At Gbajọ, we hold your data the same way our co-operatives hold money — collectively, transparently, and with the consent of every member. This page explains exactly what we collect, why, and the rights you have over it.
What we collect.
To run a co-operative on Gbajọ, we collect three categories of information. We collect only what we need to operate, secure, and improve the platform — nothing more.
Information you give us
- Identity data. Your full name, date of birth, government-issued ID number, and a verification photo — required for compliance with anti-money-laundering laws.
- Contact data. Your email, phone number, and physical address.
- Financial data. Bank account or mobile money details, contribution amounts, transaction history, and any documents you upload to support a pool or loan request.
- Co-operative data. The circles you belong to, your role within each, votes cast, and any messages or comments you post in shared spaces.
Information we collect automatically
- Device & usage data. Device type, operating system, IP address, browser, time zone, and how you interact with the platform.
- Location data. Approximate location based on IP. We do not collect precise GPS data unless you explicitly enable it for a specific feature.
- Logs. Server logs of API calls and authentication events — retained for security and audit purposes.
Information from third parties
When you sign up, we may verify your identity through licensed KYC providers. When you link a bank account, your financial institution shares only what is needed to confirm ownership and transfer funds.
Why we collect it.
We process your data on a few specific legal bases. Each piece of data has a clear purpose tied to a service you've asked for or a legal obligation we must meet.
"We never sell your personal data. We never use it to train AI models. We never share it with advertisers."
How we protect it.
Trust isn't a marketing word for us — it's the entire product. We invest heavily in keeping your data safe.
- Encryption everywhere. All data is encrypted in transit (TLS 1.3) and at rest (AES-256). Sensitive fields are additionally encrypted at the application layer.
- Multi-signature controls. No single Gbajọ employee can move money or access bulk data alone.
- Audit trails. Every system access, every contribution, every payout is logged and reviewed.
- Regular audits. We undergo annual SOC 2 Type II audits and quarterly penetration tests by independent firms.
- Bug bounty. Security researchers can report issues responsibly through our public program.
Your rights.
Under data protection laws including the Nigerian Data Protection Act, the GDPR, and similar frameworks, you have meaningful rights over your data.
- Access. Request a copy of all data we hold about you.
- Correction. Update anything that's inaccurate.
- Deletion. Request erasure, subject to records we must retain by law.
- Portability. Export your data in a structured, machine-readable format.
- Objection. Object to processing for direct marketing or based on legitimate interests.
- Restriction. Ask us to pause processing while a concern is investigated.
- Withdraw consent. Opt out of any optional data use at any time, with no penalty.
You can exercise most of these rights directly from your account settings. For anything that needs human review, email [email protected] — we respond within 30 days.
How long we keep it.
We keep your data only as long as we have a clear reason to.
- Active account data — for as long as your account is active.
- Transaction records — 7 years after the transaction, as required by financial regulations.
- KYC documents — 5 years after account closure, as required by AML laws.
- Marketing data — until you unsubscribe, then deleted within 30 days.
- Server logs — 90 days, then anonymised or purged.
Children's privacy.
Gbajọ is for adults. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact [email protected] and we will remove the account and any associated data.
International transfers.
Gbajọ operates across Nigeria, Ghana, Kenya, and other markets. Your data is primarily stored in the region closest to you, with encrypted backups in secondary regions for disaster recovery.
When data crosses borders, we use Standard Contractual Clauses, equivalent legal mechanisms, or rely on adequacy decisions to ensure your data remains protected to the standard of your home jurisdiction.
Changes to this policy.
The internet, the regulations, and our product all evolve. When we make material changes to this policy, we'll notify you by email and through the app at least 30 days before the changes take effect, giving you time to review and respond.
Minor clarifications, typo fixes, or non-material updates may be published without notice — but the version number and date at the top of this page always reflect the current state.
Talk to a real human.
If anything in this policy is unclear, or you want to exercise a right, our privacy team is here. We aim to reply within two business days.