Privacy Policy

Passionate Gammerz Platform

Effective August 8, 2026. This Privacy Policy explains what personal data Passionate Gammerz ("the Platform", "we", "us", "our") collects, why we collect it, the lawful bases we rely on, how we protect it, and the rights you have under the Nigeria Data Protection Act 2023 (NDPA 2023) and other applicable law. It forms part of, and must be read together with, our Terms and Conditions.

Who we are (Data Controller). For the purposes of data protection law, the data controller is Passionate Gammerz International (BN 9741105), a business name registered under Part B of the Companies and Allied Matters Act 2020, with its principal place of business at 930251 Jingi, Abattoir, Jos South LGA, Plateau State, Nigeria. Questions, requests, and complaints can be sent to our Data Protection Officer at privacy@passionategammerz.com or through the Contact and Support section below.

1. What We Collect

We collect the following categories of personal data:

2. Why We Collect It and Our Lawful Bases

Under the NDPA 2023, every processing activity must have a lawful basis. We rely on the following:

• Operating your account, bookings, payments, wallet, and referrals, using account, booking, payment, and technical data, under Contract (Art. 25(1)(a)), necessary to provide the Services you requested.
• Verifying identity and eligibility, including age and parental consent, using verification and parental-consent records, under Legal obligation (Art. 25(1)(c)) and contract.
• Processing payments and payouts via Paystack, using payment and bank details, under Contract.
• Fraud prevention and Platform security, including IP/device screening at signup and wallet freezes, using technical, account, and booking data, under Legitimate interests (Art. 25(1)(f)), protecting the Platform and its users from fraud and abuse.
• Moderating content and investigating reports and disputes, using content, chat, reviews, and dispute records, under Legitimate interests and legal obligations.
• Communicating with you about your activity, security alerts, and service notices, using account and contact data, under Contract and legal obligations.
• Marketing and promotional messages about the Platform, using account, contact, and usage data, under Consent (Art. 25(1)(b)), you may opt out at any time.
• Complying with tax, accounting, anti-money-laundering, and regulatory obligations, using payment, ledger, and verification data, under Legal obligation.
• Where required for a legal claim, defence, or court/regulator proceeding, using relevant records, under Legal obligation and legitimate interests.
• Safeguarding minors and investigating content involving minors, using content and account data, under Vital interests (Art. 25(1)(d)) and legal obligations.

3. Payments and Financial Data

3.1 Card and bank payments are processed by Paystack, our licensed payment processor. We never see or store your full card number, CVV, or PIN.

3.2 Gaming Center bank account details are stored solely to send payouts and are protected by: email OTP verification for changes, Paystack's Account Name Resolver checks, and a 48-hour security lock after any change, see the Payout Policy.

3.3 Wallet balances are bookkeeping entries only, see the Terms and Conditions and the Game-Time Credit and Wallet section. They are not deposits, do not earn interest, and are not insured.

3.4 We may collect and process data required to comply with anti-money-laundering and counter-terrorism-financing obligations, including verifying identity and reporting suspicious activity to the appropriate authorities where the law requires or permits.

4. Who Can See What

4.1 Publicly visible: your public profile, username, posts, reviews, follow lists, leaderboard rankings, and tournament results are visible to other users. Think carefully before posting personal data in public areas.

4.2 Private: your wallet balance, private chat messages, payment history, contact details, and support records are visible only to you and to authorized Platform admins with a legitimate reason to look (a support ticket, a dispute, a fraud check, a legal request, or a moderation report). Admin access is role-based, logged, and audited.

4.3 Gaming Centers see the information needed to serve you: your name, username, and booking details for your session, and (at check-in) your QR code.

4.4 We do not sell personal data. We do not rent, sell, or trade your personal data to third parties for their own marketing purposes.

5. Cookies and Device Technologies

5.1 We use cookies and similar technologies for three purposes:

• Essential: session authentication, security, and fraud prevention (cannot be disabled without impairing the service);
• Functional: preferences and language;
• Analytics: aggregated, anonymized understanding of how the Platform is used, to improve it.

6. Who We Share Data With

We share personal data only as necessary to operate the Platform and as the law allows or requires:

• Paystack: payment details and payout bank details, for payment processing and payouts (their DPA and terms apply).
• Vercel / hosting and CDN provider: technical data and logs, for hosting the Platform.
• Supabase / database provider: account, booking, and content records, for database infrastructure (primary region: Western Europe, London, AWS eu-west-2; encryption at rest and in transit).
• Gaming Centers: name, username, booking details, and QR code, for fulfilling your Booking.
• Legal, accounting, and audit advisers: relevant records, for professional advice and compliance, under confidentiality obligations.
• Law enforcement and regulators: relevant records, where required or permitted by law (including the NDPC, EFCC, NFIU, CBN, courts).
• Successors in business: all relevant records, in a merger, acquisition, or sale of assets, subject to this policy.

7. International Transfers

7.1 Some of our service providers process data outside Nigeria. For transparency, we disclose the current locations:

• Primary database (Supabase): Western Europe, London, AWS region eu-west-2. Backups and replicas are maintained in the same region.
• Hosting and content delivery (Vercel): Vercel is a United States company; pages and static assets may be served from edge locations around the world, including the United States and Europe.
• Payments (Paystack): payment processing infrastructure operated by Paystack (Nigeria) and its service providers, in line with Paystack's own privacy and security commitments.

8. Data Security

8.1 Server-side financial writes. Financial writes (payments, wallets, payouts) always happen on our servers, never directly from your browser. Payment verification is server-side; the browser is never trusted alone.

8.2 Row-level security. Every table in our database is protected by row-level security so one account cannot read another account's private data.

8.3 Admin accountability. Every admin action touching money, verification, or moderation is logged with the admin's identity, timestamp, and IP address. Access is granted on a least-privilege basis and reviewed periodically.

8.4 Encryption and access. Data is protected with encryption in transit and at rest, and access controls follow least-privilege principles. We apply reasonable technical and organizational measures proportionate to the risks, in line with the NDPA 2023 and NDPC guidance.

8.5 No absolute guarantee. No method of transmission or storage is completely secure. We cannot guarantee absolute security, and we ask that you protect your login credentials and report suspected unauthorized access immediately.

9. Data Retention

We keep personal data only as long as needed for the purposes in the lawful bases section above, then delete or anonymize it. Our retention schedule:

• Financial records (bookings, payments, ledger entries, payouts, invoices): at least 6 years from the end of the relevant accounting period (Companies Income Tax Act); ledger entries are never deleted or edited, only corrected with offsetting entries.
• Verification records (identity, business, bank details): while the account is active, plus 6 years after closure.
• Account data: while the account is active; deletion is honoured per the [Your Rights](#your-choices) section below.
• Chat messages: 6 months after the conversation ends, unless subject to a pending report, dispute, or legal hold.
• Posts, comments, reviews: until removed by you or by moderation, plus 30 days in backup.
• Technical/log data: 12 months.
• Moderation and audit logs (admin actions): 6 years.
• Parental-consent records: while the user is under 18, plus 3 years.
• Legal holds: until the hold is lifted by our legal team.

10. Your Rights (Data Subject Rights)

Under the NDPA 2023 (§§28-34) and the NDPR 2019, you have the following rights, which we will honour within 30 days of a verifiable request (we may ask you to confirm your identity):

• Right of access, to know whether we process your data and to receive a copy.
• Right to rectification, to correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"), to request deletion of your data, subject to legal retention obligations in the [Data Retention](#data-retention) section above.
• Right to restriction, to restrict processing in certain circumstances.
• Right to object, to object to processing based on legitimate interests, including direct marketing (an objection to marketing is honoured immediately).
• Right to data portability, to receive data you provided in a structured, machine-readable format.
• Right not to be subject to automated decisions producing legal effects without human involvement, and the right to human review, see the [Automated Decision-Making](#automated-decisions) section below.
• Right to complain, to complain to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng, or to seek judicial remedy, without prejudice to contacting us first.

11. Children and Minors

11.1 The Platform is intended for users aged 16 and older. Under the NDPA 2023, a child is anyone under 18, so we apply these rules:

• Under 16: not permitted to use the Platform. If we discover a user under 16, we will delete the account and associated data without undue delay.
• Aged 16-17: permitted only with the verifiable consent of a parent or legal guardian, which must be given at registration. The guardian's name, contact details, and consent record are stored solely for compliance and may be used to verify consent.
• 18 and over: full account.

12. Automated Decision-Making and Fraud Prevention

12.1 We use automated systems for fraud prevention, for example, screening device and IP signals at signup, flagging unusual referral or booking patterns, and applying referral clawback rules. These checks may lead to an account being blocked, a reward being held, or a wallet being frozen.

12.2 If an automated decision produces a significant effect on you (for example, blocking your account or holding a reward), you may request human review through Contact and Support below. A human will re-examine the decision.

13. Data Breach Notification

13.1 If we experience a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, as required by the NDPA 2023 (§40).

13.2 Where the breach is likely to result in a high risk to you, we will also notify affected users without undue delay, explaining what happened, what we have done, and what you can do to protect yourself.

13.3 Our incident-response procedures cover detection, containment, investigation, notification, and remediation, and are reviewed regularly.

14. Contact and Support

We aim to respond to every message within a few business days. Security-related reports are prioritized.

• Data Protection Officer: privacy@passionategammerz.com (data rights, breaches, complaints)
• General support: support@passionategammerz.com
• Legal matters: legal@passionategammerz.com
• Postal address: Passionate Gammerz International (BN 9741105), 930251 Jingi, Abattoir, Jos South LGA, Plateau State, Nigeria
• Regulator: Nigeria Data Protection Commission, ndpc.gov.ng

15. Accountability and Compliance

15.1 Data Protection Officer (DPO). We have designated a DPO who oversees compliance with this policy and the NDPA 2023. Contact the DPO at privacy@passionategammerz.com.

15.2 Registration. We will register with the NDPC as required for data controllers of major importance, and we will comply with the NDPC's regulations, guidelines, and directives as they evolve.

15.3 Records and audits. We maintain records of processing activities, data-protection impact assessments where required, and regular internal reviews of our security and privacy practices.

16. Changes to This Policy

16.1 We may update this policy as the Platform grows or as law requires. Material changes will be notified at least 7 days before they take effect by email, in-app notice, or a prominent banner, and each version carries its effective date and version number at the top of this page. Changes required for legal, security, or regulatory reasons may take effect immediately.

16.2 Continued use of the Platform after a change takes effect constitutes acceptance of the updated policy. If you do not accept the changes, you may close your account.

Chat and Messaging Policy

The rules below cover your privacy rights in a private conversation on the Platform, and the limited basis on which our team may ever review one.