GDPR data protection notice

1.About this notice

This notice explains how EBITPOINT LTD processes personal data when you visit ebitpoint.com, create or use an ebitpoint account, or contact us. It is written to meet the transparency requirements of the EU General Data Protection Regulation (GDPR) and the UK GDPR, and it also describes the rights you have under Ghana's Data Protection Act, 2012 (Act 843) and the Nigeria Data Protection Act, 2023. It adds detail to our Privacy notice.

ebitpoint's services are intended for customers in Ghana and Nigeria. Where you use ebitpoint from the European Economic Area (EEA) or the United Kingdom, this notice sets out how the GDPR and UK GDPR apply to that processing.

2.Who is responsible for your data

3.How we approach personal data

We aim to process personal data in line with the data protection principles. In practice, that means we:

• Process it lawfully, fairly, and in a way we explain to you.
• Collect it for specific purposes and do not use it in ways that conflict with them.
• Limit it to what we need, and keep it accurate and up to date.
• Keep it only for as long as we need it.
• Protect it with appropriate security, and take responsibility for how we handle it.

4.Personal data we process

We do not ask for special categories of personal data, such as health or religious information. Your ID document and selfie are reviewed by our staff, not by automated facial recognition.

5.Why we use it and our legal bases

Where we rely on legitimate interests, we have balanced those interests against your rights. Where we rely on consent, you can withdraw it at any time; this does not affect processing that already took place. If you do not give us information we need for our contract or legal obligations, we may not be able to open or maintain your account.

6.Who we share it with

We do not sell personal data. Only our staff can access customer records. We share personal data with the service providers below, who process it on our behalf to run ebitpoint:

When our staff send your payout, we give your bank or Mobile Money provider the account number, account name, and amount needed to pay you, and we check payments you make to us against our own bank and Mobile Money records. We may also disclose personal data to professional advisers, to a buyer or successor if our business is reorganised or sold, and to courts, regulators, law enforcement, or other authorities where the law requires it or where it is needed to protect our customers, our rights, or others.

Approved reviews are public. They show your rating, your review, its date, which coin you bought or sold, and your first name and last initial.

7.International transfers

Our main database is hosted in the United States, and several of our providers, including Vercel, Resend, Anthropic, and Google, are based there. Your personal data may therefore be processed outside Ghana, Nigeria, the EEA, and the UK.

Where the law requires safeguards for these transfers, we rely on the data processing terms our providers offer, which include recognised transfer mechanisms such as the European Commission's Standard Contractual Clauses or equivalent protections. Contact us if you would like more information about the safeguards for a particular provider.

8.How long we keep it

We keep personal data only for as long as we need it for the purposes above, including security, record-keeping, handling disputes, and meeting legal obligations. Some records have set periods:

9.Your rights

Depending on the law that applies to you, you have the right to:

• Access your personal data and receive a copy of it.
• Correct inaccurate or incomplete data. You can change your phone number and country in Settings; contact Support to correct your name or other details you cannot change yourself.
• Erase your data. You can ask us to delete your account. We can do this once its balance is zero and nothing is in progress (our Refund policy lists what must be settled first). We keep records the law requires us to keep, and will tell you if we cannot delete something.
• Restrict how we use your data while a concern is being resolved.
• Port data you gave us, in a structured, commonly used format.
• Object to processing based on our legitimate interests, and to direct marketing at any time.
• Withdraw consent at any time, for example by changing your privacy choices or turning off browser notifications.
• Complain to a data protection authority (see section 13).

To exercise a right, email info@ebitpoint.com with the subject line “Data protection”, or contact Support while signed in. We may need to confirm your identity before acting on a request. We aim to respond within one month, and will tell you if we need longer because a request is complex. Making a request is free unless it is clearly unfounded or excessive.

10.Automated processing

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Identity verification decisions and withdrawals are handled by our staff.

Some safeguards run automatically, such as transaction limits, waiting periods for new withdrawal addresses, and rate limits. If one of these stops an action and you think it is wrong, contact Support and a member of our team will review it.

Alma, our chat assistant, uses an AI model to answer questions. It cannot change your account, approve transactions, or issue refunds. You can ask Alma for a person at any time, or reach us by phone, WhatsApp, or email.

11.How we protect it

• Connections to ebitpoint and to our database are encrypted in transit.
• Passwords and recovery codes are stored only as one-way hashes.
• Two-factor authentication and passkeys are available to every customer, and staff must use an authenticator app.
• Verification documents and chat attachments are stored privately and are only available to you and to our staff through access-checked links.
• Sign-in sessions are checked on every request and can be revoked from Settings.
• Only our staff can access customer data; sensitive staff actions need specific permissions and are recorded in audit logs.

No online service can be completely secure. If we become aware of a personal data breach that is likely to put you at risk, we will tell you and the relevant authorities as the law requires.

12.Cookies and similar technologies

We use a small number of cookies that are needed for ebitpoint to work, plus optional advertising measurement that only runs if you allow it. You can change your choice at any time with the Privacy choices button on the ebitpoint homepage.

We also use your browser's local storage for small settings, such as sound effects and whether you have dismissed the chat preview, and, while you are signed in, a random tab identifier used for your account activity record.

13.Complaints

If you have a concern about how we handle your data, please contact us first so we can try to resolve it. You also have the right to complain to a data protection authority, including:

• The Data Protection Commission, Ghana.
• The Nigeria Data Protection Commission.
• The supervisory authority in the EEA country where you live, work, or believe an infringement occurred.
• The Information Commissioner's Office, if you are in the United Kingdom.

14.Updates to this notice

We will update this notice when our processing changes. The current version and its update date are always shown on this page.