Privacy Policy

1. Introduction

Your privacy is important to Survvo Insights and Technology Ltd ("Survvo", "we", "us", or "our"). This Privacy Policy explains how we collect, use, share, retain and protect Personal Information when you visit our website, use our services, participate in surveys or research activities, communicate with us, or interact with our digital platforms.

We process Personal Information in accordance with applicable data protection laws in Nigeria, including the Nigeria Data Protection Act 2023 and relevant directives or guidance issued by the Nigeria Data Protection Commission.

This Privacy Policy applies to survey respondents, participants, researchers, client representatives, website visitors, partners, vendors and other individuals whose Personal Information we process in connection with our services.

• Personal Information or Personal Data: any information relating to an identified or identifiable natural person.
• Processing: includes collection, recording, storage, use, disclosure, transfer, restriction, erasure or any other operation performed on Personal Information.
• Sensitive Personal Data: information requiring higher protection under applicable law, such as health information, biometric data, genetic data, religious or similar beliefs, political opinions, trade union membership, criminal records and other legally protected categories.

In some cases, we decide why and how Personal Information is processed. In other cases, we process information on behalf of a researcher or client organisation that determines the purpose of a survey or study. Where a separate survey-specific privacy notice is provided, that notice should be read together with this Privacy Policy.

2. Scope of this Privacy Policy

This Privacy Policy applies to Personal Information we collect or receive through our website, digital platforms, survey links, research services, email, support channels, business communications and related services.

It also applies where we process Personal Information for account management, participant verification, research matching, rewards or payouts, client support, service administration, legal compliance, security and other related purposes.

If a particular survey, study or feature has its own privacy notice or consent wording, that notice will explain any additional or different processing that applies to that activity.

3. Personal information we collect

The Personal Information we collect depends on how you interact with us and the services you use. It may include:

• Identity and profile information: name, age or age range, date of birth, gender, state or location, employment status, income bracket, role, organisation, participant reference number, account identifiers and other information needed to provide our services.
• Account and contact information: name, email address, telephone number, password in hashed form, account preferences, organisation details, billing contact details and support or enquiry details.
• Research-matching information: information about your work, education, device and connectivity, household, consumer behaviour, financial behaviour, media consumption, preferences and other information you choose to provide to help match you with relevant studies.
• Transaction, payout and reward information: studies completed, rewards earned, payout method, partial bank account details, phone number for airtime, payout history, balance, invoice records, payment references and transaction records.
• Engagement and usage information: studies offered, accepted or declined, completion status, completion times, referrals, notifications, dashboard activity, survey link access records, website usage information, device and browser information, IP address and system logs.
• Survey or study responses: opinions, preferences, feedback, ratings, comments or other information requested for a particular research activity.
• Correspondence information: messages, support requests, complaints, enquiries, account management communications and our responses.
• Client study data: study briefs, targeting criteria, survey URLs, budgets, study metadata, campaign instructions and research requirements.

For transaction, payout and reward information, we process only the information reasonably necessary to process payments, rewards, billing, reconciliation, tax, accounting, audit, anti-fraud and dispute-resolution requirements.

Some surveys or identity verification where applicable may be hosted by researchers, clients or third-party platforms, and their own privacy notices may also apply.

We may also process technical and usage information relating to access to survey links, such as time of access, device or browser information, IP address, referral source, delivery status, response status and system logs, where this is necessary for security, troubleshooting, reporting or service delivery.

For business operations, we may process client representative details, vendor information, correspondence, support requests, contract records, invoices and similar administrative information. We do not intentionally collect more Personal Information than is necessary for the relevant survey or service purpose.

4. Legal basis for processing

We process Personal Information in accordance with lawful bases recognised under the Nigeria Data Protection Act 2023, including consent, performance of a contract, compliance with legal obligations, protection of vital interests, performance of a task carried out in the public interest, and legitimate interests where such interests are not overridden by the rights, freedoms and interests of the data subject.

• Performance of a contract: where processing is necessary to create and operate accounts, provide access to surveys or studies, manage researcher or client engagements, process billing, route respondents or participants to study tools, confirm completion, administer rewards or payouts, and provide support connected with our services.
• Consent: where required for optional profile sections, Sensitive Personal Data, marketing communications, non-essential cookies, specific study disclosures, use of direct identifiers in a particular study, and any future use of identifiable Personal Information for AI training, dataset licensing or model evaluation.
• Legal obligation: where processing is necessary to comply with tax, accounting, KYC, anti-fraud, anti-money-laundering, regulatory reporting, court orders, law-enforcement requests or other applicable legal requirements.
• Legitimate interests: where processing is necessary to secure the platform, prevent fraud or misuse, detect duplicate accounts, improve services, conduct internal analytics, maintain audit trails, enforce our terms, resolve disputes, protect our rights and support ordinary business administration, provided that we balance those interests against the rights and freedoms of affected individuals.

Where a researcher or client organisation is responsible for a particular survey or study, that organisation may also have its own lawful basis for processing the information collected through that activity.

Where consent is relied upon, individuals may withdraw consent as provided by law. Withdrawal of consent may affect continued participation in a survey or our ability to provide certain services.

5. Special categories of personal data

Some optional profile fields, research-matching criteria, survey questions or study-level responses may relate to Sensitive Personal Data, including health information, ethnic origin, political opinions, biometric or identity-verification information, or other protected categories. We process such information only where there is a valid lawful basis, explicit consent where required, and appropriate safeguards. Where the information is optional, individuals may decline to provide it, although this may affect eligibility for certain studies or features.

6. Use of personal information

We use Personal Information to provide and operate our services, create and manage accounts, verify identity or eligibility, match participants with relevant studies, provide access to surveys, support research activities, communicate with users, process rewards or payouts, provide customer support and maintain service records.

We may also use Personal Information to manage client relationships, process billing, improve our services, maintain security, prevent fraud or misuse, resolve disputes, comply with legal obligations and enforce our terms.

We may use de-identified, aggregated or anonymised information for analytics, service improvement, operational reporting and business planning, provided that the information no longer identifies an individual or is not reasonably capable of being used to identify an individual.

We will not sell raw survey responses or identifiable participant data. We will use identifiable Personal Information for AI training, dataset licensing or model evaluation only where the data has been anonymised so that it cannot reasonably be linked back to an individual, or where the individual has given separate, explicit, opt-in consent for that purpose.

7. Automated processing, profiling and AI-assisted tools

We may use automated or AI-assisted tools to support matching, fraud prevention, service improvement, support routing, analytics and other operational purposes. We do not use these tools to make decisions that produce legal or similarly significant effects on you without appropriate safeguards. If you believe an automated matching or profiling outcome has affected you unfairly, you may contact us to request human review.

8. Third party data sharing

We may share Personal Information with:

• researchers or client organisations connected with a survey or study;
• payment and payout partners, and identity verification providers;
• survey platform providers, and messaging and email providers;
• cloud and technology providers, and analytics and error monitoring providers;
• professional advisers; and
• other service providers that help us deliver, secure and administer our services.

We may disclose Personal Information to regulators, courts, government agencies or law enforcement authorities where required by law, necessary to comply with legal obligations, protect rights, prevent fraud, respond to lawful requests or enforce agreements.

Where we engage service providers to process Personal Information for us, we require them to protect the information, process it only for authorised purposes and comply with applicable data protection obligations.

Where rewards or payouts are processed, we may disclose only the information necessary to complete the transaction to payment, airtime, banking, wallet, settlement, identity-verification or off-ramp partners. This may include payment amount, phone number, bank details, payout reference, transaction identifiers or other information required to complete, verify or reconcile the transaction.

We do not sell survey response data. Any transfer of Personal Information in connection with a merger, acquisition, restructuring or business transfer will be subject to appropriate safeguards.

9. Data retention

We retain Personal Information only for as long as necessary for the purposes for which it was processed, including survey facilitation, project records, reporting, contract administration, legal compliance, dispute resolution and security.

Retention periods vary depending on the type of information and the reason it was collected. For example:

• account and profile information is generally kept while the account or relationship is active and for a reasonable period afterwards;
• transaction, payout, tax and accounting records may be kept for the period required by law; and
• anonymised information may be retained for analytics, research, service improvement and business planning.

10. Data security

We use appropriate technical and organisational measures to protect Personal Information against unauthorised access, alteration, loss, misuse or disclosure. These measures may include encryption, access controls, authentication, monitoring, secure development practices and confidentiality obligations.

Access to Personal Information is restricted to authorised personnel who require such access for legitimate business purposes and who are bound by confidentiality obligations.

While we take all reasonable precautions, no system of electronic storage or transmission is entirely secure, and we cannot guarantee absolute security of your information.

11. Data subject rights

In accordance with the NDPA, individuals whose Personal Information we process have certain rights. These include the right to:

• be informed about how their data is used;
• access their Personal Information;
• request correction of inaccurate or incomplete data;
• request deletion of their Personal Information where legally permissible;
• object to certain forms of processing;
• withdraw consent where processing is based on consent;
• request restriction of processing in appropriate circumstances; and
• request data portability, where applicable.

Data subjects have the right to lodge complaints with the Nigeria Data Protection Commission if they believe their rights have been violated.

To exercise your rights, contact us using the details in the Contact information section. We may ask for information reasonably necessary to confirm your identity and locate the relevant records.

12. Cookies and digital tracking

Our digital platforms use cookies and similar technologies to improve functionality, enhance user experience, and analyse system usage. These technologies help us understand how users interact with our services and allow us to optimise performance and security.

Users may control or disable cookies through their browser settings, although this may affect certain functionalities of our services.

Where legally required, we will seek consent before placing non-essential cookies or similar tracking technologies. Essential cookies may be used where necessary to provide security, authentication, service continuity or requested functionality.

13. International data transfers

Where Personal Information is transferred outside Nigeria, we ensure that such transfers comply with applicable data protection requirements. This includes ensuring that the receiving country provides adequate protection or that appropriate safeguards, such as contractual clauses or regulatory approvals, are in place.

Where we transfer Personal Information internationally, we rely on legally recognised safeguards such as adequacy decisions, contractual safeguards or other measures permitted by applicable data protection law.

14. Children's data

Our services are not directed at individuals under the age of eighteen. We do not knowingly collect Personal Information from minors without appropriate authorisation. Where such data is discovered, we take immediate steps to delete it.

If we become aware that we have collected Personal Information from a child without the required consent or authorisation, we will take reasonable steps to delete it or otherwise handle it in accordance with applicable law.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Where we make material changes, we will take reasonable steps to notify users, such as by posting the updated version on our website or through other appropriate channels. The "Last updated" date shows when this Privacy Policy was last revised.

16. Contact information

If you have any questions, concerns, or requests regarding this Privacy Policy or the way we process your Personal Information, you may contact us using the details below: