, and your document, are also compared with those submitted for other accounts, to stop one person opening several accounts or using someone else's identity. Face measurements are calculated on ebitpoint's own systems.

Where automatic review is switched on, a submission that passes every check can be approved without waiting for a person, and a submission showing strong signs of a reused identity or a faked camera image can be declined automatically. Other submissions go to a person at ebitpoint. These decisions affect whether you can use ebitpoint, so if your submission is declined you can submit again, or contact Support and ask for a person to review it. You can also tell us why you disagree with the decision.

Withdrawals that need a review are reviewed by a person at ebitpoint.

Some safeguards run automatically, such as transaction limits, waiting periods for new withdrawal addresses, and rate limits. If one of these stops an action and you think it is wrong, contact Support and we will review it.

Alma, our chat assistant, uses an AI model to answer questions. It cannot change your account, approve transactions, or issue refunds. You can ask Alma for a person at any time, or reach us by phone, WhatsApp, or email.

11.How we protect it

• Connections to ebitpoint and to our database are encrypted in transit.
• Passwords and recovery codes are stored only as one-way hashes.
• Two-factor authentication and passkeys are available to every customer, and people with access to customer records use extra sign-in protection.
• Verification documents and chat attachments are stored privately and are only available to you and to authorised people at ebitpoint through access-checked links.
• Sign-in sessions are checked on every request and can be revoked from Settings.
• Access to customer data is limited to authorised people at ebitpoint, and access is recorded.

No online service can be completely secure. If we become aware of a personal data breach that is likely to put you at risk, we will tell you and the relevant authorities as the law requires.

12.Cookies and similar technologies

We use a small number of cookies that are needed for ebitpoint to work, plus optional analytics and advertising cookies that only run if you turn them on. You can change either choice at any time from Privacy choices in the footer of any page.

We also use your browser's local storage for small settings, such as sound effects and whether you have dismissed the chat preview, and, while you are signed in, a random tab identifier used for your account activity record.

13.Complaints

If you have a concern about how we handle your data, please contact us first so we can try to resolve it. You also have the right to complain to a data protection authority, including:

• The Data Protection Commission, Ghana.
• The Nigeria Data Protection Commission.
• The supervisory authority in the EEA country where you live, work, or believe an infringement occurred.
• The Information Commissioner's Office, if you are in the United Kingdom.

14.Updates to this notice

We will update this notice when our processing changes. The current version and its update date are always shown on this page.