Privacy notice

This notice explains how 100percenta.io ("we"), the data controller for 100percenta.io (https://100percenta.com), collects and uses personal data, as the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Commission's General Application and Implementation Directive (GAID) 2025 require.

1. Who we are and how to reach us

• Controller: 100percenta.io, address given on request.
• Privacy contact: the address on our Contact page.

2. What we collect, why, and on what lawful basis

Data	Why we use it	Lawful basis (NDPA s.25)
Name, email, password (stored only as a hash), optional phone	To create and run your account, sign you in and contact you about it	Contract
Plan purchases: plan, amount, date, Paystack reference	To give you the plan you paid for, keep accounts and handle refunds	Contract; legal obligation (tax and accounting records)
Sign-in security data: IP address, browser and device type, a device cookie, sign-in times, failed attempts, two-step sign-in secret (encrypted)	To keep accounts safe: lock out password guessing, tell you about sign-ins on new devices, investigate misuse	Legitimate interest (security)
What you add: bets you track, picks you lock in the notary, chances in the forecasting league, match reports, your tipster handle	To provide those features; locked picks, league chances and reports are public by design	Contract
Phone number for morning texts, browser notification subscription	To send the texts and notifications you asked for	Consent (you can turn them off at any time)
Analytics cookies (only if you accept them)	To understand which pages are used, to improve the site	Consent
Messages you send us	To answer you	Legitimate interest

We do not use your data for automated decisions that have legal or similarly significant effects on you, and we do not sell it.

3. Who receives it

We share personal data only with providers that process it for us under contract, or where the law requires:

• Paystack (payments): your payment is made on Paystack's checkout; card and bank details go to Paystack, never to us.
• Our hosting provider, where the site and its database run.
• Email and SMS providers (for account emails, security alerts and texts you asked for).
• Google Analytics, only if you accept analytics cookies.
• Authorities, when the law requires it.

Your public handle and what you publish under it (notary picks, league board, reports) can be seen by anyone.

4. Transfers outside Nigeria

Some providers (for example hosting, email or analytics) may store data outside Nigeria. We transfer personal data abroad only as sections 41 to 43 of the NDPA allow: to a country with adequate protection, or with appropriate safeguards such as contractual clauses, or with your consent.

5. How long we keep it

• Account data: while your account is open, and up to 2 years after it is closed, unless you ask us to delete it sooner.
• Payment records: 6 years, for tax and accounting.
• Sign-in and security records: 12 months.
• The audit log of staff actions: kept for good, as a security record.
• Picks locked in the notary and the public ledger: kept for good, because the public record depends on them; if you close your account they stay under your handle.

6. Your rights

Under the NDPA you may:

• be informed about how we use your data (this notice);
• access your data and get a copy (s.34);
• have inaccurate data corrected (s.34);
• have data erased where there is no reason for us to keep it (s.34);
• restrict our use of it in certain cases (s.34);
• object to our use of it, including for direct marketing (s.36);
• receive your data in a structured, machine-readable format, or have it sent to another controller (s.38);
• withdraw consent at any time, for anything based on consent (texts, notifications, analytics cookies), without affecting what was done before (s.35);
• not be subject to decisions based solely on automated processing with legal or similarly significant effects (s.37).

Write to the address on our Contact page. We answer within 30 days. You may also complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

7. Security

Passwords are stored as one-way hashes; two-step sign-in secrets and webhook secrets are encrypted; all traffic uses HTTPS; staff accounts must use two-step sign-in, and every staff action is written to an audit log. If a breach is likely to put your rights at risk, we will tell the Commission within 72 hours and tell you without delay.

8. Children

The site is for adults 18 and over. We do not knowingly collect data from anyone younger; if we learn we have, we delete it.

9. Cookies

See our Cookie policy.

10. Changes

We will post any change here with a new date, and announce material changes on the site.