1. Scope of This Policy
This Privacy Policy applies to:
- Users of the Hypally website, mobile applications, and services
- Verified individual providers and business (CAC-registered) providers
- Visitors who browse Hypally without creating an account
- Government official accounts operating on Hypally in an institutional capacity
2. Legal Basis for Processing (NDPA Compliance)
Hypally processes personal data under the following lawful bases as defined by the Nigeria Data Protection Act (NDPA) 2023:
- Consent — where you have given explicit permission (e.g., submitting your NIN or CAC details for verification).
- Contractual necessity — to provide the services you request, including listing, booking, and payment facilitation.
- Legal obligation — to comply with Nigerian laws and regulations, including identity-verification and anti-fraud requirements.
- Legitimate interest — to ensure platform security, prevent fraud, protect community safety, and operate the trust and ranking systems described in Section 5.
Where identity verification (NIN or CAC) is performed, the applicable bases are consent (you choose to submit your details) and legal obligation/legitimate interest (verifying identity to keep the platform safe and accountable).
3. Categories of Personal Data We Collect
3.1 Individual Identity & Verification Data
Collected to confirm that individual users and providers are real and accountable, and to support the name, phone number, and age checks described in our verification process.
- Full name (as provided and as matched against NIN records)
- Phone number
- Date of birth / age
- Government-issued identity reference (NIN)
- Verification status and match result (e.g., name: matched, phone: unmatched, age: matched)
Hypally does not store your raw NIN number. We store a hashed or tokenised reference sufficient to confirm verification status, plus the match outcome for each field checked. Our verification partner processes the raw NIN number solely to perform the check and return a result; see Section 7 for how this is safeguarded and Section 12 for data localisation.
3.2 Business Verification Data
Collected from Tier 3 (CAC-verified) business accounts to confirm the business is genuinely registered and currently active.
- Business name and CAC registration (RC) number
- Registration status (e.g., active, inactive, struck-off)
- Names of current directors/officers as listed with the Corporate Affairs Commission
- Verification status and match result
Director names are matched against the business account holder's declared identity; we do not retain historical (resigned) director records beyond what is needed to complete verification.
3.3 Location & Neighbourhood Data
- City or Local Government Area
- Neighbourhood ("Hub") assignment
- Approximate location (non-precise)
Purpose: to deliver relevant local listings and neighbourhood content, and to reduce the risk of a provider or user falsely claiming a neighbourhood they are not actually in.
3.4 Account & Usage Data
- Login timestamps
- Device and browser identifiers
- Interaction logs (searches, views, clicks)
Purpose: security, fraud prevention, and platform improvement.
3.5 Trust & Reputation Data
This is data generated through your activity on Hypally that determines your trust badge and ranking, and is central to how the platform works — see Section 5.2 for how it is used.
- Completed-job confirmations and "Worked for me" community endorsements
- Complaint and dispute records
- Response-time and reliability metrics
- Resulting trust badge tier and any Featured Position or discount status derived from it
3.6 User-Generated Content
- Posts, comments, and reports
- Service reviews
- Marketplace listings
Purpose: enable community interaction and moderation.
3.7 Transaction & Commerce Data
- Transaction confirmations
- Dispute records
- Where applicable, records of paid Growth Tools, Featured Position bids, or performance-advertising charges
Purpose: fraud prevention, accountability, billing, and dispute resolution.
4. How We Use Personal Data
Hypally uses personal data for the following purposes:
- Identity and business verification, and fraud prevention
- Operating the trust and reputation system described in Section 5.2, including badge computation and ranking
- Maintaining platform safety and trust systems
- Delivering neighbourhood-relevant content and alerts
- Moderation and enforcement of community standards
- Providing customer support and service communications
- Improving platform reliability and performance
- Operating paid visibility features (Growth Tools, Featured Positions, performance advertising) and the internal audience-segmentation used to run them — see Section 5.3
Hypally does not share your personal data with third-party ad networks or brokers for behavioural advertising, and does not sell your data for advertising purposes. Section 5.3 explains the limited internal use of activity data to operate our own advertising features.
5. Trust Scoring, Ranking & Automated Processing
5.1 What this section covers
Hypally's trust badge and ranking system meaningfully affects a provider's visibility and, in some cases, their advertising costs and eligibility for paid features. This section explains how that works and what rights you have in relation to it, consistent with NDPA provisions on automated decision-making and profiling.
5.2 How trust badges and ranking are determined
- Your trust badge is calculated from the Trust & Reputation Data in Section 3.5 — completed jobs, community confirmations, complaint history, and responsiveness.
- Your badge affects your default ranking position among providers in your category and neighbourhood, your eligibility for certain paid features, and the price you pay for optional paid visibility features.
- No paid feature can move a provider above a higher-badge competitor in organic results — badge computation itself is never purchasable.
5.3 Internal use of activity data for advertising features
To operate Growth Tools, Featured Positions, and performance advertising, Hypally groups activity data into internal audience segments (for example, by category, neighbourhood, or past booking behaviour) to decide which listings or campaigns are shown to whom. This is an internal operating mechanism for our own advertising features, not a data-sharing arrangement with external advertisers, and is separate from third-party behavioural-advertising networks, which we do not use.
5.4 Your rights regarding automated processing
- You may request an explanation of how your current trust badge or ranking was determined.
- You may request human review of a badge or ranking outcome you believe is inaccurate, and provide supporting information.
- You will not be subject to a decision based solely on automated processing that produces a legal or similarly significant effect on you without the ability to request the review described above.
6. Data Sharing & Disclosure
Hypally shares personal data only when strictly necessary and under contractual safeguards:
- Verification partners — your name, phone number, date of birth, and/or CAC details are shared solely to perform identity or business verification and receive a match result.
- Other providers or customers, for leads — when you contact or are contacted through a booking, enquiry, or a paid performance-advertising lead, the minimum contact information needed to complete that interaction is shared with the other party.
- Payment processors — for community commerce transactions and billing of paid features.
- Hub/community sponsors — sponsors receive only aggregated, anonymised engagement statistics for the Hub or campaign they sponsor — never individual user data.
- Regulators or law enforcement — only where legally required.
Hypally does not sell or rent personal data to third parties.
7. Data Security Measures
- Encryption of data in transit and at rest
- Hashed and tokenised identifiers for government ID references
- Role-based internal access controls, with additional restrictions on who may access identity-verification and trust-scoring systems
- Audit logging and periodic security reviews
- Contractual data-protection obligations placed on verification partners and other processors
8. Data Retention
We retain personal data only for as long as necessary for the purposes described in this Policy:
| Data category | Retention period |
|---|---|
| NIN/CAC verification match result & hashed reference | For as long as the account remains active, plus 12 months after closure, unless a longer period is legally required. |
| Trust & reputation data | For as long as the account remains active; anonymised on account closure. |
| Transaction and dispute records | 6 years from the transaction or dispute date. |
| Account & usage logs | 12 months, after which they are aggregated or deleted. |
| User-generated content | Until you delete it or close your account, unless retained for moderation/legal purposes. |
| Closed accounts (all other data) | Deleted or irreversibly anonymised within 90 days of closure, unless a longer period is legally required. |
9. Your Rights Under the NDPA
Under the Nigeria Data Protection Act 2023, you have the right to:
- Access your personal data
- Request correction of inaccurate data
- Withdraw consent at any time
- Request the deletion of your data
- Object to or restrict processing
- Receive a copy of your data in a portable format
- Request human review of a decision based solely on automated processing that significantly affects you
- Lodge a complaint with the Nigeria Data Protection Commission (NDPC)
Requests can be made via privacy@hypally.com. We will respond within 30 days. To protect your data, we will take reasonable steps to verify your identity before actioning an access, correction, or deletion request.
10. Cookies & Tracking Technologies
Hypally uses limited cookies and similar technologies for security, session management, and performance analytics. We do not use invasive tracking or third-party behavioural-advertising cookies. Where required, you will be shown a cookie preference option allowing you to manage non-essential cookies.
11. Children's Data
Hypally is not intended for children under the age of 18. We do not knowingly collect data from minors. If we become aware that we have collected personal data from a minor, we will delete that data within 30 days of discovery, unless retention is required to comply with a legal obligation.
12. International Data Transfers & NIN Data Localisation
Where personal data is processed outside Nigeria, Hypally ensures appropriate safeguards consistent with the NDPA and applicable international standards, including contractual data-protection commitments from any processor involved.
National Identification Number (NIN) data is subject to additional restrictions under the NIMC Act. Hypally requires that any verification partner processing NIN data on our behalf does so on infrastructure located within Nigeria, and does not transfer raw NIN data outside Nigeria, unless NIMC has separately authorised that arrangement.
13. Data Breach Notification
If Hypally becomes aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission (NDPC) without undue delay, and will notify affected users directly where the breach is likely to result in a high risk to them, explaining what happened, what data was affected, and what steps we are taking.
14. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated clearly through the Platform, and the "Effective Date" above will be updated accordingly.
15. Contact Information
Data Controller: Hypally Limited
Email: privacy@hypally.com
Website: www.hypally.com
Hypally is built on the principle that trust, safety, and privacy are inseparable.